Remote IP sets rebooting every single hour 2

[curlycord]

I have been troubleshooting another thread in the BCM forum and I believe I have sourced the issues.

Out of about 15 sets 4 of them would reboot every singe hour and on the hour XX:58
3 X 1140e
1 X 2004_ps
I updated sets firmware and patches on the bcm450 R6

Turns out there is WAN attacks on the router/modem - I was looking at with one users modem loge files "Firewall".

FW.IPv6 FORWARD drop
, 1375
Attempts, 2020/5/18 10:58:02 Firewall Blocked

FW.WANATTACK DROP
, 13
Attempts, 2020/5/18 10:58:02 Firewall Blocked

FW.IPv6 FORWARD drop
, 1832
Attempts, 2020/5/17 18:58:02 Firewall Blocked

FW.IPv6 INPUT drop
, 16
Attempts, 2020/5/17 03:58:02 Firewall Blocked

FW.IPv6 FORWARD drop
, 1137
Attempts, 2020/5/16 18:58:02 Firewall Blocked

It seems that only the phones and the wifi of the home networks are sensitive to this.
Soon as the phone went down:
One could print to wired printer
One could not print to a wireless printer
Both users could still google a search word, a word they have never searched before in case previous word was in cache.

I have advised the client on first scanning devices for malicious issues, public IP change and/or trying Bridged Mode and use with another Router

My question is I just want to double check if there is some setting in the phone that would try to keep the set alive a little longer during this very brief event before it says "time to reboot".

Sets are using NAT Traversal Remote Worker and not any VPN.
Only DHCP set to yes, and S1 & S2 set to the external IP of the BCM.

Thanks






________________________________________

=----(((((((((()----=

http://www.curlycord.com

Toronto, Canada

Add me to LinkedIN

 

[ucxguy]

Can you try to use a static IP address for one of the phones that keeps rebooting?

 

[bignose21]

Are they using the phones or does it only happen when they are idle for about an hour?

 

[curlycord]

I will see if I can get a remote user to change the DHCP and IP but I wonder how that would be related to the WAN attack from outside?

They are using the phones in the hour, the set does not care if in use or idle too.


________________________________________

=----(((((((((()----=

http://www.curlycord.com

Toronto, Canada

Add me to LinkedIN

 

[curlycord]

Internal IP change, no go.

I gather I am correct in assuming there is no such way to delay the reboot so I am closing this case.

The only fixes seem to be Cisco 30XX modems on Comcast need replacing or putting those Cisco DPC-39XX into Bridge mode and use another a router.

Thanks



________________________________________

=----(((((((((()----=

http://www.curlycord.com

Toronto, Canada

Add me to LinkedIN