D100 looses sync to IPO over VPN

[rm81]

Hi Guys,

Has anyone had issues with the D100 bases loosing sync with the IP500 v2's on the latest 9.1.7.163 release.

My scenario has multiple D100 (latest firmware applied) with D160's connecting back to head office over a VPN link and periodically the phones loose sync with the IPO.... each time this occurs i can see that the VPN between sites is up.

At the remote site a local ping to the base stays up.

i checked it last night when the traffic was zero and via monitor found the below indicating a timer issue possibly ?? binding refresh??

23:05:45 563118362mS D100: D100BaseManager::KeepAliveTimeout lost communication with base station 00e0110cadae

Has anyone encountered this previously?

Any input would be much appreciated


"Striving for success without hardwork is like trying to harvest where you havent planted

 

[amriddle01]

VPN's can often show as up but not pass any traffic, depends on the dead peer detection threshold etc.
You say a local ping stays up but how about a ping across the VPN?
I will say this is 99% a network/VPN issue, that's how they work and that's what's stopping it working after all

 

[janni78]

What firewalls are you using? It's not happening during VPN rekey?

"Trying is the first step to failure..." - Homer

 

[rm81]

Hiya Guys,

Thanks for the update much appreciated

Whilst at the main office site i had 2 pings running

1. Ping from the VMPRO server at the main site to my laptop (this remains continuous when the ping to the d100 fails)
2. ping to the D100 at the remote site

The VPN connects via two draytek 28xxx series boxes

Initially i thought the issue could have been a flakey base so i swapped and re registered the repeaters and handsets to the new base but the issue continued.

Also ruled out any possible IP clash by scanning the range and assigning an IP at the high end of the scale which is unused.

Could this be an ALG re writing the SIP packets ?


Many thanks

"Striving for success without hardwork is like trying to harvest where you havent planted

 

[amriddle01]

ALGs will not be applied passing through the VPN, so no, but Drayteks are a bit dodgy with SIP mind

 

[rm81]

Thanks amriddle.

Im interested to know what the keep alive in the trace extract refers to would could it be the binding refresh on the relevant lan tab ?

Kind regards and thanks

"Striving for success without hardwork is like trying to harvest where you havent planted

 

[amriddle01]

Keepalive settings are typically dictated in the base firmware and non-configurable AFAIK, but I haven't touched those specific handets/base so I'm no expert

 

[amriddle01]

BTW if you mean the Binding Refresh settings on the system LAN ports then those are to do with SIP options messages for trunks set to a certain network topology, not keepalive settings for handsets

 

[rm81]

hmmmm

I wonder if this would have a bearing on the sip dect line as because of the IP routing set up these would use the network topology for LAN 1.

Thanks again

"Striving for success without hardwork is like trying to harvest where you havent planted

 

[amriddle01]

IP Routes don't use any network topology settings, it can only be set to do so in a normal SIP trunk

 

[rm81]

Well guys.

Checked and the routers running the site to site VPN'S aren't using ALG.

Checking further it almost looks like the VPN drops (although we have verified it isnt) as the pings start responding after a period of time and then the D100's start to function correctly and then drop out with the base being unreachable.

Switch wise this is a generic POE un-manged switch that we've installed. swapped the cabling swapped the bases (swapped the switch) checked the router re built the sip dect lines on the IPO and re registered the handsets to a completely different replacement base.

The only other thing i can think to do is to take a base and a couple of handsets to the main site and connect them up and see if the issue persists

All very bizarre

"Striving for success without hardwork is like trying to harvest where you havent planted

 

[mforrence]

@rm81 - we had the exact same issue. In the end, we put added an IP500V2 control at remote site as a test. D100/160 has been perfect since. Expensive, yet functional solution.

 

[derfloh]

But it saved a lot of money for the cheap D100 ;-)

 

[IPGuru]

is the VPN in your drayteks an on demand connection or is it set to be permanently "Nailed up"?

Always use a fixed permanent connection




Do things on the cheap & it will cost you dear