Re: WRP400 stops responding after browsing certain websites - Page 14

rgp · ‎04-20-2009

Hi support

We are a danish ISP who use Linksys RTP300 and WRP400 routers as CPE equitment. Trough our Danish Cisco contact (Henrik Bønnelycke) we have been told to discuss our prolems with the WRP400 router here.

Our problem is that the router seems quite unstable at many customers (who have no problem with RTP300). In the last few months we have been forced to replace a large amount of routes because the WRP400 just router stops responding (Cannot ping LAN+WAN interface, phone dead) while browsing certain websites fx. http://www.nordjyske.dk. At the time we are not able to repoduce the error here i the office and the problem are only at some customers.

At the begining we testet if the customers NIC was the source to the failure but as I see it it is not the case. We have tryid to exchange the customers NIS card and the problem was the same. Together with the fact that it works with a RTP300 router we must conclude something must be wrong with the WRP400.

From my point of view the problem could be related to the router content filter, activex filter or something like that when all the customers all have the problem on certain websites.

Please help we replaces 10-20 WRP400 routes every week right now and have no faith let for the WRP400 router.

Danmark.

René Gjerlev Pedersen

Driftstekniker

Bredbåndnord I/S

rvcarstens · ‎01-27-2011

Hi Eric M.

I have been told by my provider that there must be something wrong with my

router.

I believe the reason for this is also that when I set the phone data some of

them change after a short time.

Also when I set the data as instructed by my provider and save the settings

they do not stay as I set them. They change back to the factory setting.

If I set them a number times I can get them to show the correct value after

save.

I did that yesterday but today they are back to factory settings.

If I back up the file and restore it they data are as the factory settings.

Based on an advice I found on the internet about the slow speed that

sometimes happen for the internet transmission I have changed the

transmission rate from Auto to 54 Mbps. That is still as I set it some days

ago.

I am running the 1.00.06 May 29 2008 version because I was asked by my

provider to do so.

Since I changed to the older version I have had fewer instances were the

system dies completely.

I believe they will change my curreent WRP to a new according to warranty.

Regards

Ricky Carstens

vianet.ca · ‎01-27-2011

Hello,

I'm currently on vacation and will return on February 7th, 2011.

Please call 1-800-788-0363 for assistance.

--

Kind Regards,

Vic Laface

Vianet Internet Solutions

1-800-788-0363 Ext. 5236

www.vianet.ca

Eric Moyers · ‎01-28-2011

Based on the new information that you provided, with your unit not keeping the saved settings and constantly reverting back to factory, I agree that there is an issue with your WRP400. If the unit was provided by your ISP, then they should replace the unit for you. Once that is complete, if you continue to have problems with the new unit. Please contact us back and let us provide assistance for you.

Eric Moyers
Cisco Network Support Engineer
1-866-606-1866

glenbellamy · ‎02-03-2011

Hi all

I have had this WRP400 Router 4 about 7months now, and had logged a fault with Cisco regarding it freezing up (no Wireless/LAN/VOIP connectivity). After troubleshooting it and trying numerous things (settings/firmware versions) they said they would replace it. Well, now that I have the replacement router, the issue remains.

I have just found this post (cant believe I did find it sooner) and am going to try version 1.04 as suggested in the post, as well as the RESTRICT SOURCE IP and AUTH settings.

I am not holding my breath, as this post continues to grow even with these suggestions in place.

Cisco, you need to pull your finger out on this issue, and "nimusell" (post 185) suggesting to ditch this one and purchase another router at over twice the price is not a helpful solution.

I look forward to some firmware that does the job correctly.

regards

vianet.ca · ‎02-03-2011

Hello,

I'm currently on vacation and will return on February 7th, 2011.

Please call 1-800-788-0363 for assistance.

--

Kind Regards,

Vic Laface

Vianet Internet Solutions

1-800-788-0363 Ext. 5236

www.vianet.ca

glenbellamy · ‎02-04-2011

Hi again.

I have just witnessed (very lucky timing) my WRP400 router freeze. I have been running a syslog server on my PC for the last 14 hours or so trying to identify the possible "SIP attack" theory mentioned in the post by "Luci Beneduci" (post 117, Sep 10, 2010 3:54 AM)

"In my case the block is due to SIP attack from external IP that try many time to find righet user e pwd ofor SIP login: this attempts block device (it's very expensive, and the hardware .... :-((

the solution is block this attempt using a firewall, I don't think this is possible trought the firewall integrated in WRP400!"

I dont pretend to know exactly what is happening in this "attack", if it actually is a malicious attack, but it looks to me that an external address (in this case it was 114.108.150.227:5070, a korean site) is making huge numbers of requests, and as I watched it happen, within 60secs, it stopped and my router was frozen. I have the log of this happening, but not sure who can help me determine what was actually happening, and more importantly how to stop these attacks from crippling the router.

Looking at the log, I see that from the start of the attack to the time my router froze was 39seconds. In that time it had received 6478 requests (I am calling them requests, but half of these may be replies, so it could be 3239 requests).

