SIP Configuration - UK VoIP providers?

Hi Oliver,

Please refer the link to configure VoIP:

https://www.sophos.com/support/knowledgebase/120284.aspx

Next, I request you to check logs; ips.log, packetfilter.log and afc.log. Please check if you discover any log line dropped or blocked on a specific VoIP ports. The delay in outgoing call is usually not a glitch from UTM but, I want to check if IPS is dropping anything silently.

Thanks

Hi Sachin,

Thanks for coming back to me.

We configured the SIP settings as described, using the information provided by our provider (attached).

However, we still have the problems described.

The main issue for us is the SIP attacks, as it causes disruption for our users. The numbers calling in on the phones are random: e.g. 101, 1001, 3001, 201, 'test'. The line is silent when you answer.

Our Expectation is set to Any. Could this be letting the attacks in?

If we change it to Client/Server, the phones don't work at all.

Thanks,

Oliver

Hi, Oliver, and welcome to the UTM Community!

Please attach pictures of the UTM VoIP configuration as well as any relevant NAT or Firewall rules.  Do we understand correctly that you have no internal VoIP PBX?

Cheers - Bob

Hi Bob,

Thanks for the reply!

I have attached some screenshots below of our current VoIP configuration.

No internal VoIP PBX.

Our Expectation Mode is set to 'Any'. Could that be causing the attacks? If we set it to client/server only, the phones do not work at all (engaged tone when dialling out or in).

Thanks,

Oliver

What happens if you eliminate "NTP Server Pool" from 'Sip Server Networks' and then configure for "Client/Server" expectation?

Cheers - Bob

Hi Bob,

You're a genius! After removing NTP Server Pool, client/server expectation is working.

Hopefully that's the end of our attacks.

Thanks for your help.

Best regards,

Oliver