For Hosted PBX users, an incorrectly configured UDP Timeout is one of the most common causes of dropped calls and missed inbound calls

What is UDP Timeout?

UDP Timeout refers to the duration a UDP Pinhole (a temporary opening in your firewall or router) remains open. Depending on your equipment, this timeout can range from a few seconds to many minutes. Most devices fall under the minute(s) range.

Info: UDP Timeout is commonly set to 30 or 60 seconds by default, however in special cases with Hosted Voice, this setting can be updated up to 300. For Hosted PBX, we recommend setting your firewall's UDP Timeout to at least 300 seconds (5 minutes). This gives your phone enough time to re-register before the port is closed. Contact your IT administrator or network provider to make this change.

Important: Please be aware that leaving a UDP Port open for an extended period of time can be a security risk for some network devices. 

If you are not certain and have little to no knowledge with networking, do not recommend changes on Hosted Voice timeout settings, consulting higher support is always the best option when dealing with these kind of configurations.

Brief Explanation of UDP Timeouts

UDP Ports must be opened from the Inside of your customer Network (explanation below), that port will timeout within a set timeframe after the last message was transmitted.

1. Your Phone Registers using local port 5060, sending its registration to the Switch.
2. As registration passes through your Firewall, it assigns a random UDP port to the external connection (sometimes using the same internal port).
3. The Switch keeps this as Registration data and knows it can contact the phone at this Port, as long as the port doesn't close or change.
4. Re-registration or Keep-Alive can be sent to keep this port open. Typically, the port doesn't change often.
5. If the UDP Timeout is too short, the firewall will close the port before Re-registration occurs. During this period, SIP messages from the Switch would be sent to a port that the Firewall has already closed, and the packets would be dropped. Picture Example Below.

What are the Symptoms of UDP Timeouts?

Aside from the normal symptoms mentioned below, it is easily recognizable in a SIP Trace of a failed or dropped call. You will see 5 duplicated SIP Messages, such as an INVITE, all sent quickly with no response. Followed by a BYE from the Switch either right away or two minutes later.

• Incoming Call Goes straight to Voicemail, or doesn't ring certain phones in a ring group.
• Calls drop at exactly 17, 32, and 47 minutes.
• Calls drop randomly.
• Firewall Port (registration port) for SIP Traffic changes frequently.

What Symptoms are NOT caused by UDP Timeouts?

UDP Timeout issues can look similar to other problems. If you see the following, UDP Timeout is likely not the issue

• Phone appears to have lost registration. The phone and the Switch are unaware of the Firewall's UDP Timeout Length; both sides will think Registration is Active.
• Not able to place Outbound calls. The phone will always open the firewall port itself because it's inside the Network, and the switch will always respond to the same port.
• Call Quality issues.

How do I fix a UDP Timeout Issue?

UDP Timeout is a setting on your firewall or router. It is not something that can be changed from the Hosted PBX system or your SIP phone. Your IT administrator or network provider will need to make this change.

Recommended setting: Set your firewall's UDP Timeout (sometimes called "UDP Session Timeout" or "UDP State Timeout") to 300 seconds (5 minutes) or higher.

Helpful links:

• RFC 4787 -  Network Address Translation (NAT) Behavioural Requirements for Unicast UDP (IETF, tools.ietf.org/html/rfc4787)
• RFC 3261 - SIP: Session Initiation Protocol (IETF, tools.ietf.org/html/rfc3261)
• Cisco Meraki Firewall Configuration Guide (Cisco Meraki Documentation)
• Fortinet FortiGate Session Timeout Settings (Fortinet Documentation)
• SonicWall UDP Timeout Configuration (SonicWall Documentation)