Compairing this activity to the rest of the log, I had 1010 requests from my VOIP provider in a 9hour period. (once again I am calling them requests, but half of these may be replies, so it could be 505 requests).

looking at these numbers, it means the router is getting about 58hours worth of SIP traffic in just over half a minute before it is on its knees.

Cisco engineers, can I give this syslog log file to you, will it help you determine what is happening to to cause the freeze?

here is a very tiny snippet of the log (I have replaced my external IP addres with "my.ip.add.ess" to try and stop it from being attacked even more.

---------------------------------------------------------------------------------------------------------------------------------------------

2011-02-05 13:10:50 Local0.Info 192.168.0.1 [0]<<114.108.150.227:5077(416)

2011-02-05 13:10:50 Local7.Debug 192.168.0.1 REGISTER sip:56455645@my.ip.add.ress SIP/2.0

Via: SIP/2.0/UDP 127.0.0.1:5077;branch=z9hG4bK-2172623620;rport

Content-Length: 0

From: "56455645"<>56455645@my.ip.add.ress>; tag=353634353536343501393537393134363635

Accept: application/sdp

User-Agent: friendly-scanner

To: "56455645"<>56455645@my.ip.add.ress>

Contact: sip:56455645@my.ip.add.ress

CSeq: 1 REGISTER

Call-ID: 1126188245

Max-Forwards: 70

2011-02-05 13:10:50 Local0.Info 192.168.0.1

2011-02-05 13:10:50 Local2.Debug 192.168.0.1 OP ADD OBJ t=6 i=6080 s=2913

2011-02-05 13:10:50 Local2.Debug 192.168.0.1 OP ADD OBJ t=0 i=52 s=2922

2011-02-05 13:10:50 Local0.Info 192.168.0.1 [0]->114.108.150.227:5077(331)

2011-02-05 13:10:50 Local7.Debug 192.168.0.1 SIP/2.0 404 Not Found

To: "56455645"<>56455645@my.ip.add.ress>;tag=57768892f31cf4c9i0

From: "56455645"<>56455645@my.ip.add.ress>; tag=353634353536343501393537393134363635

Call-ID: 1126188245

CSeq: 1 REGISTER

Via: SIP/2.0/UDP 127.0.0.1:5077;branch=z9hG4bK-2172623620

Server: Linksys/WRP400-1.01.00

Content-Length: 0

2011-02-05 13:10:50 Local0.Info 192.168.0.1

2011-02-05 13:10:50 Local0.Info 192.168.0.1 [0]<<114.108.150.227:5070(386)

2011-02-05 13:10:50 Local7.Debug 192.168.0.1 REGISTER sip:6737@my.ip.add.ress SIP/2.0

Via: SIP/2.0/UDP 127.0.0.1:5070;branch=z9hG4bK-2212791913;rport

Content-Length: 0

From: "6737"<>6737@my.ip.add.ress>; tag=363733370131393031353836343137

Accept: application/sdp

User-Agent: friendly-scanner

To: "6737"<>6737@my.ip.add.ress>

Contact: sip:6737@my.ip.add.ress

CSeq: 1 REGISTER

Call-ID: 3631472276

Max-Forwards: 70

2011-02-05 13:10:50 Local0.Info 192.168.0.1

--------------------------------------------------------------------------------------------------------------------------------------------

router freezes just here after 39secs of constand attack.

--------------------------------------------------------------------------------------------------------------------------------------------

look forward to hearing from you Cisco

glenbellamy · ‎02-10-2011

Ok,

so 1 week has gone by since posting my observation and actual proof of what is actually happening to the router to cause it to freeze up, and what have I seen happen from Cisco?...nothing, absolutely nothing.

Well I should have expected this, as this post has been going for, hmmm, how many years! now?

When I go to the contact us section is strongly encourages me to post my issues here as there are active Cisco technicians that will help me (and the community)...but where are they.

At the moment I feel like I am standing in the middle of an empty town square with tumble weed rolling by, and no community,. and definitely no Cisco support around.

So how does one get support from Cisco?

regards

streaves · ‎02-10-2011

Hi Glen -- Please provide the ticket number you received when you contacted the Small Business Support Center so we may escalate your case. If you've not yet contacted the Support Center, please do so right away. You'll find a list of international support numbers here: www.cisco.com/go/sbsc.

The US Support Center is available 24/7.

Thanks for participating in the Support Community.

Stephanie Reaves

Cisco Small Business Technology Group

tomasz-kowalczyk · ‎02-11-2011

Hi,

I have the same issue with WRP400, after setting SIP auth invite, the router looses WAN, not on every call but few times per month.

I have called Cisco 24/7 in US, but:

1) I was informed that I'll have to create my own syslog messages (I am doing it now), because they need it from my device.

2) I'll receive email with ticket number, on which I could reply attaching log. But email didn't come

What I can add, that before I knew the issue, I've sent device to my distributor (because of hanging up issue). I got new WRP, but still the issue happens.

