ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Issue with EdgeRouter Lite/ Verizon FiOS

    IT Discussion
    6
    24
    5.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • scottalanmillerS
      scottalanmiller
      last edited by

      This may seem trivial but we are having diagnostic issues with a SIP trunk provider and believe that this inspire of a larger issue.

      1 Reply Last reply Reply Quote 0
      • ?
        A Former User
        last edited by A Former User

        Is ICMP allowed on the firewall of the edgerouter for the wan port?

        FiyaFlyF 1 Reply Last reply Reply Quote 0
        • FiyaFlyF
          FiyaFly @A Former User
          last edited by

          @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

          configure
          set firewall all-ping enable
          commit
          save

          Is there additional steps needed?

          ? 1 Reply Last reply Reply Quote 0
          • ?
            A Former User @FiyaFly
            last edited by

            @FiyaFly said:

            @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

            configure
            set firewall all-ping enable
            commit
            save

            Is there additional steps needed?

            From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

            http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

            From what I read the code is something like this

            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

            FiyaFlyF JaredBuschJ 3 Replies Last reply Reply Quote 0
            • FiyaFlyF
              FiyaFly @A Former User
              last edited by

              @thecreativeone91 said:

              @FiyaFly said:

              @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

              configure
              set firewall all-ping enable
              commit
              save

              Is there additional steps needed?

              From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

              http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

              From what I read the code is something like this

              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

              Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

              Any other ideas for that part, then?

              NetworkNerdN 1 Reply Last reply Reply Quote 0
              • NetworkNerdN
                NetworkNerd @FiyaFly
                last edited by

                @FiyaFly said:

                @thecreativeone91 said:

                @FiyaFly said:

                @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

                configure
                set firewall all-ping enable
                commit
                save

                Is there additional steps needed?

                From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

                http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

                From what I read the code is something like this

                set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
                set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
                set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
                set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
                set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
                set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

                Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

                Any other ideas for that part, then?

                Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

                FiyaFlyF 1 Reply Last reply Reply Quote 0
                • FiyaFlyF
                  FiyaFly @NetworkNerd
                  last edited by

                  @NetworkNerd said:

                  @FiyaFly said:

                  @thecreativeone91 said:

                  @FiyaFly said:

                  @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

                  configure
                  set firewall all-ping enable
                  commit
                  save

                  Is there additional steps needed?

                  From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

                  http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

                  From what I read the code is something like this

                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

                  Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

                  Any other ideas for that part, then?

                  Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

                  Yes it does. I have also ensured that ports are open and forwarded to the PBX.

                  NetworkNerdN 1 Reply Last reply Reply Quote 0
                  • NetworkNerdN
                    NetworkNerd @FiyaFly
                    last edited by

                    @FiyaFly said:

                    @NetworkNerd said:

                    @FiyaFly said:

                    @thecreativeone91 said:

                    @FiyaFly said:

                    @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

                    configure
                    set firewall all-ping enable
                    commit
                    save

                    Is there additional steps needed?

                    From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

                    http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

                    From what I read the code is something like this

                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

                    Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

                    Any other ideas for that part, then?

                    Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

                    Yes it does. I have also ensured that ports are open and forwarded to the PBX.

                    If this is Asterisk (which I am guessing it may be), what happens in the CLI for inbound calls?

                    FiyaFlyF 1 Reply Last reply Reply Quote 1
                    • ?
                      A Former User
                      last edited by

                      This is a bit off topic, but on topic at the same time.....how many users would you comfortably put behind this router?

                      JaredBuschJ 1 Reply Last reply Reply Quote 0
                      • JaredBuschJ
                        JaredBusch @A Former User
                        last edited by

                        @Hubtech said:

                        This is a bit off topic, but on topic at the same time.....how many users would you comfortably put behind this router?

                        I have these routers all over the place. The largest single office is 35 users with a total of say 150 devices (counting the semi-public wifi). The router at that facility has 8 Site to site OpenVPN connections. 1 site to site IPSEC connection. 2 Open VPN servers (one is for users, one is for phones). They have a 10/10 mbit AT&T fiber.

                        The unit never breaks a sweat. I could easily triple the workload IMO.

                        1 Reply Last reply Reply Quote 0
                        • ?
                          A Former User
                          last edited by

                          ok good deal.

                          1 Reply Last reply Reply Quote 0
                          • FiyaFlyF
                            FiyaFly @NetworkNerd
                            last edited by

                            @NetworkNerd said:

                            @FiyaFly said:

                            @NetworkNerd said:

                            @FiyaFly said:

                            @thecreativeone91 said:

                            @FiyaFly said:

                            @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

                            configure
                            set firewall all-ping enable
                            commit
                            save

                            Is there additional steps needed?

