External VOIP Phones connecting back to Office - No Audio

Cheers for the reply Bob, apologies for the delayed reply - it was a Public Holiday here yesterday and I've only just got back in the office!

The Firewall logs aren't showing anything at all. I sit there watching the Live Firewall logs when calls are being made and I am not seeing anything being actively dropped/blocked.

Actually, if you read #1 closely, you'll see that I was more interested in the Intrusion Prevention log... [;)]

Cheers - Bob

LOL, missed that bit. Absolutely nothing at all popping in the IP logs. I just made a call to the handset at my place - nada in the IP Log and nothing dropped in the Firewall logs. 

This is starting to drive me a little nuts! One tiny little thing somewhere is screwing it ... 

Yeah, it looks like there's no escape from having to use tcpdump.

Cheers - Bob

I'd scour through the NAT settings on your PBX. The only reason I say this is because any SIP system I've worked with has needed these changes in order to have audio passed to external extensions. The IP's I gave in my example above obviously do not apply but there might be an equivalent option(s) for your Panasonic system and maybe even the handset as well. Much like Asterisk. You have specified the NAT - Fixed Global IP Address in the Panasonic web console?

This might be the equivalent of asterisks "externip" option:

Indicates the IP address that will be used as the source IP address for all SIP messages when NAT is specified.

Where as my post above is about the "localnet" option

Hosts falling within the network ranges specified by the localnet option will be excluded from any NATing efforts by Asterisk. As a result, the source IP address within the SIP requests/responses will use the internal IP address of the network interface associated with bindaddr .

Thought I'd touch base with this ongoing issue. 

I submitted an official Support Request with Sophos last week but haven't had much luck/response with Sophos other than two emails suggesting what I have already done, and showed them the screenshots for ... awaiting another response sometime tomorrow ...

Working remotely after hours (its after midnight here now!) I've turned logging on on my Firewall Rules just to see the ACCEPTED packets, as well as the Dropped.

When I call from my mobile to my Direct Dial Number of my phone sitting beside me it makes the call and connects fine everytime. The Firewall shows:

1st Call  

And I had audio ONE WAY. Speaking into my mobile it was being received on the phone extension. No audio was going from the extension back to the mobile phone. There was only this single ACCEPTED LINE referencing my IP here at home (61.68.6.236) and its going to the DSP1 card on the PABX on the 16000 Port, as its supposed to. There were no other ACCEPTED packets from my IP at all, no DROPS either.

2nd Call  

This call was identical to the first, audio from my mobile being received by the remote phone handset, no audio back the other way. Again, only a single ACCEPT entry in the Firewall, no DROPS.

3rd Call 

Here is a difference. This time NO audio was sent or received ON EITHER END. At all. I ended up hanging up after 20 seconds. ACCEPTED packets from my IP to the Phone System continued the whole time.

4th Call  

Identical to Call 3, no audio either way

5th Call 

Identical to Calls 3 and 4, no audio either way again, lots of accepted packets int eh log and no DROPS at all either from my IP, to my IP or to/from the PABX IP's.

As mentioned earlier - no entries at all coming up in IPS and ATM while calls are active.


In regards to the PABX - the only networking components I can see in the Web Admin Console are your basic set DHCP or Static, and Static is selected and the Details manually entered are:

IP: 10.0.30.250
Subnet: 255.255.255.0
Gateway: 10.0.30.254 (The Dell Layer 3 Switch - same as every other vLAN)
DNS: 10.0.10.51 and 10.0.10.52 - our two internal Windows 2016 DC's running AD, DNS, DHCP

DSP1 Card: 10.0.30.251
DSP2 Card: 10.0.30.252

And thats about it ... nothing about NAT, NAT Traversal or anything else that I can see. 

Again, any comments, suggestions, ideas etc are greatly appreciated!!!

Hopefully Sophos will get back to me tomorrow with some suggestions that I already haven't tried!  ;)

Do a preentscren of the phone configuration page (hide sensitive data)

Something its wrong because in the logs i see private IP not your external IP

Agreed with oldeda - the traffic is not even hitting the UTM - tcpdump would likely confirm that.

Cheers - Bob

Cheers lads - I will be doing some packet tracing from the Phone System outwards shortly, just getting Wireshark installed onto a laptop ...

I had Richard from Sophos 'remoted' in in the past hour or so going through the UTM. I showed him all my PABX and Dell 6448 Configs and settings etc and he did jump into TCPDump on the UTM and we could see the packets from my external handset hitting the firewall on the correct external IP and the Accepted Packets going to the Internal IP of the PABX and the right Port Ranges (that match the Port Forwards) - but again only from Outside In. Nothing is going from the PABX outwards according to logging ... but the annoying thing is - occasionally audio IS getting to the remote handset yet there is no DROPPED or ACCEPTED packets going through the Firewall?! Only my external IP to the Internal IP of the PABX!

Anyways, I'll do some packet sniffing (I'll mirror the PABX's port on the switch) and see whats going out of there and where its going to to see if I can suss anything out there.

Richard has escalated the case with Sophos Support to Level 2 - I'll report back any further progress and or findings ;)

Cheers again for the assistance/advice so far!  ;) 

Have you searched in Google for your PBX "Nat Traversal" (not port forwarding etc)

If not you are in the wrong forum

Bye