ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Issue with EdgeRouter Lite/ Verizon FiOS

    Scheduled Pinned Locked Moved IT Discussion
    24 Posts 6 Posters 5.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • NetworkNerdN
      NetworkNerd @FiyaFly
      last edited by

      @FiyaFly said:

      @thecreativeone91 said:

      @FiyaFly said:

      @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

      configure
      set firewall all-ping enable
      commit
      save

      Is there additional steps needed?

      From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

      http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

      From what I read the code is something like this

      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

      Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

      Any other ideas for that part, then?

      Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

      FiyaFlyF 1 Reply Last reply Reply Quote 0
      • FiyaFlyF
        FiyaFly @NetworkNerd
        last edited by

        @NetworkNerd said:

        @FiyaFly said:

        @thecreativeone91 said:

        @FiyaFly said:

        @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

        configure
        set firewall all-ping enable
        commit
        save

        Is there additional steps needed?

        From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

        http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

        From what I read the code is something like this

        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

        Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

        Any other ideas for that part, then?

        Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

        Yes it does. I have also ensured that ports are open and forwarded to the PBX.

        NetworkNerdN 1 Reply Last reply Reply Quote 0
        • NetworkNerdN
          NetworkNerd @FiyaFly
          last edited by

          @FiyaFly said:

          @NetworkNerd said:

          @FiyaFly said:

          @thecreativeone91 said:

          @FiyaFly said:

          @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

          configure
          set firewall all-ping enable
          commit
          save

          Is there additional steps needed?

          From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

          http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

          From what I read the code is something like this

          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

          Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

          Any other ideas for that part, then?

          Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

          Yes it does. I have also ensured that ports are open and forwarded to the PBX.

          If this is Asterisk (which I am guessing it may be), what happens in the CLI for inbound calls?

          FiyaFlyF 1 Reply Last reply Reply Quote 1
          • ?
            A Former User
            last edited by

            This is a bit off topic, but on topic at the same time.....how many users would you comfortably put behind this router?

            JaredBuschJ 1 Reply Last reply Reply Quote 0
            • JaredBuschJ
              JaredBusch @A Former User
              last edited by

              @Hubtech said:

              This is a bit off topic, but on topic at the same time.....how many users would you comfortably put behind this router?

              I have these routers all over the place. The largest single office is 35 users with a total of say 150 devices (counting the semi-public wifi). The router at that facility has 8 Site to site OpenVPN connections. 1 site to site IPSEC connection. 2 Open VPN servers (one is for users, one is for phones). They have a 10/10 mbit AT&T fiber.

              The unit never breaks a sweat. I could easily triple the workload IMO.

              1 Reply Last reply Reply Quote 0
              • ?
                A Former User
                last edited by

                ok good deal.

                1 Reply Last reply Reply Quote 0
                • FiyaFlyF
                  FiyaFly @NetworkNerd
                  last edited by

                  @NetworkNerd said:

                  @FiyaFly said:

                  @NetworkNerd said:

                  @FiyaFly said:

                  @thecreativeone91 said:

                  @FiyaFly said:

                  @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

                  configure
                  set firewall all-ping enable
                  commit
                  save

                  Is there additional steps needed?

                  From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

                  http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

                  From what I read the code is something like this

                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
                  set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

                  Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

                  Any other ideas for that part, then?

                  Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

                  Yes it does. I have also ensured that ports are open and forwarded to the PBX.

                  If this is Asterisk (which I am guessing it may be), what happens in the CLI for inbound calls?

                  Sadly, FortiVoice, so unable to get in via CLI

                  ? 1 Reply Last reply Reply Quote 0
                  • JaredBuschJ
                    JaredBusch @A Former User
                    last edited by

                    @thecreativeone91 said:

                    @FiyaFly said:

                    @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

                    configure
                    set firewall all-ping enable
                    commit
                    save

                    Is there additional steps needed?

                    From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

                    http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

                    From what I read the code is something like this

                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
                    set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

                    no single ticks on all of that, but yes that is right..

                    Here is the sanitized firewall config on my ERL in our colo space. It has my PBX in a Flash system behind it.