                            From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

                            http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

                            From what I read the code is something like this

                            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
                            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
                            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
                            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
                            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
                            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

                            Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

                            Any other ideas for that part, then?

                            Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

                            Yes it does. I have also ensured that ports are open and forwarded to the PBX.

                            If this is Asterisk (which I am guessing it may be), what happens in the CLI for inbound calls?

                            Sadly, FortiVoice, so unable to get in via CLI

                            ? 1 Reply Last reply Reply Quote 0
                            • JaredBuschJ
                              JaredBusch @A Former User
                              last edited by

                              @thecreativeone91 said:

                              @FiyaFly said:

                              @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

                              configure
                              set firewall all-ping enable
                              commit
                              save

                              Is there additional steps needed?

                              From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

                              http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

                              From what I read the code is something like this

                              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
                              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
                              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
                              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
                              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
                              set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

                              no single ticks on all of that, but yes that is right..

                              Here is the sanitized firewall config on my ERL in our colo space. It has my PBX in a Flash system behind it.

                              Last login: Mon Oct 13 12:47:42 2014 from win8jar64
jbusch@erl:~$ show configuration commands firewall
set firewall all-ping enable
set firewall broadcast-ping disable
set firewall group address-group FSL_Addresses address XXX.XXX.XXX.XXX/29
set firewall group address-group FSL_Addresses description 'Forklifts of St Louis IP Information'
set firewall group network-group BundyAddresses description 'Bundy User IP Blocks'
set firewall group network-group BundyAddresses network XXX.XXX.XXX.XXX/16
set firewall group port-group PBXPorts description 'Ports used by the PBX'
set firewall group port-group PBXPorts port 4569
set firewall group port-group PBXPorts port 5060
set firewall group port-group PBXPorts port 10000-20000
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable
set firewall ip-src-route disable
set firewall log-martians enable
set firewall name LAN_IN default-action accept
set firewall name LAN_IN description 'Internal network to Internet'
set firewall name LAN_LOCAL default-action accept
set firewall name LAN_LOCAL description 'Internal network to router'
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'Internet to internal networks'
set firewall name WAN_IN rule 1 action accept
set firewall name WAN_IN rule 1 description 'Accept established and Related'
set firewall name WAN_IN rule 1 log disable
set firewall name WAN_IN rule 1 protocol all
set firewall name WAN_IN rule 1 state established enable
set firewall name WAN_IN rule 1 state related enable
set firewall name WAN_IN rule 2 action drop
set firewall name WAN_IN rule 2 description 'Drop Invlid'
set firewall name WAN_IN rule 2 log enable
set firewall name WAN_IN rule 2 protocol all
set firewall name WAN_IN rule 2 state invalid enable
set firewall name WAN_IN rule 3 action accept
set firewall name WAN_IN rule 3 description 'Accept New for PBX from Bundy Emp'
set firewall name WAN_IN rule 3 destination group port-group PBXPorts
set firewall name WAN_IN rule 3 log enable
set firewall name WAN_IN rule 3 protocol udp
set firewall name WAN_IN rule 3 source group network-group BundyAddresses
set firewall name WAN_IN rule 3 state new enable
set firewall name WAN_IN rule 4 action accept
set firewall name WAN_IN rule 4 description 'Accept New for PBX from FSL'
set firewall name WAN_IN rule 4 destination group port-group PBXPorts
set firewall name WAN_IN rule 4 log enable
set firewall name WAN_IN rule 4 protocol udp
set firewall name WAN_IN rule 4 source group address-group FSL_Addresses
set firewall name WAN_IN rule 4 state established disable
set firewall name WAN_IN rule 4 state invalid disable
set firewall name WAN_IN rule 4 state new enable
set firewall name WAN_IN rule 4 state related disable
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'Internet to router'
set firewall name WAN_LOCAL rule 1 action accept
set firewall name WAN_LOCAL rule 1 description 'Accept Established and Related'
set firewall name WAN_LOCAL rule 1 log disable
set firewall name WAN_LOCAL rule 1 protocol all
set firewall name WAN_LOCAL rule 1 state established enable
set firewall name WAN_LOCAL rule 1 state related enable
set firewall name WAN_LOCAL rule 2 action drop
set firewall name WAN_LOCAL rule 2 description 'Drop Invlaid'
set firewall name WAN_LOCAL rule 2 log enable
set firewall name WAN_LOCAL rule 2 protocol all
set firewall name WAN_LOCAL rule 2 state invalid enable
set firewall name WAN_LOCAL rule 5 action accept
set firewall name WAN_LOCAL rule 5 description 'Accept Rate Limited Ping'
set firewall name WAN_LOCAL rule 5 limit burst 1
set firewall name WAN_LOCAL rule 5 limit rate 50/minute
set firewall name WAN_LOCAL rule 5 log enable
set firewall name WAN_LOCAL rule 5 protocol icmp
set firewall receive-redirects disable
set firewall send-redirects enable
set firewall source-validation disable
set firewall syn-cookies enable
jbusch@erl:~$
                              1 Reply Last reply Reply Quote 0
                              • JaredBuschJ
                                JaredBusch @A Former User
                                last edited by