Regards, Tomasz Kowalczyk

rvcarstens · ‎02-22-2011

I have now been offered a replacement by my provider.

It costs me extra but I would like to do it if I get a stabile net and phone, and it doesn't seem that Cisco is doing something full hearted to get this solved.

It is a Small Business Pro SRP521W-K9-G5.

I have accepted this but if any here knows of problems with this system then please let me know.

Regards

Ricky V. Carstens

Denmark

keyimagery · ‎02-22-2011

Hi Ricky,

Good luck with the SRP512W. You might want to check out these links...

https://www.myciscocommunity.com/thread/14863

https://supportforums.cisco.com/message/3271247#3271247

https://supportforums.cisco.com/docs/DOC-12874

I was a WRP400 user experiencing exactly the same problems mentioned in this thread and decided to purchase the SRP521. Unfortunately I experienced the exact same problems with the SRP512W. Luckily for me I was able to return it for a refund. I'm now using a TP-Link TL-WR1043ND and separate ATA and they are both running flawlessly.

Regards,

Mike Walen.

www.KeyImagery.com

rvcarstens · ‎02-24-2011

Thank you very much for the reply.

I have asked my IP provider to ensure that it will work fine.

I will let you know the answer.

Seems that the problem is a general software problem in Cisco products.

Best regards

Ricky

aemcomcco · ‎03-10-2011

Hi Experts, I write about this argument because our WRP400s continue to freeze.
We are an Internet and Telephony Service Provider and we have chosen Cisco-Linksys CPEs imagining to find the same stability of well know Cisco equipments.
Unfortunately, we find that the Linksys devices are not Cisco devices.
We use WRP400s since version firmware 1.00.04c.

Over the years we have tested this list of firmwares:
1.00.04c
1.00.06
1.01.00
1.01.01
2.00.05
2.00.11
2.00.16
2.00.20
2.00.21
2.00.26 (actually used)

We can say that there have been improvements but we are far from a stable device.

The reason of this post is a common block presents in latest version 1 and all veriosion 2 of the firmware.
After several days of normal activity the voice module of WRP400 freezes.

This is a description of WRP400 during its block:

- PING is OK
- remote access to the router web menu is OK
- Internet surfing from LAN is OK
- phone line is KO
- remote access to the voice web module is KO
- every operations from the router web menu are ineffective (change LAN IP, diagnostic PING or diagnostic LAN search, reboot button, reboot url of version 2.00.26, ecc)

The only procedure to restore normal working is power off and on the device.

Now I'm trying to reproduce the cause of these stops without succes.

I think that the problem is in the router module and consequently blocks the voice module.

I think in a memory leak and so the first question is:

Is there a tool to monitor memory and CPU usage? Is there information of router uptime (no elapsed time of voice module)?

Can you find a workaround? e.g. a configurable hardware reboot in cron?

I'll update this post with new elements as soon as possible.

Thanks in advance.

Gilbert Rebeiro · ‎03-27-2011

Hi,

We are in the same situation as you.

We have around 20 of these units, and they operate properly for about 1 week.

Then the router stops functioning.

No pings, no webinterface, no voip.

After reboot all works again.

Is there any soluition in sight?

We are using the latest firmware Firmware Version: 2.00.20

Has there been any progress with this issue?

Gilbert.

sberla544 · ‎03-27-2011

Hi to everybody.

I think we've managed to fix the block/freeze problem, or, better, we've found a workaround.

For first, the latest firmware isn't 2.00.20 but 2.00.26:

http://www.cisco.com/cisco/software/release.html?mdfid=282414113&softwareid=282463656&release=2.00.26&relind=AVAILABLE&rellifecycle=&reltype=latest

Here the release notes:

http://www.cisco.com/en/US/docs/voice_ip_comm/csbpvga/wrp400/release/notes/WRP400_RN_v2-00-26.pdf

Cisco says this firmware upgrades the voice modules, fix a bug of the 2.00.20 that didn't let the fax work properly and, above all, fix something about this block/freeze problem.

Anyway, we've fixed the problem in this way:

1) Set the Restrict Source IP ON for all the voice lines (even if they're unused and switched off)

2) Block the access on the 5060 port from every source external to your network.

You can do this on your network gateway/firewall, if you have one. In this way you will block out all the SIP attacks that come from the internet.

Obviously, the point 2 is very very important.

As soon as we blocked out the attacks on the 5060, all the WRP400 have stopped freezing every damn few days.

We've seen that, also only with the point 1, the Restrict Source IP, the WRP400 was less vulnerable to the attacks and freezed a lot less than before....but it freezed anyway...and it goes offline for all the time of an attack, so if it receive an attack of 30 minutes, it will stop responding and working for 30 minutes...

We've tried this test with the firmware 1.01.00 and 2.00.20 and they both were the same.

The 2.00.20 had some problem with the fax.

Sometimes we couldn't use any fax with it.

We've currently testing the 2.00.26 but now, with the gateway blocking external attacks on the 5060 port, we're sure we'll have no more problems.

Anyway, i couldn't tell that this WRP400 is a good product....