<div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im"><br>
> In both cases, allowguest=no, alwaysauthrej=yes, and nat=yes was set in<br>
> sip.conf.<br>
><br>
> Unless these log messages are universalized and unless the source IP<br>
> address is always logged, there is NO WAY to use Fail2ban or any other<br>
> security tool effectively.<br>
<br>
</div>You can look into the CDRs. There should be an originator's IP address there.<br>
And if you will find many failed call attempts from the same source IP, you<br>
can activate Fail2ban or similar tool.<br>
<div class="im"><br></div></blockquote><div><br></div><div>Okay, so there is no mention of the source IP in CDRs either. When the fake message is sent it doesn't log that attempt in CDRs. Do you now agree that this is a very much needed log that should be there? So, there is literary no way to grab the IP. It seems that this should be part of the allowguest section to log the source IP just as the "fake" message is sent.</div>
<div><br></div><div>I also checked res_security_log and the module is loaded but it doesn't add ANY whatsoever logs in Asterisk 1.8. Is that an incomplete module?</div><div><br></div><div>Regards,</div><div> </div></div>