Hi,

We have an issue with SIP packets through our Mikrotik hAP ac Lite. We have a VoIP-device in the network, but it is not receiving incoming calls.

When we make some traces we see that the VoIP-PBX is sending SIP INVITES, they are reaching the router. But not forwarded to the VoIP-device in the network.

What can be the problem and how to solve this?

I've attached a packet sniff on the Mirkotik.
Best regards,
Joost Lauwen

please post your config

please post your config

/interface bridge
add admin-mac=64:D1:54:56:0C:8E auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full comment=\
UPLINK speed=1Gbps
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.1.10-192.168.1.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge network=\
192.168.1.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server lease
add address=192.168.1.252 mac-address=00:0D:B9:49:B4:16 server=defconf
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=8.8.8.8,8.8.4.4 \
gateway=192.168.1.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=x.x.x.x list=RemoteManagement
add address=x.x.x.x list=PINGlist
add address=x.x.x.x list=PINGlist
add address=x.x.x.x list=AXS2COM
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp \
src-address-list=PINGlist
add action=accept chain=input comment="Allow Remote Management" \
src-address-list=RemoteManagement
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=input comment="Drop External Acces to DNS" dst-port=53 \
in-interface-list=WAN protocol=tcp
add action=drop chain=input dst-port=53 in-interface-list=WAN protocol=udp
add action=drop chain=input comment="Block External Acces to Ports" dst-port=\
21,22,23,80,443,8291,8728,8729 in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=50080
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/tool sniffer
set file-name=sniff.pcap filter-ip-protocol=udp filter-port=sip,rtp

Is the phone registered with the PBX? If there is no connection (under IP > Firewall > Connections) the incoming packets have nowhere to go and will be dropped.

There is little point setting 1000M-half,1000M-full on ether1 as the device only supports fast, not gigabit, ethernet.
The Drop External Acces to DNS and Block External Acces to Ports input rules are unnecessary due to the defconf: drop all not coming from LAN rule.

Hi tdw,

Yes, the Anynode-device is registered to our PBX. And it is registering every 3 minutes.
Best regards,
Joost Lauwen

We always disable SIP helper in MikroTik and this solve us problems. IP > Firewall > Service Ports

We always disable SIP helper in MikroTik and this solve us problems. IP > Firewall > Service Ports

We've already disabled SIP ALG/Helper in the config. Without any success.
I've also tried to create a NAT-rule to forward all the SIP-traffic to the IP-address of the VoIP-device.

The device is not a standard VoIP-phone, like Cisco, Gigaset. But an AnyNode SBC.

Do you see the registration messages between the Mikrotik and SBC in the packet trace in both directions (SBC -> Mikrotik and Mikrotik -> SBC)

Yes, I see the REQUEST, REGISTER and BINDING packages.
So the registration packages are OK.

Yes, the Anynode-device is registered to our PBX. And it is registering every 3 minutes.

Have you tried to increase the udp-stream-timeout to 5m in /ip/firewall/connection/tracking ?
The default value is 3m (minutes), same as your phone's register interval. Maybe the connection times on small interval delays.

Yes, the Anynode-device is registered to our PBX. And it is registering every 3 minutes.

Have you tried to increase the udp-stream-timeout to 5m in /ip/firewall/connection/tracking ?
The default value is 3m (minutes), same as your phone's register interval. Maybe the connection times on small interval delays.

Changed it, without any luck.

Sometimes the best way to discover a voip problem is run the syslog on the Anynode-device and after reboot watch the entry... this way help me the most in my scenario. VoIP devices generally not have logs but a syslog they are almost all (in Poland market).

When we make some traces we see that the VoIP-PBX is sending SIP INVITES, they are reaching the router. But not forwarded to the VoIP-device in the network.

Since you haven't shown the filter condition you used when sniffing the traffic on the Mikrotik, it is not clear whether the Mikrotik indeed doesn't forward the INVITEs to the AnyNode or whether it does but they got somehow lost on their way there.

If the SIP helper is disabled, Mikrotik doesn't inspect the SIP payload, so it treats the INVITEs just like any other UDP packets, i.e. the L4 contents of the packets should play no role.

If the IP of the registrar is the same like the source IP of the INVITEs, which should be the case, you do not need a dst-nat rule for the INVITEs to be redirected from the WAN IP of the Mikrotik to the LAN IP of the AnyNode, as the UDP packets carrying those INVITEs are considered response packets in the connection created by the first REGISTER.

