Issues with two VoIP accounts on a dual ATA

Eighteen months/2 years ago I was comparing VoIP suppliers with a view to port my BT number to VoIP. At the time I already had a VoIP number which I had used since 2004.
During my comparison, I came across an article regarding using two different VoIP accounts on a dual ATA - I cannot remember which VoIP provider's FAQ it was, but it was not A&A.

Recently with now twoVoIP accounts on a dual ATA (A Cisco ATA191 I have experienced issues such as my phone not ringing when called.

One of my numbers is through A&A the other used to be DrayTel but taken over by Telappliant.

A&A's FAQs at https://support.aa.net.uk/VoIP_NAT say, "The local SIP port (often 5060) and the local RTP port(s) can't be the same on the 2 phones - if they are the same, you'll get weirdness on incoming calls."

So could the solution be as simple as setting one line to use a different SIP port? Currently both 5060 - Is there a preferred alternative port number? It all seems rather random......

Cheers!

Set one number to use port 5060 and the second number to use 5061

See:
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/...

In reply to a post by Pheasant:

Set one number to use port 5060 and the second number to use 5061

See:
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/...

If these are different VOIP ISPs why not just use 5060 for both of them?

Because the only way the ATA can distinguish incoming SIP calls is if they are delivered to different ports.

The factory default on Cisco ATAs is 5060 for the first line and 5061 for the second line, if you are not expecting direct inbound calls then using other ports will cut down on hits from SIP port scanners if you are not using firewall rules to block them.

If you're on A&A and using A&A VoIP then you could also have that service use IPv6, and leave the second VoIP service using IPv4.

In reply to a post by tdw42:

Because the only way the ATA can distinguish incoming SIP calls is if they are delivered to different ports.

The factory default on Cisco ATAs is 5060 for the first line and 5061 for the second line, if you are not expecting direct inbound calls then using other ports will cut down on hits from SIP port scanners if you are not using firewall rules to block them.

The VOIP ISP sends incoming calls to device(s) that are registered. My Cisco SPA112 works fine with both lines set to port 5060 as does my Gigaset N300.

According to Mr Google "Port 5060 is commonly used for non-encrypted signaling traffic, whereas port 5061 is typically used for traffic encrypted with Transport Layer Security (TLS)." - Not that I new that!

In reply to a post by Michael_Chare:

The VOIP ISP sends incoming calls to device(s) that are registered.

Unless you have a firewall, anyone can call your phone at your IP, don't need to go through the server.
SIP URLs such as sip:[email protected] can ring a phone on port 5600 by default.

This is why A&A and other VoIP suppliers recommend (as their ISP supplies) multiple IP addresses, one for a firewall, one for the ATA and limiting only the A&A servers (e.g. voiceless) from being able to connect to your ATA using a firewall.

VoIP unwanted calls (e.g. "SPAM") is a thing

In reply to a post by jchamier:

In reply to a post by Michael_Chare:

The VOIP ISP sends incoming calls to device(s) that are registered.

Unless you have a firewall, anyone can call your phone at your IP, don't need to go through the server.
SIP URLs such as sip:[email protected] can ring a phone on port 5600 by default.

This is why A&A and other VoIP suppliers recommend (as their ISP supplies) multiple IP addresses, one for a firewall, one for the ATA and limiting only the A&A servers (e.g. voiceless) from being able to connect to your ATA using a firewall.

VoIP unwanted calls (e.g. "SPAM") is a thing

Most modern VoIP kit (I know this is the case on Panasonic and Yealink) usually have the option to block calls from other IPs to stop SPIT (Spam over Internet telephony), which may be the default option. Also most people just rely on STUN or Keep Alives to open incoming connections via 5060 across NAT, this will mean incoming calls from other IP addresses can't find there way back to make unsolicited calls and port 5060 will be hidden to all traffic except the server connected to when setting up the outgoing connection to established the SIP session. So its not usually a problem unless someone adds a NAT forward for any incoming 5060 traffic AND their phone is set to allow any IP. With default setups SPIT shouldn't be an issue.

However the same thing stopping SPIT can cause a problem with incoming calls not getting through. For example Sipgate (I've had this issue when using IPv6) have more than one VoIP server. So an outbound connection to set up SIP and wait for calls might be made to one of their servers and Keep Alives keep a route through the firewall open, however if due to load balancing a call comes through from Sipgates other servers with a different IP address, it can't get through the firewall. The solution then is to set up a NAT rule and/or firewall rule to allow all the IP addresses the VoIP provider could use. Also the method to prevent SPIT calls may also block this different IP address depending on how well it is implemented and how it is filtering. Typically this problem manifests itself with some incoming calls working or working for a while, then it stops intermittently.

Yes if you're using NAT and STUN it should be effectively a firewall, but the likes of AAISP document that "NAT is evil" and want everyone using routed IP with firewalling.