1

I set up a new HP MSR2004 router for a corporate network. The network uses an internal private net and has one static public ip address. Surfing the web and all tcp related things seem to work fine. As does dns via udp.

However, all UDP based services are not working properly. We are using an external SIP provider and the ip phones in the internal network constantly loose their registration and are not able to place outbound calls.

Here is the (sanitized) config file:

#
 version 7.1.064, Release 0605P20
#
 sysname gw-1
#
 ip icmp source 192.168.100.1
#
nat address-group 0
 address xxx.91.227.170 xxx.91.227.170
#
 nat mapping-behavior endpoint-independent
#
 dhcp enable
#
 dns proxy enable
 dns server 8.8.8.8
 dns server 8.8.4.4
#
 password-recovery enable
#
vlan 1
#
vlan 10
 name Management VLAN
#
vlan 11
 name Internal VLAN
#
vlan 12
 name Guest Wifi VLAN
#
vlan 20
 name Sublet 1 VLAN
#
qos map-table dscp-lp
 import 6 export 6
#
traffic classifier highprio operator and
 if-match acl name sip
#
traffic behavior communication
#
traffic behavior highprio
 remark local-precedence 7
#
qos policy communication
 classifier highprio behavior highprio
#
 stp mode rstp
 stp global enable
#
dhcp server ip-pool guest
 gateway-list 192.168.210.1
 network 192.168.210.0 mask 255.255.255.0
 address range 192.168.210.10 192.168.210.200
 dns-list 192.168.210.1
 expired day 0 hour 4
#
dhcp server ip-pool internal
 gateway-list 192.168.200.1
 network 192.168.200.0 mask 255.255.254.0
 address range 192.168.200.10 192.168.201.200
 dns-list 192.168.200.1
 expired day 0 hour 8
#
controller Cellular0/0
#
interface Aux0
#
interface NULL0
#
interface Vlan-interface10
 ip address 192.168.100.1 255.255.255.0
#
interface Vlan-interface11
 ip address 192.168.200.1 255.255.254.0
 packet-filter 3000 inbound
 qos apply policy communication inbound
#
interface Vlan-interface12
 ip address 192.168.210.1 255.255.255.0
 packet-filter 3000 inbound
 packet-filter 3001 inbound
 qos apply policy communication inbound
#
interface Vlan-interface20
 packet-filter 3000 inbound
#
interface GigabitEthernet0/0
 port link-mode route
 ip address xxx.91.227.170 255.255.255.248
 tcp mss 1460
 packet-filter name external inbound
 nat outbound address-group 0 port-preserved
#
interface GigabitEthernet0/1
 port link-mode route
#
interface GigabitEthernet0/2
 port link-mode route
#
interface GigabitEthernet0/27
 port link-mode route
#
interface GigabitEthernet0/3
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 12 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/4
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 12 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/5
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 12 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/6
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 12 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/7
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 12 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/8
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 12 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/9
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 12 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/10
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 12 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/11
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/12
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/13
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/14
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/15
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/16
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/17
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/18
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
 port hybrid pvid vlan 10
#
interface GigabitEthernet0/19
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/20
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 12 tagged
 port hybrid vlan 1 untagged
 port hybrid pvid vlan 10
#
interface GigabitEthernet0/21
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
 port hybrid pvid vlan 10
#
interface GigabitEthernet0/22
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/23
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/24
 port link-mode bridge
 port link-type hybrid
 port hybrid vlan 10 to 11 tagged
 port hybrid vlan 1 untagged
#
interface GigabitEthernet0/25
 port link-mode bridge
 port access vlan 11
#
interface GigabitEthernet0/26
 port link-mode bridge
 port access vlan 10
#
 scheduler logfile size 16
#
line class aux
 user-role network-admin
#
line class tty
 user-role network-operator
#
line class vty
 user-role network-operator
#
line aux 0
 user-role network-admin
#
line vty 0
 user-role network-operator
#
line vty 1
 authentication-mode scheme
 user-role network-operator
#
line vty 2 63
 user-role network-operator
#
 ip route-static 0.0.0.0 0 xxx.91.227.169
#
 ssh server enable
 ssh user admin service-type all authentication-type password
#
 ssh2 algorithm cipher aes256-cbc
#
 ntp-service unicast-server ptbtime1.ptb.de
#
acl advanced 3000
 rule 0 deny tcp destination 192.168.100.0 0.0.0.255
 rule 1 deny udp destination 192.168.100.0 0.0.0.255
#
acl advanced 3001
 rule 0 deny ip destination 192.168.100.0 0.0.0.255
 rule 1 deny ip destination 192.168.200.0 0.0.0.255
#
acl advanced name external
 rule 0 permit icmp
 rule 5 permit tcp established
 rule 15 permit udp source-port eq dns
 rule 20 permit udp destination-port gt 1024
 rule 21 permit udp
 rule 25 permit 115
 rule 9999 deny ip
#
acl advanced name sip
 rule 0 permit tcp destination-port range 5060 5061
 rule 5 permit udp destination-port range 5060 5061
#
domain system
#
 domain default enable system
#
role name level-0
 description Predefined level-0 role
#
role name level-1
 description Predefined level-1 role
#
role name level-2
 description Predefined level-2 role
#
role name level-3
 description Predefined level-3 role
#
role name level-4
 description Predefined level-4 role
#
role name level-5
 description Predefined level-5 role
#
role name level-6
 description Predefined level-6 role
#
role name level-7
 description Predefined level-7 role
#
role name level-8
 description Predefined level-8 role
#
role name level-9
 description Predefined level-9 role
#
role name level-10
 description Predefined level-10 role
#
role name level-11
 description Predefined level-11 role
#
role name level-12
 description Predefined level-12 role
#
role name level-13
 description Predefined level-13 role
#
role name level-14
 description Predefined level-14 role
#
user-group system
#
local-user admin class manage
 password hash xxx
 service-type ssh telnet terminal http
 authorization-attribute user-role network-admin
 authorization-attribute user-role network-operator
#
cwmp
 cwmp enable
#
return

