4351 Phone just getting [RST,ACK] in response to [SYN]

[Chojin]

This is kind of weird. I have a phone that won't register. It gets an ip address and grabs firmware without trouble. I get to the point where it downloads the XMLdefault file. Then I see a series of packets that alternate [SYN] and [RST,ACK]. It's TCP 78. The ports are mostly 6970 and 49627 (rising by 2 with each packet) until it shows 49629 > cisco-sccp [SYN] with a [RST,ACK] in reply.

Put the phone on another router and when it gets to the cisco-sccp [SYN] I get a [SYN,ACK]. I've not seen anything in debug ephone reg or debug sccp all. ACLs aren't showing drops. So I'm trying to figure out why I'm just seeing [RST,ACK]s.

Any suggests on where to check? Thanks!

[Dennis Mink]

where you trying to register this phone on? CME, CUCM, Asterisk?

[Chojin]

Registering on CME running on a 4351. It's a 7962 phone and we're using skinny.

[Sreekanth Narayanan]

Can you please share your show run?
Please check if you have enabled hfs on the CME. The port 6970 is the default hfs port. If it is enabled, try disabling it and the phone should try to get the SEP<mac>.cnf.xml file via TFTP.
You could do a debug ip http all to see if there are debugs on the http layer for the hfs.

[Chojin]

I'll check and see on hfs. The phone's downloading  everything with TFTP so I wouldn't expect to see it doing anything with hfp. But the 6970 port makes me wonder.

[Chojin]

I see port 6970 [SYN] about the time it's requesting the CTLSEP.tlv, ITLSEP.tlv, ITLFile.tlv, SEP.cnf.xml and XMLDefault.cnf.xml. After the requests get RST it rolls over to TFTP and downloads the default file. So I'm pretty sure those are just the HFS. It's disabled on the router and nothing shows up on debug ip http all.

I did notice on the routers that reply to the cisco-sccp [SYN] packets with [SYN,ACK], it shows TCP 82. When it responds with [RST,ACK] it's TCP 78. I'm not sure if this is significant.

I see the same HFS results with phones on working routers, so my concern over that was likely a false positive. Now I just need to figure out what to look at to see why the router is sending back the [RST,ACK] when SCCP starts. DEbug ephone reg shows nothing.

[Sreekanth Narayanan]

Good to know that 6970 is clear now.

Can you please paste the show run, show version, show license all and show license feature?

[Chojin]

I can't post the sho run unfortunately.  I can't get permission. I'll see about the others. Since I see matches in an ACL going to the ip address the phone should register to that traffic seems to be passing. A sho license indicated the cme license was active. But it feels like the cme is not turned on or active since I'm seeing that RST,ACK. Is there a good way to test that with a command in the router? I'm also going to check the config file, though that seems like a long shot.

Thanks.

[Sreekanth Narayanan]

Try a telnet <CME IP> 2000 from your PC. If this fails, the CME is not listening on this port and may not have been configured correctly.

[Chojin]

A sho license shows:  cme-srst EvalRightToUse, Active, In Use. License Count 15/0. There is plenty of time on the Period Left.

Show license features shows cme-srst with a yes under everything but the middle option.

Firmware 16.06.03, Suit License Module has cme-srst and Cube.

Telephony service is pretty basic.

Protocol ipv4

max-ephone 5

max-dn 5

ip source-address X.X.X.X port 2000

auto assign 1 to 5

cnf-file location flash:

load 7962 SCCP.9-4-2SR1-1S.loads

transfer-system full-consult

Not much luck tracking down the RST,ACK so far. The license looks good. Same phones work fine on another router with the same telephony-service.

[Sreekanth Narayanan]

All of that configuration looks good. Can we get the debug ip tcp transaction, debug ephone detail and debug ephone register. You could also enable an access list that only permits the phone IP and use debug ip packet detail <access-list number>

[ananth1991]

Is this issue resolved.l'm facing the same issue.But phones are registering in call manager