Showing results for 
Search instead for 
Did you mean: 

How to resolve the one-way audio issue when Cisco CallManager Express is used with remote IP phones without an encrypted GRE tunnel


Core Issue

The Cisco CallManager Express remote phone solution extends IP voice services out to teleworkers that use    CallManager Express over an Internet Protocol Security (IPSec) Virtual Private Network (VPN). This solution provides a cost-effective starter kit for a voice- and data-enabled teleworker solution. However, some restrictions apply to the remote Skinny Client Control Protocol (SCCP) across WAN links (for example, IPSec VPN). One such restriction is that generic routing encapsulation (GRE) over IPSec is required for remote teleworker sites. If GRE is not used, calls from remote phones to the Public Switched Telephone Network (PSTN) or Cisco Unity Express receive one-way audio.

If you have the IP phone (ephone) attached to Cisco CallManager Express over IPSec, and the remote router or VPN client is attached through a GRE/IPsec tunnel, the ephone routes through the tunnel. In this scenario, the GRE interface passes through encryption properly.


Without the GRE tunnel, the ephone is able to transmit Real-Time Protocol (RTP) packets over the dial-peer. Traffic that comes from the dial-peer towards the ephone is not encrypted. As a result, the downstream router discards the clear RTP packets, and the remote IP phone gets one-way audio.

This problem is most commonly seen when encrypted ephones and a Cisco Unity Express module are used together.


There are different ways to display the RTP packets sent and received by the ephone. You can determine whether the ephone can receive RTP packets from Cisco CallManager Express in these ways:

  • Issue the show ephone command on Cisco CallManager Express.

  • Browse the ephone ip address in order to check the call stream statistics.

  • Press the help (i or ?) button twice in quick succession during an active call in order to show the call statistics on the screen. 

Normally, GRE over IPSec is the recommended solution for this one-way voice issue. If the remote VPN client cannot support the GRE tunnel, as is the case with VPN 3002 client software, you can still use policy routing to achieve two-way audio.

You can use Policy-based Routing (PBR) in order to force the ephone traffic through the encryptor. In order to do this, apply a static route to the remote ephone pointing at a loopback interface. Then use PBR on the loopback in order to set the next hop downstream of the crypto map.

This is a sample configuration:

  crypto isakmp policy 1
  encr 3des
  authentication pre-share
  group 2
  crypto isakmp client configuration group RemoteUsers
  key emmanuel
  crypto isakmp client configuration group cisco

  key cisco
  crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

  crypto dynamic-map SDM_DYNMAP_1 1
  set transform-set ESP-3DES-SHA
  crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1
  crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1
  crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1
  !--- Create the loopback interface and apply the policy
  interface Loopback10
  ip address
  ip policy route-map 10
  interface GigabitEthernet0/0
  ip address
  duplex auto
  speed 100
  crypto map SDM_CMAP_1
  interface Service-Engine0/1
  ip unnumbered GigabitEthernet0/0
  service-module ip address
  service-module ip default-gateway
  interface GigabitEthernet0/1
  ip address
  duplex auto
  speed auto
  no keepalive
  ip classless
  ip route
  !---  Route the ephone traffic to the loopback interface. 
  ip route loopback10
  ip route Service-Engine0/1
  ip http server
  no ip http secure-server
  ip http path flash:
  !--- Define the access-list to match the traffic to ephone.
  access-list 101 permit ip any host
  !--- Configure the route-map for the policy routing and
  issue the set ip next-hop or set interface command in the route-map
  in order to force the ephone traffic to go through the encryptor.

  route-map 10 permit 10
  match ip address 101
  set ip next-hop

You can use these commands for verification and troubleshooting:

  • show call active voice brief. This shows the active call legs. 

  • show route-map. This is used in order to verify the route-map operations.        

  • show ip policy. This is used in order to verify the policy route operation. 

Recognize Your Peers
Content for Community-Ad