SIP Trunks showing "Alerting"

[canflyguy]

I'm fighting with phantom calls and I may have resolved the situation, but I have about 10 SIP lines tied up showing "Alerting". Is there any way to clear them by turning off a service and then turning it back on?

I don't know why or how this installation is having issues with the hackers?? I've turned off SIP ALG and I did enable 5989 for remote programming for the element manager, 30000-30999 for IP sets, 7000-7002 for IP sets & 60001 for being able to use Monitor remotely.
I don't know if that's what causing the issue?

I also enabled remote programming access on the router in case I needed to do something for the customer, but I don't know if that's what's also possible to get into the BCM?

Any ideas?

 

[jsaad]

I would recommend a firewall rule to only allow incoming traffic on port 5060 (sip) from the IP address of your sip trunk provider. It is not clear if you have done that.

What type of firewall are you using?

 

[exsmogger]

Make sure port 5060 isn't forwarded to the BCM

Brian Cox
Georgia Telephone

http://Georgia-Telephone.com

http://www.linkedin.com/in/briancox1952

 

[Firebird Scrambler]

Also make sure Jsaad comments are followed if your SIP provider uses a static IP address, but follow Exmoggers idea if your SIP provider uses a username and password etc.

Firebird Scrambler

Nortel & Avaya Meridian 1 / Succession & BCM / Norstar Programmer

Website =

http://somertel.myfreesites.net

linkedin

 

[curlycord]

I agree....do not forward 5060 or even have it listed in your Port Ranges on the BCM

________________________________________

=----(((((((((()----=

http://www.curlycord.com

Toronto, Canada

Add me to LinkedIN

 

[canflyguy]

I haven't added anything to the port ranges in the BCM so although 5000 is there in signalling, there is no entry of 5060 specifically. I did manage to eventually kill the phantom calls, I believe by turning off SIP ALG in the router. It's a wait and see game now. One thing I will post a question on separately though, is why remote access to BCM Monitor works and then somehow stops working giving an error or 80004 after a while? It helps to monitor the traffic when these trunks are filling up. The only way I've seen to correct it is to reboot the BCM unless there is some other service that can be turned off or restarted?

 

[curlycord]

Which system and desktop patches are loaded on it?
Desktop 005 and System 22 are the latest.


________________________________________

=----(((((((((()----=

http://www.curlycord.com

Toronto, Canada

Add me to LinkedIN

 

[Firebird Scrambler]

I have the same issue with the error code of 80004. It's fine to access BCM Monitor within 10 minutes after a reboot.
This problem is very strange and I've given up with why it is happening. I thought it was patch related but even with no patches installed, I still have the problem.

We always recommend turning off SIP ALG as it does cause more problems that aren't always easy to trace.


Firebird Scrambler

Nortel & Avaya Meridian 1 / Succession & BCM / Norstar Programmer

Website =

http://somertel.myfreesites.net

linkedin

 

[canflyguy]

Phantom calls are no more and with respect to the Monitor being handy to check the traffic and having it drop after a while without being able to get in, I found an answer on a previous thread. If you restart the Msm service, then Monitor works. It did seem to take a while to restart the service as I got impatient and turned it off and then pressed start. I'm not sure if using Restart is less interference, but turning it off and back on caused a frozen line (line lockup) and some other services all went down until the whole thing did come back. I'm maybe going to try it again on another unit here to see what it does.

 

[canflyguy]

Takes about a good 10 minutes to come back after you click on "Restart" the Msm service and it is disruptive.

 

[curlycord]

The 80004 was addressed in an earlier patch, if your not up to date then worth a shot otherwise you have same issue as some others have but perhaps caused by something else.

________________________________________

=----(((((((((()----=

http://www.curlycord.com

Toronto, Canada

Add me to LinkedIN

 

[canflyguy]

Both Desktop 005.201406-1 and System 022.201412 are applied, but system still kills remote monitor after a couple of days or so. This happens from all sites I have.

 

[curlycord]

Try a spare PC and also try going direct to OAM port to see if same issue since it might be a network/router issue instead.


________________________________________

=----(((((((((()----=

http://www.curlycord.com

Toronto, Canada

Add me to LinkedIN

 

[curlycord]

Also maybe try to fix socket/protocol errors:

https://www.youtube.com/watch?v=G3DpeeXLSDM

________________________________________

=----(((((((((()----=

http://www.curlycord.com

Toronto, Canada

Add me to LinkedIN

 

[canflyguy]

Thanks Curlycord!