So first, I'd like to see what /tool sniffer quick ip-address=5....101 (the address of the PBX, not writing it in full as you took the effort to hide it in the OP) shows when you make the incoming call attempt (INVITEs from the PBX address towards your WAN). Normally, you should see the packet on the WAN interface with the 217... as destination address, and then once again on the LAN interface, with the IP address of the AnyNode as the destination one. If this is not the case, something is rotten with the routing on the Mikrotik, but according to the configuration export you've posted, the only external causes I can imagine are a failure to obtain the MAC address of the AnyNode, or some MTU issue on the LAN if the INVITE is huge and the MTU of the LAN on the Mikrotik is higher than the actual one of the AnyNode. Which reminds me of a case where a default configuration of some Mikrotik model/CPU architecture had a MTU of 1600 or so on the bridge, and the symptoms were similar, except that the INVITE was coming encrypted in an IPsec transport packet as it was a VoWiFi scenario.

Also, your configuration export doesn't match the connection state - the connection you have shown is fasttracked but there is no action=fasttrack rule in the export. Not that it would change anything as such, but maybe you have removed also some other "unrelated" configuration before posting the export?

Hi Sindy,

My sniffer was configured like this: I've used your sniffer-rule, but I have the same result. Only SIP INVITES to ourpublic-ip, and not to the anynode.

Our firewall has the default config loaded for now, with some extra rules. We've used the basic config for this routerboard.

1. The reason why I've suggested to filter on the PBX IP address rather that on SIP port was that if the router was eventually sending some ICMP feedback, your filter would not capture it.

2. When you let the sniffer run for more than 3 minutes, so that a re-registration could take place, can you see the registrar responses (200 and possibly 401/407) to be sent to the anynode address?

3. what is the Ethernet size of the received INVITEs, and what is the actual-mtu value of the bridge interface of the Mikrotik?

1. Here's the trace 2. Yes, register en re-register is working. The anynode SBC is also registered to our PBX.

3. Actual MTU = 1500, Size of the received invite is 1161 bytes

Maybe overly simplifying it, but if the device can register, but cannot receive calls, sounds like the PBX cannot reach the endpoint device on port 5060. Open that port up to the device and I'll bet it works.

The trace shows that the router does not just drop the INVITEs but it notifies the sender about an issue with them. To confirm that, look inside the ICMP "deatination unreachable" packets, you should see the beginning of the INVITE packets there, at least the IP and UDP headers.

It seems as if their destination address was not the router's WAN address but nevertheless they did arrive to it. Could it be that the AnyNode determines some other public IP using e.g. STUN, sends the determined public IP in the Contact field of the register, and the PBX uses that other public address from Contact rather than the one from which the REGISTER has actually arrived to it? The Mikrotik configuration doesn't suggest that, but maybe there are some more routers there?

I would have to see the actual capture file to say more, with both the REGISTER exchange and the INVITE, to say something more specific.

Guess I should have said forward that port.

It is already open by way of the connection tracking shown in post #5.

Getting ICMP host unreachable responses points to something more complex, hence the requests to see a packet trace of the registration process.

The trace shows that the router does not just drop the INVITEs but it notifies the sender about an issue with them. To confirm that, look inside the ICMP "deatination unreachable" packets, you should see the beginning of the INVITE packets there, at least the IP and UDP headers.

It seems as if their destination address was not the router's WAN address but nevertheless they did arrive to it. Could it be that the AnyNode determines some other public IP using e.g. STUN, sends the determined public IP in the Contact field of the register, and the PBX uses that other public address from Contact rather than the one from which the REGISTER has actually arrived to it? The Mikrotik configuration doesn't suggest that, but maybe there are some more routers there?

I would have to see the actual capture file to say more, with both the REGISTER exchange and the INVITE, to say something more specific.

You can download the trace here.

It's without the REGISTER-exchange. I will create a larger trace for that

https://www.dropbox.com/t/pNeOjCO1Yz4i3Chk

This is trace is more complete.

It contains an call to the Anynode and a registration of the Anynode to our PBX.

https://www.dropbox.com/t/n6EphvLRkk8ex0E4

From the larger sniff above it seems the issue is even more complicated than it seemed initially. It shows that the first call did get through (it did not start ringing, but the AnyNode did send a 100, and once the CANCEL has arrived from the PBX, the AnyNode has sent both the 200 to the CANCEL and the 487 to the INVITE), so all good here. The second call was also fine up to the 100, but all of a sudden the CANCEL a few seconds later got rejected with ICMP host unreachable, and any subsequent retransmissions of the CANCEL and also of the ACK to the 503 are rejected with the same ICMP host unreachable. The responses to the subsequent REGISTER are forwarded normally.