                    Last login: Mon Oct 13 12:47:42 2014 from win8jar64
jbusch@erl:~$ show configuration commands firewall
set firewall all-ping enable
set firewall broadcast-ping disable
set firewall group address-group FSL_Addresses address XXX.XXX.XXX.XXX/29
set firewall group address-group FSL_Addresses description 'Forklifts of St Louis IP Information'
set firewall group network-group BundyAddresses description 'Bundy User IP Blocks'
set firewall group network-group BundyAddresses network XXX.XXX.XXX.XXX/16
set firewall group port-group PBXPorts description 'Ports used by the PBX'
set firewall group port-group PBXPorts port 4569
set firewall group port-group PBXPorts port 5060
set firewall group port-group PBXPorts port 10000-20000
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable
set firewall ip-src-route disable
set firewall log-martians enable
set firewall name LAN_IN default-action accept
set firewall name LAN_IN description 'Internal network to Internet'
set firewall name LAN_LOCAL default-action accept
set firewall name LAN_LOCAL description 'Internal network to router'
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'Internet to internal networks'
set firewall name WAN_IN rule 1 action accept
set firewall name WAN_IN rule 1 description 'Accept established and Related'
set firewall name WAN_IN rule 1 log disable
set firewall name WAN_IN rule 1 protocol all
set firewall name WAN_IN rule 1 state established enable
set firewall name WAN_IN rule 1 state related enable
set firewall name WAN_IN rule 2 action drop
set firewall name WAN_IN rule 2 description 'Drop Invlid'
set firewall name WAN_IN rule 2 log enable
set firewall name WAN_IN rule 2 protocol all
set firewall name WAN_IN rule 2 state invalid enable
set firewall name WAN_IN rule 3 action accept
set firewall name WAN_IN rule 3 description 'Accept New for PBX from Bundy Emp'
set firewall name WAN_IN rule 3 destination group port-group PBXPorts
set firewall name WAN_IN rule 3 log enable
set firewall name WAN_IN rule 3 protocol udp
set firewall name WAN_IN rule 3 source group network-group BundyAddresses
set firewall name WAN_IN rule 3 state new enable
set firewall name WAN_IN rule 4 action accept
set firewall name WAN_IN rule 4 description 'Accept New for PBX from FSL'
set firewall name WAN_IN rule 4 destination group port-group PBXPorts
set firewall name WAN_IN rule 4 log enable
set firewall name WAN_IN rule 4 protocol udp
set firewall name WAN_IN rule 4 source group address-group FSL_Addresses
set firewall name WAN_IN rule 4 state established disable
set firewall name WAN_IN rule 4 state invalid disable
set firewall name WAN_IN rule 4 state new enable
set firewall name WAN_IN rule 4 state related disable
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'Internet to router'
set firewall name WAN_LOCAL rule 1 action accept
set firewall name WAN_LOCAL rule 1 description 'Accept Established and Related'
set firewall name WAN_LOCAL rule 1 log disable
set firewall name WAN_LOCAL rule 1 protocol all
set firewall name WAN_LOCAL rule 1 state established enable
set firewall name WAN_LOCAL rule 1 state related enable
set firewall name WAN_LOCAL rule 2 action drop
set firewall name WAN_LOCAL rule 2 description 'Drop Invlaid'
set firewall name WAN_LOCAL rule 2 log enable
set firewall name WAN_LOCAL rule 2 protocol all
set firewall name WAN_LOCAL rule 2 state invalid enable
set firewall name WAN_LOCAL rule 5 action accept
set firewall name WAN_LOCAL rule 5 description 'Accept Rate Limited Ping'
set firewall name WAN_LOCAL rule 5 limit burst 1
set firewall name WAN_LOCAL rule 5 limit rate 50/minute
set firewall name WAN_LOCAL rule 5 log enable
set firewall name WAN_LOCAL rule 5 protocol icmp
set firewall receive-redirects disable
set firewall send-redirects enable
set firewall source-validation disable
set firewall syn-cookies enable
jbusch@erl:~$
                    1 Reply Last reply Reply Quote 0
                    • JaredBuschJ
                      JaredBusch @A Former User
                      last edited by

                      @thecreativeone91 said:

                      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'

                      Also, just FYI, when using my MBP it can ping too fast and this rate limiter will show time outs. I set this to 62/minute and the timeouts went away.

