I've got an ASA 5505 running 8.2 configured for solely as an IP phone proxy, it is the default gateway for the cucm box and PRI router, its inside interface is directly attached to the same subnet as all internal phones as well.
Calls can be placed from either end, but after call is established, proxy phones does not hear audio from internal or pstn phones. The proxy phone registers with cucm with the remote internal IP of the phone that obviously cannot be reached by corp network.
Debugging from pri router shows the rtp traffic destination is the internal ip address of the proxy phone 192.168.0.50, why is the phone registering with its internal IP 192.168.0.50 rather than its Natted external IP 184.108.40.206 that can be reachable by cucm and other phones?
Proxy phone is a 7945, after it registers, I do not see it under sh phone-proxy secure-phones, or sh phone-proxy signaling-sessions while on a call.
ASA Proxy config
switchport access vlan 2
ip address 10.10.33.25 255.255.255.0
ip address 65.x.x.24 255.255.254.0
boot system disk0:/asa823-k8.bin
ftp mode passive
dns server-group DefaultDNS
same-security-traffic permit intra-interface
access-list inside_access_in extended permit ip host 10.10.33.10 any
access-list inside_access_in extended permit ip any host 10.10.33.10
access-list inside_access_in extended permit ip host 10.10.33.5 any
access-list inside_access_in extended permit ip any any
access-list outside_access_in extended permit udp any host 65.x.x.25 eq tftp
access-list outside_access_in extended permit udp any host 65.x.x.25
access-list outside_access_in extended permit icmp any interface outside
access-list outside_access_in extended permit ip any host 65.x.x.25
access-list outside_access_in extended permit ip any host 10.10.33.5
access-list inside_nat0_outbound extended permit ip host 10.10.33.10 10.10.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip host 10.10.33.10 204.x.x.0 255.255.254.0
access-list inside_nat0_outbound extended permit ip host 10.10.33.5 10.10.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip host 10.10.33.5 204.x.x.0 255.255.254.0
pager lines 24
logging console informational
logging buffered notifications
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-634-53.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 10.10.33.0 255.255.255.0
static (inside,outside) 65.x.x.25 10.10.33.10 netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 65.x.x.240 1
route inside 10.0.0.0 255.0.0.0 10.10.33.1 1
route inside 204.x.x.0 255.255.254.0 10.10.33.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
aaa authentication ssh console LOCAL
http server enable
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto ca trustpoint phoneproxy_trustpoint
crypto ca trustpoint capf_trustpoint
crypto ca trustpoint CAP-RTP-001
crypto ca trustpoint CAP-RTP-002
crypto ca trustpoint Cisco_Manufacturing_CA_Trustpoint
crypto ca trustpoint CAP-RTP-001_trustpoint
crypto ca trustpoint CAP-RTP-002_trustpoint
crypto ca trustpoint _internal_ctl_phoneproxy_file_SAST_0
subject-name cn="_internal_ctl_phoneproxy_file_SAST_0";ou="STG";o="Cisco Inc"
crypto ca trustpoint _internal_ctl_phoneproxy_file_SAST_1
subject-name cn="_internal_ctl_phoneproxy_file_SAST_1";ou="STG";o="Cisco Inc"
crypto ca trustpoint _internal_PP_ctl_phoneproxy_file
subject-name cn="_internal_PP_ctl_phoneproxy_file";ou="STG";o="Cisco Inc"
crypto ca trustpoint cucm_tftp_server_tp
crypto ca trustpoint _internal_asactl_SAST_0
subject-name cn="_internal_asactl_SAST_0";ou="STG";o="Cisco Inc"
crypto ca trustpoint _internal_asactl_SAST_1
subject-name cn="_internal_asactl_SAST_1";ou="STG";o="Cisco Inc"
crypto ca trustpoint _internal_PP_asactl
subject-name cn="_internal_PP_asactl";ou="STG";o="Cisco Inc"
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 10
ssh version 2
console timeout 0
server trust-point _internal_PP_asactl
record-entry cucm-tftp trustpoint cucm_tftp_server_tp address 65.x.x.25
address 10.10.33.26 interface inside
address 65.x.x.26 interface outside
tftp-server address 10.10.33.10 interface inside
cipc security-mode authenticated
no disable service-settings
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username admin password xxxxxxxxxx encrypted
match port tcp eq 2334
match port tcp eq 5061
policy-map type inspect dns preset_dns_map
message-length maximum 512
inspect sip phone-proxy asdm_phone_proxy
inspect skinny phone-proxy asdm_phone_proxy
inspect dns preset_dns_map
inspect h323 h225
inspect h323 ras
service-policy global_policy global
service-policy pp interface outside
prompt hostname context
the proxy phone public IP is not blocked and can ping the ASA's outside interface, the Watchguard Firebox that is in front of the ASA is set to allow any any to the ASA IP, termination IP and NATted IP for TFTP.