                                @thecreativeone91 said:

                                set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'

                                Also, just FYI, when using my MBP it can ping too fast and this rate limiter will show time outs. I set this to 62/minute and the timeouts went away.

                                1 Reply Last reply Reply Quote 0
                                • ?
                                  A Former User @FiyaFly
                                  last edited by A Former User

                                  @FiyaFly said:

                                  @NetworkNerd said:

                                  @FiyaFly said:

                                  @NetworkNerd said:

                                  @FiyaFly said:

                                  @thecreativeone91 said:

                                  @FiyaFly said:

                                  @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

                                  configure
                                  set firewall all-ping enable
                                  commit
                                  save

                                  Is there additional steps needed?

                                  From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

                                  http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

                                  From what I read the code is something like this

                                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
                                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
                                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
                                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
                                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
                                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

                                  Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

                                  Any other ideas for that part, then?

                                  Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

                                  Yes it does. I have also ensured that ports are open and forwarded to the PBX.

                                  If this is Asterisk (which I am guessing it may be), what happens in the CLI for inbound calls?

                                  Sadly, FortiVoice, so unable to get in via CLI

                                  So the PBX is internal not hosted. It's just the SIP Trunk that is having issues?

                                  scottalanmillerS 1 Reply Last reply Reply Quote 0
                                  • scottalanmillerS
                                    scottalanmiller @A Former User
                                    last edited by

                                    @thecreativeone91 said:

                                    @FiyaFly said:

                                    @NetworkNerd said:

                                    @FiyaFly said:

                                    @NetworkNerd said:

                                    @FiyaFly said:

                                    @thecreativeone91 said:

                                    @FiyaFly said:

                                    @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

                                    configure
                                    set firewall all-ping enable
                                    commit
                                    save

                                    Is there additional steps needed?

                                    From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

                                    http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

                                    From what I read the code is something like this

                                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
                                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
                                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
                                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
                                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
                                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

                                    Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

                                    Any other ideas for that part, then?

                                    Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

                                    Yes it does. I have also ensured that ports are open and forwarded to the PBX.

                                    If this is Asterisk (which I am guessing it may be), what happens in the CLI for inbound calls?

                                    Sadly, FortiVoice, so unable to get in via CLI

                                    So the PBX is internal not hosted. It's just the SIP Trunk that is having issues?

                                    Yes and yes.

                                    1 Reply Last reply Reply Quote 0
                                    • ?
                                      A Former User
                                      last edited by

                                      well to find out if it is a SIP trunk provider issue or not you could setup another extension on NTGs PBX then use that as the SIP Trunk peer on theirs for testing. If that works you know it's an issue with the trunk provider.

                                      1 Reply Last reply Reply Quote 1
                                      • JaredBuschJ
                                        JaredBusch
                                        last edited by

                                        Or if the provider with the problem is not VoIP.ms you can always make a sub account on any VoIP.ms account and set that up as a trunk too.

                                        NetworkNerdN 1 Reply Last reply Reply Quote 1
                                        • NetworkNerdN
                                          NetworkNerd @JaredBusch
                                          last edited by

                                          @JaredBusch said:

                                          Or if the provider with the problem is not VoIP.ms you can always make a sub account on any VoIP.ms account and set that up as a trunk too.

                                          I like the idea of getting a test trunk as well.

                                          1 Reply Last reply Reply Quote 0
                                          • NetworkNerdN
                                            NetworkNerd
                                            last edited by

                                            You could do the free trial of OnSIP: http://www.onsip.com/pricing. I know it is really hosted VOIP, but it should at least allow testing of SIP and RTP traffic passing through the router. It takes the PBX out of the equation completely though.

                                            1 Reply Last reply Reply Quote 1
                                            • 1
                                            • 2
                                            • 1 / 2
                                            • First post
                                              Last post