So the contents of the INVITE is not the root cause, nor are wrong IP addresses - all the traffic uses same IP addresses and UDP ports.

No ideas at the moment.

As the Mikrotik is responding with ICMP host unreachable that suggests the issue is with the Mikrotik - AnyNode connection. If the ARP table entry expires and is not refreshed for some reason the Mikrotik would send that response.

Mikrotik does have a SIP-ALG that you likely want to disable.. IP - Firewall - Service Ports

If just your SIP phone/ATA is behind your Mikrotik router, change your SIP device's "local SIP port" ran into this with one site a couple weeks ago. SIP-ALG had no effect, changing the local SIP port fixed all issues immediately. Pick a random number between 10000 and 65534.

Had this same issue a couple weeks ago at a site using a SPA2102.

Unless the SIP client is the PBX, then something else will be needed.

If the ARP table entry expires and is not refreshed for some reason the Mikrotik would send that response.

I have seen devices to be lazy to respond to ARP requests under load, maybe AnyNode is one of these? If so, a workaround could be to set a static ARP record for it on the Mikrotik. Doing so will at least show whether the temporarily missing ARP record due to late or no response to ARP request is the actual reason why the packets are not forwarded.

Looking at the 2nd capture At packet #241-243 the SIP host sends 3x SIP CANCEL, which the MikroTik fails to deliver to the PBX and hence bounce with ICMP code 3 (Host unreachable).
After that (starting at #254), the PBX on 192.168.1.252 starts responding again, but never with something else than "500 Internal Server Error" for the rest of the trace.

The internal LAN part of the capture does not show any ARP or ICMP packages. Was there any filtering in place?
Looking at the time stamps of the SIP CANCEL and the ICMP Host unreachable, it looks like the MikroTik tries to do ARP resolution for the PBX, gets no response and than bounces with ICMP Host unreachable. One guess would be the PBX "stalls" (hangs?) in a way not even responding to ARP requests for some seconds, than comes back and sticks in some 500 Internal Server Error error state.

Another observation (not sure if related):
In the capture before the part in the screenshot, the PBX sends STUN BINDING REQUESTs every few seconds. After getting binding success from the STUN server, it immediatly sends the next STUN binding request again and again.

I add some my thinking too.

Fist capture have two SIP converstions, two differ sip tag... thats we can see differ color's in Flow diagram. This is the same with the OP original screenshot #1 from his wireshark even when communication is between the same IPs.
On the SIP/SDP packages we can see that Media Port, each is differ in each conversation.. and those are 11140 and 13866 udp... question if that udp is open in forward rule in firewall.
Capture give me sure that OP select to capture interface=ether1 that's we see in capture only traffic between his public ip 217... and siptrunk 5... but we not see converstion with 192.168.1.252 who is very critical here.

And about a https://www.anynode.de/features/ , the SBC is like sip proxy or firewall dedicated for VoIP or Multi SIP Providers Gateway... and SBC very often have own LAN and WAN zone with proper addressation. One of best example of diagnose in wireshark a sbc is here, good video: https://www.youtube.com/watch?v=Skn7kwLIxB0



About second capture, yes, we have a LAN site now.
SIP Flows show us Rejected registration...


ps. I sill think that this SIP Helper, even if he claim to be disable, to set him wrong ports, just for sure.
ps2. maybe after killing all connection with sip host's the next connection is "better". Firewall Contrack must be often be removed from voip entry in setups with lte and ohv siptrunk & pbx for france.
ps3. maybe change from 180 to 90 the sip.expires ... on google say that SIP 500 error is with long expires/timeouts

Hi All,

It looks like that the Anynode is now receiving calls from the PBX.
The only problem we're facing right now is that there is a lot op packet loss from the the Anynode to WAN. Only the AnyNode has this problem on Eth4, laptop and firewall on Eth3 en Eth5 does not have packet loss.

What exactly means "now"? Have you added the static ARP record or the problem has disappeared without any specific activity on your side?

spiketechnics write

It looks like that the Anynode is now receiving calls from the PBX.

FORUM is place to share knowleadge, what solve the issue ? This can help next persons. If you see how many times ppl put here to check your case... you should at least say what and where problems was, what solve it. Be part a community.

The only problem we're facing right now is that there is a lot op packet loss from the the Anynode to WAN. Only the AnyNode has this problem on Eth4, laptop and firewall on Eth3 en Eth5 does not have packet loss.