I think I had an issue similar to this when my ASA wasn't the default route to the internet from the LAN. I had to do some reverse NATing to get packets from the internal phones to go back out through the ASA.
I thought the same thing, the PRI router's default route is to the ASA, and we have the same issue when calling external numbers.
I've had intermittent one-way voice before on Phone Proxy. If you are 'always' getting one-way voice then you need to look at your firewalls and routing as other folks in this post have suggested.
For intermittent one-way voice on Phone Proxy, the one work around I found is to destroy/re-establish the RTP stream. The easiest way to do this is to place the call on hold and then pick it back up. Doing that should force the RTP stream to re-establish and two-way voice should be available.
It occured to me on some early versions of 8.2. You're config shows you are running 8.2(3) so be try running latest 8.2 code which was 8.2(5) as of this post. That might just solve your issue.
Thanks Steve, is it expected though to see the internal IP address of the proxy phone registering with cm? I can't picture how phones can communicate with a proxy phone if its IP is not natted, thus making it unreachable.
I moved this thread into the Firewalling space, since most of the phone-proxy related issues are raised here.
If you haven't already, please check out this document on troubleshooting and common issues with phone proxy:
You already have per-interface MTA configured, so packet captures taken at the time you bring up a call would help determine if the voice traffic is reaching the ASA or not...we've seen bad routes or devices in the path blocking media traffic before it can reach the MTA interfaces of the ASA.
Packet captures on ASA:
Ok, did a packet capture on the ASA and saw what I expected, internal phone sends packets to real private IP of proxy phone.
134: 10:20:05.889129 802.1Q vlan#1 P0 10.10.33.17.31540 > 192.168.1.26.27782: udp 172
135: 10:20:05.889144 802.1Q vlan#2 P0 65.x.x.24.36960 > 192.168.1.26.27782: udp 172
136: 10:20:05.890609 802.1Q vlan#2 P0 68.x.x.115.27782 > 65.x.x.24.36960: udp 172
137: 10:20:05.890624 802.1Q vlan#1 P0 68.x.x.115.27782 > 10.10.33.17.31540: udp 172
138: 10:20:05.908949 802.1Q vlan#2 P0 68.x.x.115.27782 > 220.127.116.11.36960: udp 172
139: 10:20:05.908964 802.1Q vlan#1 P0 68.x.x.115.27782 > 10.10.33.17.31540: udp 172
140: 10:20:05.910170 802.1Q vlan#1 P0 10.10.33.17.31540 > 192.168.1.26.27782: udp 172
141: 10:20:05.910170 802.1Q vlan#2 P0 65.x.x.24.36960 > 192.168.1.26.27782: udp 172
142: 10:20:05.931180 802.1Q vlan#1 P0 10.10.33.17.31540 > 192.168.1.26.27782: udp 172
Perhaps the phone is not completely registered via phone proxy? It may be registered directly to the CUCM. What do you get when you run 'show phone-proxy secure-phones'? Also, what version are you running exactly? Did you upgrade to 8.2.5?
I know you said you think there weren't any NAT/Routing issues since the ASA is the default gateway. You may want to add this config just in case. It will NAT inbound traffic to the IP of the ASA so traffic will be forced to return through the ASA.
PhoneProxyASA(config)# nat (outside) 55 0 0 outside
PhoneProxyASA(config)# global (inside) 55 interface
Also, have you tried reloading the ASA? And have you deleted the CTL file on the phone-proxy phone(s) after making changes to the ASA? How many Call Managers are in your cluster?