VPN Blocking SIP Trunk Keep Alive

[Mike S]

I have an Asus RT-AC88U router at my Mpls office and an RT-AC68U at my Naples office, both running Asus-Merlin Rel 384.17. The Naples Router has an OpenVPN Server Configured. The Mpls Router has an OpenVPN Client Connected to the Naples Router with Create NAT on Tunnel = NO and Inbound Firewall = Allow. The Firewalls on both routers are disabled.

Attached to the router LANs at each location I have a Grandstream UCM6204 IP-PBX systems with Peer SIP Trunks configured connecting the two UCM systems. Each UCM can successfully ping the other UCM.

When I first configure the Peer SIP Trunks on the UCM systems, the connections work fine. After a week or two, the trunks no longer work. When I do a network trace on each of the UCM systems, they are sending SIP Keep Alive packets to the remote UCM, but the remote UCM does not seem to see these packets. While I have this failure mode, each UCM can still ping the remote UCM.

I'm pulling my hair out trying to figure out why these SIP keep alive packets are being blocked. How can I debug this problem?

 

[L&LD]

Why would you disable the firewalls on both routers?

 

[Mike S]

Why would you disable the firewalls on both routers?

To try to eliminate one possible reason the SIP keep alive packets are being blocked.

 

[L&LD]

So, you endanger your entire network (x2)?

 

[coxhaus]

You may want to look at small business equipment if you want to run phones.

 

[JDB]

Are the keep alives NAT keep alives of the empty UDP packet type that requires no response, or are they full SIP OPTIONS out of call packets expecting a 200 OK response?
I’d recommend using the latter.

You say you have NAT tunnel set to NO, are you referring to TAP vs TUN? Either way, which are you using?

When you say they are not being seen how are you testing this? PCAP trace on box PBXs? You can also install Entware on both routers and then tcpdump onto the routers so you can trace at every step where the packet disappears/is ignored.

I design and maintain custom VoIP networks for ISPs, the last of which ran over a mesh VPN between nodes, so if I can’t work this out I’ll... [emoji23]


Sent from my iPhone using Tapatalk