                      1 Reply Last reply Reply Quote 0
                      • ?
                        A Former User @FiyaFly
                        last edited by A Former User

                        @FiyaFly said:

                        @NetworkNerd said:

                        @FiyaFly said:

                        @NetworkNerd said:

                        @FiyaFly said:

                        @thecreativeone91 said:

                        @FiyaFly said:

                        @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

                        configure
                        set firewall all-ping enable
                        commit
                        save

                        Is there additional steps needed?

                        From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

                        http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

                        From what I read the code is something like this

                        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
                        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
                        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
                        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
                        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
                        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

                        Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

                        Any other ideas for that part, then?

                        Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

                        Yes it does. I have also ensured that ports are open and forwarded to the PBX.

                        If this is Asterisk (which I am guessing it may be), what happens in the CLI for inbound calls?

                        Sadly, FortiVoice, so unable to get in via CLI

                        So the PBX is internal not hosted. It's just the SIP Trunk that is having issues?

                        scottalanmillerS 1 Reply Last reply Reply Quote 0
                        • scottalanmillerS
                          scottalanmiller @A Former User
                          last edited by

                          @thecreativeone91 said:

                          @FiyaFly said:

                          @NetworkNerd said:

                          @FiyaFly said:

                          @NetworkNerd said:

                          @FiyaFly said:

                          @thecreativeone91 said:

                          @FiyaFly said:

                          @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

                          configure
                          set firewall all-ping enable
                          commit
                          save

                          Is there additional steps needed?

                          From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

                          http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

                          From what I read the code is something like this

                          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
                          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
                          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
                          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
                          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
                          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

                          Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

                          Any other ideas for that part, then?

                          Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

                          Yes it does. I have also ensured that ports are open and forwarded to the PBX.

                          If this is Asterisk (which I am guessing it may be), what happens in the CLI for inbound calls?

                          Sadly, FortiVoice, so unable to get in via CLI

                          So the PBX is internal not hosted. It's just the SIP Trunk that is having issues?

                          Yes and yes.

                          1 Reply Last reply Reply Quote 0
                          • ?
                            A Former User
                            last edited by

                            well to find out if it is a SIP trunk provider issue or not you could setup another extension on NTGs PBX then use that as the SIP Trunk peer on theirs for testing. If that works you know it's an issue with the trunk provider.

                            1 Reply Last reply Reply Quote 1
                            • JaredBuschJ
                              JaredBusch
                              last edited by

                              Or if the provider with the problem is not VoIP.ms you can always make a sub account on any VoIP.ms account and set that up as a trunk too.

                              NetworkNerdN 1 Reply Last reply Reply Quote 1
                              • NetworkNerdN
                                NetworkNerd @JaredBusch
                                last edited by

                                @JaredBusch said:

                                Or if the provider with the problem is not VoIP.ms you can always make a sub account on any VoIP.ms account and set that up as a trunk too.

                                I like the idea of getting a test trunk as well.

                                1 Reply Last reply Reply Quote 0
                                • NetworkNerdN
                                  NetworkNerd
                                  last edited by

                                  You could do the free trial of OnSIP: http://www.onsip.com/pricing. I know it is really hosted VOIP, but it should at least allow testing of SIP and RTP traffic passing through the router. It takes the PBX out of the equation completely though.

                                  1 Reply Last reply Reply Quote 1
                                  • scottalanmillerS
                                    scottalanmiller
                                    last edited by

                                    SIP and RTP are working. Outbound calls work, inbound do not.

                                    1 Reply Last reply Reply Quote 0
                                    • NetworkNerdN
                                      NetworkNerd
                                      last edited by

                                      So what was the resolution on this one? I'm sure others would like to know if it was the SIP provider, the Ubiquiti device, or something else entirely.

                                      1 Reply Last reply Reply Quote 0
                                      • 1
                                      • 2
                                      • 1 / 2
                                      • First post
                                        Last post