topic One way audio for phones using IP Proxy in Network Security

One way audio for phones using IP Proxy

tarekaljallad — Mon, 11 Mar 2019 20:42:41 GMT

I've got an ASA 5505 running 8.2 configured for solely as an IP phone proxy, it is the default gateway for the cucm box and PRI router, its inside interface is directly attached to the same subnet as all internal phones as well.

Calls can be placed from either end, but after call is established, proxy phones does not hear audio from internal or pstn phones. The proxy phone registers with cucm with the remote internal IP of the phone that obviously cannot be reached by corp network.

Debugging from pri router shows the rtp traffic destination is the internal ip address of the proxy phone 192.168.0.50, why is the phone registering with its internal IP 192.168.0.50 rather than its Natted external IP 50.50.50.50 that can be reachable by cucm and other phones?

Proxy phone is a 7945, after it registers, I do not see it under sh phone-proxy secure-phones, or sh phone-proxy signaling-sessions while on a call.

ASA Proxy config

interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 10.10.33.25 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 65.x.x.24 255.255.254.0
!
boot system disk0:/asa823-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name ----.com
same-security-traffic permit intra-interface
access-list inside_access_in extended permit ip host 10.10.33.10 any
access-list inside_access_in extended permit ip any host 10.10.33.10
access-list inside_access_in extended permit ip host 10.10.33.5 any
access-list inside_access_in extended permit ip any any
access-list outside_access_in extended permit udp any host 65.x.x.25 eq tftp
access-list outside_access_in extended permit udp any host 65.x.x.25
access-list outside_access_in extended permit icmp any interface outside
access-list outside_access_in extended permit ip any host 65.x.x.25
access-list outside_access_in extended permit ip any host 10.10.33.5
access-list inside_nat0_outbound extended permit ip host 10.10.33.10 10.10.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip host 10.10.33.10 204.x.x.0 255.255.254.0
access-list inside_nat0_outbound extended permit ip host 10.10.33.5 10.10.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip host 10.10.33.5 204.x.x.0 255.255.254.0
pager lines 24
logging enable
logging timestamp
logging console informational
logging buffered notifications
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-634-53.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 10.10.33.0 255.255.255.0
static (inside,outside) 65.x.x.25 10.10.33.10 netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 65.x.x.240 1
route inside 10.0.0.0 255.0.0.0 10.10.33.1 1
route inside 204.x.x.0 255.255.254.0 10.10.33.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto ca trustpoint phoneproxy_trustpoint
enrollment self
keypair proxy_key
crl configure
crypto ca trustpoint capf_trustpoint
enrollment terminal
crl configure
crypto ca trustpoint CAP-RTP-001
enrollment terminal
crl configure
crypto ca trustpoint CAP-RTP-002
enrollment terminal
crl configure
crypto ca trustpoint Cisco_Manufacturing_CA_Trustpoint
enrollment terminal
crl configure
crypto ca trustpoint CAP-RTP-001_trustpoint
enrollment terminal
no client-types
crl configure
crypto ca trustpoint CAP-RTP-002_trustpoint
enrollment terminal
no client-types
crl configure
crypto ca trustpoint _internal_ctl_phoneproxy_file_SAST_0
enrollment self
fqdn none
subject-name cn="_internal_ctl_phoneproxy_file_SAST_0";ou="STG";o="Cisco Inc"
keypair _internal_ctl_phoneproxy_file_SAST_0
crl configure
crypto ca trustpoint _internal_ctl_phoneproxy_file_SAST_1
enrollment self
fqdn none
subject-name cn="_internal_ctl_phoneproxy_file_SAST_1";ou="STG";o="Cisco Inc"
keypair _internal_ctl_phoneproxy_file_SAST_1
crl configure
crypto ca trustpoint _internal_PP_ctl_phoneproxy_file
enrollment self
fqdn none
subject-name cn="_internal_PP_ctl_phoneproxy_file";ou="STG";o="Cisco Inc"
keypair _internal_PP_ctl_phoneproxy_file
crl configure
crypto ca trustpoint cucm_tftp_server_tp
enrollment self
serial-number
keypair cucmtftp_kp
crl configure
crypto ca trustpoint _internal_asactl_SAST_0
enrollment self
fqdn none
subject-name cn="_internal_asactl_SAST_0";ou="STG";o="Cisco Inc"
keypair _internal_asactl_SAST_0
crl configure
crypto ca trustpoint _internal_asactl_SAST_1
enrollment self
fqdn none
subject-name cn="_internal_asactl_SAST_1";ou="STG";o="Cisco Inc"
keypair _internal_asactl_SAST_1
crl configure
crypto ca trustpoint _internal_PP_asactl
enrollment self
fqdn none
subject-name cn="_internal_PP_asactl";ou="STG";o="Cisco Inc"
keypair _internal_PP_asactl
crl configure

.......

certs emitted

.......

telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 10
ssh version 2
console timeout 0

!
tls-proxy asatlsp
server trust-point _internal_PP_asactl
ctl-file asactl
record-entry cucm-tftp trustpoint cucm_tftp_server_tp address 65.x.x.25
no shutdown
!
media-termination asdm_media_termination
address 10.10.33.26 interface inside
address 65.x.x.26 interface outside

!
phone-proxy asdm_phone_proxy
media-termination asdm_media_termination
tftp-server address 10.10.33.10 interface inside
tls-proxy asatlsp
cipc security-mode authenticated
ctl-file asactl
no disable service-settings
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username admin password xxxxxxxxxx encrypted
!
class-map sec-sccp
match port tcp eq 2334
class-map inspection_default
match default-inspection-traffic
class-map sec-sip
match port tcp eq 5061
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map pp
class sec-sip
inspect sip phone-proxy asdm_phone_proxy
class sec-sccp
inspect skinny phone-proxy asdm_phone_proxy
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
service-policy pp interface outside
prompt hostname context

Thanks,

Tarek

One way audio for phones using IP Proxy

phamvinhdat — Mon, 06 Jun 2011 15:59:34 GMT

Check and make sure that the ip address range for proxy phone are not blocked in ASA.

