Jabber some Calls dropping immediately when encryption is enabled

[Ragnar]

Hello,

we have Cisco Jabber (12.9.6) up and running for our employees.

Everyone (on site, remote site and vpn) can connect with the Jabber Client and place/receive calls.

As soon as we enable encryption (TLS, LSC Certificates) we have the following problem.

Every now and then the call window dissapears as soon as accepting a call or placing a call and the connection/call is not being established (after that it somehow looks like jabber is quickly doing a reregister), sometimes we can place 5 calls without any problem and sometimes it "drops" several times in a row.

As i said this problem only occurs when the Security Profile for Jabber is set to TLS encrypted.

We also have some Cisco 8851 and 8961 IP Phones and even with TLS encryption enabled we have no problems at all. So this is only affecting Cisco Jabber.

I would very much appreciate your help to resolve this issue.

Thank you.

Edited the Message because after some testing we found out that the issue is also happening onsite.

I attached some logs (edited names and IPs) - The logs where the error is happening are starting with "failed". The logs with the successful call are starting with "successful"

For better understanding:

14.14.14.14 = CUBE - VoiceGW

+49122222222 = external calling mobile phone

+492111111111111 = Phone Number of Jabber Client (CSFTEST)

11.211.98.212 = IP of the Client which is running Jabber

[Maren Mahoney]

As you may have guessed, the deal is that the RTP stream (or SRTP in this case) cannot be established. Phone call is made, call rings, user picks up, call drops immediately is a classic symptom of this problem. Why it is happening intermittently is an interesting thing.

This could be media resources, could be certificate/key exchange, could be several things. But I think we'll need to look at log files.

Let's start with a log file from a Jabber client that (preferably) includes a successful call and a failed call. Chances are very good we will need to do additional digging.

Question: You say your remote sites are VPN connected. Is this a site-to-site VPN or a per-device VPN? Also, do you have MRA running via Expressways or only doing VPN?

Maren

[Mahmoud Belhaj]

hello 

this is RTP issue 

is there expressway e in your design if yes please share your logs to see what’s problem 

[Ragnar]

Sorry for the delay. We did some testing and found at that the problem is also occurring onsite (so not just remote site and vpn). I edited the initial post.

We do not have MRA via Expressways. Only VPN.

I attached some logs from RTMT. I will update again with Logs from the Jabber client.

[MrTyClark]

Just a thought- Both failed logs are showing session timer issues. Check the Lua script for SIP Notmalization are correct and that the CUCM SIP timers in Service Parameters are at least the minimums. Do you have SDL for CUCM for the times of calls, may be useful. Also, can you show the SIP configuration on the CUBE? 

[Ragnar · Accepted solution]

We were able to resolve the issue.

CUCM -> System -> Server

Change the hostnames to FQDN -> Regenerate CTL and restart

[sangyong.kim]

How to re-generate CTL and restart?  Can you provide the location?