Telium Support Group

When you perform an upgrade/update to any module in FreePBX (even a minor one) there is the possibility that FreePBX will change the structure of the tables in MySQL. Since HAAst will (intentionally) not sync metadata (SQL structures), you must ensure that the peers do not attempt to synchronize data during such an upgrade/update.

The Maintenance and Operations Guide shows the complete upgrade procedure (see section 6). But if you are very experienced with Linux & FreePBX, you can follow this short-cut:

1. Upgrade A
   1. Unplug the network connection from A
   2. Upgrade FreePBX on A
2. Upgrade B
   1. Unplug the network connection from B
   2. Replug the network connection to A
   3. Upgrade FreePBX on B
3. Re-establish cluster
   1. Replug the network connection from B
   2. Wait for the cluster to HAAst restablish automatically
   3. Use the telnet/web interface to make the preferred peer active. (Or wait for automatic fallback during the maintenance window if enabled in the haast.conf file)

The key concept here is that a standby peer must NOT be able to see an active peer which is running a different version (or different modules installed/enabled) of the configuration generator.

Note that this applies only to FreePBX. Other configuration generators do a much better job managing settings and keeping settings-code aligned.

The answer depends on the location of your two PBX’s. If the two PBX’s are located on the same subnet, then

1. Move IP: Use the VoIPNIC option of HAAst to move a single IP between peers. This will allow for rapid reconnection of downstream (user agents) and upstream (trunks)

If the two PBX’s are located on different subnets (from each other):
[list=2]
[*]SRV records: Assuming your user agents (phone sets) support SRV records (which most do), then you should create SRV records for your two PBX’s. Most user agents will perform a DNS lookup for SRV records to find available PBX’s, and try them in order of priority until they successfully register with a PBX. For example, if you have PBX’s located in data centers dc1 and dc2, create two DNS entries (in your internal DNS server) as follows:

type=srv
name=_sip._udp.mydomain.com
priority= 10
weight=0
port=5060
hostname=pbx1.local

and

type=srv
name=_sip._udp.mydomain.com
priority= 20
weight=0
port=5060
hostname=pbx2.local

[*]Route Change: Use the pre/post Asterisk start/stop event handlers of HAAst to update routes in your router(s). Set the updated routes to point to the new PBX address.
[*]DNS update: Use the pre/post asterisk start/stop event handlers to update a public DNS entry. Be sure to set the TTL value low enough that phones will lookup the new IP in a reasonable timeframe.[/list]

Note: Using SRV records or DNS entries makes it easy for users with softphones to move on and off LAN and resume a PBX connection without manual intervention.

Yes, HAAst was certified Asterisk 14 compatible in November 2016. Not a lot of companies are running Asterisk 14 yet (in production) as of Jan 2017, so you will be on the leading edge. But I assume you need some Asterisk 14 features.

You didn’t mention your customer name/number but based on the username (and 4500 phone sets) I think I found you in our CRM system. It looks like your maintenance agreement expired last year so you will need to contact admin@telium.io to upgrade your license (otherwise upgrading HAAst will cause it to run as the ‘free edition’).

The fact that the license violation occurs close to the time of a log rotation is a red herring (no relationship).

SecAst does not track calls in progress; it asks Asterisk to report the number of calls in progress. You can perform the same query from the command line:

asterisk -vx ‘core show calls’

So the question is why is your Asterisk installation reporting 8 calls in progress. This can be due to:

• Valid users making calls in or out
• Valid user starting the conference feature
• Incoming callers leaving a voicemail
• Automated calls
• Hackers calling in to probe your dialplan
• Asterisk incorrectly not releasing channels
• Dialplan errors

If the number of calls reports higher than you expect, you can delve deeper into the calls in progress using a command like:

asterisk -vx ‘core show channels’

If you are using FreePBX then Sangoma recently started making automatic calls in the background to set ‘time condition’ variables. In essence FreepBX is making invisible calls, and Asterisk will report these as calls in progress; nothing we can do about it, and that won’t explain 8 calls in progress.