Dat

One way audio for phones using IP Proxy

tarekaljallad — Mon, 06 Jun 2011 16:37:01 GMT

the proxy phone public IP is not blocked and can ping the ASA's outside interface, the Watchguard Firebox that is in front of the ASA is set to allow any any to the ASA IP, termination IP and NATted IP for TFTP.

One way audio for phones using IP Proxy

vincehgov — Mon, 06 Jun 2011 16:49:24 GMT

I think I had an issue similar to this when my ASA wasn't the default route to the internet from the LAN. I had to do some reverse NATing to get packets from the internal phones to go back out through the ASA.

Vince

One way audio for phones using IP Proxy

tarekaljallad — Mon, 06 Jun 2011 16:54:51 GMT

I thought the same thing, the PRI router's default route is to the ASA, and we have the same issue when calling external numbers.

One way audio for phones using IP Proxy

vincehgov — Mon, 06 Jun 2011 17:13:35 GMT

What about all the phones?

One way audio for phones using IP Proxy

Steven Griffin — Mon, 06 Jun 2011 17:34:13 GMT

Tarek,

I've had intermittent one-way voice before on Phone Proxy. If you are 'always' getting one-way voice then you need to look at your firewalls and routing as other folks in this post have suggested.

For intermittent one-way voice on Phone Proxy, the one work around I found is to destroy/re-establish the RTP stream. The easiest way to do this is to place the call on hold and then pick it back up. Doing that should force the RTP stream to re-establish and two-way voice should be available.

It occured to me on some early versions of 8.2. You're config shows you are running 8.2(3) so be try running latest 8.2 code which was 8.2(5) as of this post. That might just solve your issue.

-Steven

One way audio for phones using IP Proxy

tarekaljallad — Mon, 06 Jun 2011 18:18:35 GMT

Thanks Steve, is it expected though to see the internal IP address of the proxy phone registering with cm? I can't picture how phones can communicate with a proxy phone if its IP is not natted, thus making it unreachable.

One way audio for phones using IP Proxy

Jay Johnston — Mon, 06 Jun 2011 19:31:53 GMT

I moved this thread into the Firewalling space, since most of the phone-proxy related issues are raised here.

If you haven't already, please check out this document on troubleshooting and common issues with phone proxy:

https://supportforums.cisco.com/docs/DOC-1226

You already have per-interface MTA configured, so packet captures taken at the time you bring up a call would help determine if the voice traffic is reaching the ASA or not...we've seen bad routes or devices in the path blocking media traffic before it can reach the MTA interfaces of the ASA.

Packet captures on ASA:

https://supportforums.cisco.com/docs/DOC-1222

One way audio for phones using IP Proxy

tarekaljallad — Tue, 07 Jun 2011 13:45:44 GMT

Ok, did a packet capture on the ASA and saw what I expected, internal phone sends packets to real private IP of proxy phone.

134: 10:20:05.889129 802.1Q vlan#1 P0 10.10.33.17.31540 > 192.168.1.26.27782: udp 172

135: 10:20:05.889144 802.1Q vlan#2 P0 65.x.x.24.36960 > 192.168.1.26.27782: udp 172

136: 10:20:05.890609 802.1Q vlan#2 P0 68.x.x.115.27782 > 65.x.x.24.36960: udp 172

137: 10:20:05.890624 802.1Q vlan#1 P0 68.x.x.115.27782 > 10.10.33.17.31540: udp 172

138: 10:20:05.908949 802.1Q vlan#2 P0 68.x.x.115.27782 > 65.123.205.24.36960: udp 172

139: 10:20:05.908964 802.1Q vlan#1 P0 68.x.x.115.27782 > 10.10.33.17.31540: udp 172

140: 10:20:05.910170 802.1Q vlan#1 P0 10.10.33.17.31540 > 192.168.1.26.27782: udp 172

141: 10:20:05.910170 802.1Q vlan#2 P0 65.x.x.24.36960 > 192.168.1.26.27782: udp 172

142: 10:20:05.931180 802.1Q vlan#1 P0 10.10.33.17.31540 > 192.168.1.26.27782: udp 172

One way audio for phones using IP Proxy

brquinn — Tue, 07 Jun 2011 14:27:56 GMT

Perhaps the phone is not completely registered via phone proxy? It may be registered directly to the CUCM. What do you get when you run 'show phone-proxy secure-phones'? Also, what version are you running exactly? Did you upgrade to 8.2.5?

I know you said you think there weren't any NAT/Routing issues since the ASA is the default gateway. You may want to add this config just in case. It will NAT inbound traffic to the IP of the ASA so traffic will be forced to return through the ASA.

PhoneProxyASA(config)# nat (outside) 55 0 0 outside

PhoneProxyASA(config)# global (inside) 55 interface

Also, have you tried reloading the ASA? And have you deleted the CTL file on the phone-proxy phone(s) after making changes to the ASA? How many Call Managers are in your cluster?

Thanks,

Brendan