Please give details, we are not magic wizard.
You say that SBC have problems going to SIP Provider 5.x.x.x. From where you know that, you check a wireshark RTP Streams as source of it's base on ping ?

For the incoming calls, they we're rejected on Anynode-side. The Anynode was not using the right CALLEDDID header from our PBX.
The calls are reaching the AnyNode, but are not established.

Now the main problem seems that packages are lost, that's why the registration and calls are not working.
That explains the

DESTINATION UNREACHABLE (HOST UNREACHABLE)

in our traces.

At this point i've found out:

PING from AnyNode to RouterBOARD -> 0% packet lost
PING from RouterBOARD -> 8.8.8.8 -> 0% packet lost
PING from AnyNode -> 8.8.8.8 -> avg. 70% packet lost

spiketechnics write:

PING from AnyNode -> 8.8.8.8 -> avg. 70% packet lost

do a tracert / traceroute .
If AnyNode is a windows node then you can use a PingPlotter who show many struff.

BTW, ping packet loose can not means that you have problems with SIP... or you start it because you have some voip problems with packet loose. Please say more about it.

BTW, ping packet loose can not means that you have problems with SIP... or you start it because you have some voip problems with packet loose. Please say more about it.

Yes, it think we now have the VoIP-problems because of the packet loose. AnyNode is running on linux, so I will ask the technician to do a traceroute.

spiketechnics write

Yes, it think we now have the VoIP-problems because of the packet loose. AnyNode is running on linux, so I will ask the technician to do a traceroute.

You can connect any other device in LAN (next to SBC) of MikroTik LAN and check traceroute from it.
You can do traceroute from MikroTik too. Compare both of them.

You should capture RTP traffic and check if in his data flow are/exist a package loose. Check this: https://youtu.be/TYK6Cq-p5BQ?t=550



You should do it to few hosts, one of them should be your sip provider/pbx asx2com. It not response on icmp :( from my ISP.

Yes, PING of the PBX is enabled for some public IPs.

Below a traceroute from the Anynode.

root@Anynode:~# mtr -o "LSDNABWV" -s 1000 -r -c 900 5.79.70.101
Start: Wed May 25 08:03:32 2022
HOST: Anynode Loss% Snt Drop Last Avg Best Wrst StDev
1.|-- ??? 100.0 900 900 0.0 0.0 0.0 0.0 0.0
2.|-- 217.67.232.65 73.8% 900 664 3.3 111.9 3.2 2664. 394.4
3.|-- 178.238.96.81 73.6% 900 662 3.6 129.4 3.4 2553. 443.8
4.|-- leaseweb.evoswitch.nl-ix. 73.6% 900 662 4.6 124.4 4.5 2441. 419.3
5.|-- ae-101.br01.ams-02.nl.lea 73.6% 900 662 4.8 115.9 4.4 2330. 394.9
6.|-- ae-111.cr01.ams-01.nl.lea 73.7% 900 663 12.9 104.5 3.9 2219. 369.2
7.|-- po-1001.ce02.ams-01.nl.le 73.7% 900 663 4.1 98.4 4.0 2107. 347.3
8.|-- 5.79.78.212 73.7% 895 660 4.2 125.7 4.0 2998. 452.2
9.|-- sip1.axs2com.com 73.7% 895 660 4.5 121.4 4.4 2887. 434.2

Traceroute from laptop in same network, other eth port

This is proof that problem is only with Anynode and his network layer.
If it is on some virtualization machine then try from other vm.
if it is a standalone hardware with linux, try other network card, try USB-Ethernet adapter, try run other LiveUSB distribution ... all this to found why only this node have that problems.

See that first host is not your 192.168.1.1 and his generate problems for AnyNode or it is outgoing anynode itself.

You not check the RTP streem for problems ? Maybe only icmp have problem.

Maybe only icmp have problem.

ARP seems to have problems too. So maybe the root cause will get tracked down to an ill crimped patchcord.

What do the error counters at the Mikrotik port and at the AnyNode port say?

Hi,

At this moment technicians are busy with the VoIP-devices.
If I have some news about this issue, i will post it here.

Best regards,
Joost Lauwen

Had very similar issue recently on Yealink W70B
Outgoing calls fine, Incoming impossible , only error: this person's phone is currently unavailable

Turned out that my provider used one server for Registration and another for Incoming calls

So in Yealink had to disable: Accept SIP Trust Server Only

sebus

This issue reminds me the RDP connections that dies.
try to change the udp timeout from 10sec to 30sec and check if it helps.
we dont have any issues on ROS 7, but we changed this setting en-masse.