UPDATE: The device supports NAT ALG for multiple protocols, SIP being one of them. There's no difference with or without ALG. However, looking at the sip packets received by the asterisk server, the body is rewritten correctly by the SBC. Incoming calls are working fine, including audio. This leads me to the conclusion, that the must be something wrong with the outgoing udp packets not being tracked/PAT'ed correctly. I might be totally off though!

How can I debug/solve this issue?

|improve this question
  • Please edit your question to include the necessary information. You can read the Network Engineering Question Checklist for guidance. We cannot simply guess or speculate, and remember that host/server questions and questions about protocols above OSI layer-4 are off-topic here. – Ron Maupin♦ May 28 '18 at 18:50
  • Just updated the question, please review. – Daniel Becker May 31 '18 at 18:44
  • Unfortunately, if you really knew what the relevant parts of the configuration are, then you could probably solve the problem. Very often, other parts of a configuration can have a profound effect on what you are doing. You should include the full (sanitized) configuration, as well as any logs or debugs. What are the timeouts you have set (or the defaults if you didn't set them) for UDP through NAT? What do the logs say when you have a problem? – Ron Maupin♦ May 31 '18 at 18:50
  • That's a good point. Let me add the full config. – Daniel Becker May 31 '18 at 19:11
  • I'v added the full config. I don't have any logs or anything else. I could include a system-diagnostic output. But that might be a bit lengthy. – Daniel Becker May 31 '18 at 19:15
1

It turns out that sip never was the problem. The ip phones (Snom D710) send dns requests to determine if there's a SRV record for sip for that domain. The router discarded the dns requests instead of replying with domain not found. So the phone kept trying for a minute before initiating the call.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.