So…in a nutshell SecAst does not count calls – it gets that number from Asterisk. Something else is going on with your Asterisk setup. Repeat the first command above once every 30 seconds and watch if your ‘calls processed’ count is increasing even when users aren’t making calls. That should help you figure out why Asterisk is reporting a count you don’t expect!

And now the bad news…it sounds like you’re struggling with some basic Linux admin and Asterisk admin tasks. If this is a commercial installation I would recommend purchasing 2 hours of support so we can help you through setup. If this is a home installation you probably have a big learning curve ahead of you in terms of Ubuntu and Asterisk – I’m not sure if it’s worthwhile for you to continue but we can’t really offer free support for Asterisk (or Ubuntu). I’m not sure if you are using a configuration generator either (you don’t offer any details of your system), but if this is a commercial installation you may want to move up to a package like xCALLY which provides a very professional turnkey solution without many of the headaches involved with many smaller packages (you don’t need to know anything about Linux or Asterisk).

When the peers are in a state of dual-active contention one of the peers is considered improperly active (invalid state). In other words, it should not be processing calls at all. Usually trunks (E1/T1/SIP/IAX/etc) are forced to one peer or the other which means one peer will not be getting (more) calls. If your configuration allows both peers to handle calls simultaneous then you are in the minority (this is not typical).

For this reason the number of active calls is not a criteria in determining which peer to demote.

The peerlink error means that the two peers are unable to talk to one another. This is most likely due to Security Group misconfiguration within AWS. As a simple test, try to telnet from one peer to the other peer on port 3002; for example:


telnet 10.1.2.3 3002

This command will likely fail/timeout, which confirms the Security Group misconfiguration. To resolve this, and assuming both peers are in the same Security Group, and iptables/firewalld is disabled, set that Security Group to allow “itself” traffic on all ports (in AWS). After doing so the peers should quickly find each other and the Peerlink indicators in the GUI will turn green.

If you decide you want the highest level of security possible, only enable destination port 3002 TCP access between the peers (plus ports needed for file/directory/database sync as optionally defined in your haast.conf). But if the peers are in the same Security Group you should be fine allowing all traffic.

No. The best place to block attackers is at the network edge; i.e. at your firewall.

Although SecAst supports using iptables to block IP’s at the PBX, it does so primarily for testing / prototypes / proof of concepts etc. In general you should not allow attackers that far into your network.

SecAst is designed to block attackers at the firewall, and is compatible with most firewalls through its event handler system. SecAst includes a sample event handler for the ‘Mikrotik’ and ‘pfSense’ firewalls, and these scripts can be modified for most other firewalls. We also invite customers to submit their firewall event handlers to become templates for other users.

The most likely cause is that you have incorrectly configured synchronization between your peers; you are mistakenly synchronizing the G729 license files which is causing Asterisk to refuse them. First, take a look at the Asterisk (full) log to look for G729 related errors on startup – you will likely see one relating to a hardware change.

Digium stores the G729 license files in the directory /var/lib/asterisk/licenses. Be sure that this directory is excluded from HAAst synchronization. If you are synchronizing a parent directory then you must exclude this directory; for example:


; Asterisk support
elastix-astsupport/description=Asterisk support
elastix-astsupport/type=directory
elastix-astsupport/directory=/var/lib/asterisk
elastix-astsupport/excludepattern=lost+found | licenses
elastix-astsupport/interval=3600
elastix-astsupport/compression=9
elastix-astsupport/debug=off
elastix-astsupport/postsynccondition=never
elastix-astsupport/recurse=true

Alternatively, some companies choose to use open source G729 codec implementations which are not encumbered by Digium’s licensing, as outlined on web sites like this http://asterisk.hosting.lv/ . Many people don’t realize that the g.729 compression algorithm is not protected by copyright (expired patent was held by Intel), though Digium’s implementation is patented (and the fee is for licensing their implementation). Please note that you should check with your own legal counsel to determine if the open source G729 codec can be used in your jurisdiction without requiring royalty payments.