call forwarding without setting in CUCM

[thiraponphetklai7501]

could you please help me, i found some call from SIP inbound, call direct to extension 206197 but after 9 second call forwarding to 206136 without setting in CUCM and two number are not using in Hunting group

Message Details

SENDER: 10.20.0.12
GUID: E295204A-F0DB11EA-82E9C2A0-4C6778AB@10.20.0.23
MSG_LABEL: 180 Ringing
RECEIVER: [SIP-TRUE-DC] 10.20.0.23
MAC_ADDRESS: SIP-TRUE-DC
MSGTAG: 1401529978
MSG_TYPE: UCM_CTRACE
CORRELATIONID: 2,100,14,64100644.33827^10.20.13.193^*
TIMESTAMP: 2020/09/08 14:29:37.928

Detailed Sip Message

There is no SIP message to display!
Please verify the following:
1.Check if the "Enable SIP Call Processing Trace" check box in "Unified Serviceability Webpage --> Trace --> Configuration --> CM Services --> Cisco CallManager" is enabled
2.Check if the trace level is set to State Transition, Significant, Arbitrary or Detailed
Message In Log File

2020/09/08 14:29:37.817|SIPT|0|UDP|IN|10.20.0.12|5060|SIP-TRUE-DC|10.20.0.23|54782|2,100,10,1.19902439^10.20.0.23^*|1401529958|E295204A-F0DB11EA-82E9C2A0-4C6778AB@10.20.0.23|INVITE
2020/09/08 14:29:37.818|SIPT|0|UDP|OUT|10.20.0.12|5060|SIP-TRUE-DC|10.20.0.23|5060|2,100,10,1.19902439^10.20.0.23^*|1401529959|E295204A-F0DB11EA-82E9C2A0-4C6778AB@10.20.0.23|100 Trying
2020/09/08 14:29:37.821|CC|SETUP|38186994|38186995|90628295194|206197|206197
2020/09/08 14:29:37.824|CC|OFFERED|38186994|38186995|90628295194|206197|206197|SIP-TRUE-DC|SEPCC9891D1F3AA
2020/09/08 14:29:37.825|SIPL|38186995|TCP|OUT|10.20.0.12|5060|SEPCC9891D1F3AA|10.20.13.193|51733|2,100,10,1.19902439^10.20.0.23^*|1401529960|b4a8c00-f57132e1-1ad281d-c00140a@10.20.0.12|INVITE
2020/09/08 14:29:37.833|SIPL|38186995|TCP|IN|10.20.0.12|5060|SEPCC9891D1F3AA|10.20.13.193|51733|2,100,14,64100644.33826^10.20.13.193^*|1401529966|b4a8c00-f57132e1-1ad281d-c00140a@10.20.0.12|100 Trying
2020/09/08 14:29:37.926|SIPL|38186995|TCP|IN|10.20.0.12|5060|SEPCC9891D1F3AA|10.20.13.193|51733|2,100,14,64100644.33827^10.20.13.193^*|1401529977|b4a8c00-f57132e1-1ad281d-c00140a@10.20.0.12|180 Ringing
2020/09/08 14:29:37.928|SIPT|38186994|UDP|OUT|10.20.0.12|5060|SIP-TRUE-DC|10.20.0.23|5060|2,100,14,64100644.33827^10.20.13.193^*|1401529978|E295204A-F0DB11EA-82E9C2A0-4C6778AB@10.20.0.23|180 Ringing
2020/09/08 14:29:46.063|CC|SETUP|38186994|38187020|90628295194|206197|206136
2020/09/08 14:29:46.069|SIPL|38187020|TCP|OUT|10.20.0.13|5060|SEPCC9891D1CAC6|10.20.13.197|51263|3,100,14,20999950.3297^10.20.0.17^*|197003362|10a7d680-f57132ea-2f05bc-d00140a@10.20.0.13|INVITE
2020/09/08 14:29:46.069|SIPL|38187020|TCP|OUT|10.20.0.13|5060|TCT206136|10.20.0.17|5060|3,100,14,20999950.3297^10.20.0.17^*|197003363|10a7d680-f57132ea-2f05bd-d00140a@10.20.0.13|INVITE
2020/09/08 14:29:46.070|CC|OFFERED|38186994|38187020|90628295194|206197|206136|SIP-TRUE-DC|SEPCC9891D1CAC6
2020/09/08 14:29:46.071|SIPL|38186995|TCP|OUT|10.20.0.12|5060|SEPCC9891D1F3AA|10.20.13.193|51733|3,100,14,20999950.3297^10.20.0.17^*|1401530600|b4a8c00-f57132e1-1ad281d-c00140a@10.20.0.12|CANCEL
2020/09/08 14:29:46.075|SIPL|38186995|TCP|IN|10.20.0.12|5060|SEPCC9891D1F3AA|10.20.13.193|51733|2,100,14,64100644.33828^10.20.13.193^*|1401530601|b4a8c00-f57132e1-1ad281d-c00140a@10.20.0.12|200 OK
2020/09/08 14:29:46.076|CC|RELEASE|38186995|0|0
2020/09/08 14:29:46.077|SIPL|38186995|TCP|IN|10.20.0.12|5060|SEPCC9891D1F3AA|10.20.13.193|51733|2,100,14,64100644.33829^10.20.13.193^*|1401530602|b4a8c00-f57132e1-1ad281d-c00140a@10.20.0.12|487 Request Cancelled
2020/09/08 14:29:46.077|SIPL|38186995|TCP|OUT|10.20.0.12|5060|SEPCC9891D1F3AA|10.20.13.193|51733|2,100,14,64100644.33829^10.20.13.193^*|1401530603|b4a8c00-f57132e1-1ad281d-c00140a@10.20.0.12|ACK
2020/09/08 14:29:46.083|SIPL|38187020|TCP|IN|10.20.0.13|5060|SEPCC9891D1CAC6|10.20.13.197|51263|3,100,14,21233652.657^10.20.13.197^*|197003367|10a7d680-f57132ea-2f05bc-d00140a@10.20.0.13|100 Trying
2020/09/08 14:29:46.181|SIPL|38187020|TCP|IN|10.20.0.13|5060|SEPCC9891D1CAC6|10.20.13.197|51263|3,100,14,21233652.658^10.20.13.197^*|197003371|10a7d680-f57132ea-2f05bc-d00140a@10.20.0.13|180 Ringing
2020/09/08 14:29:46.184|SIPT|38186994|UDP|OUT|10.20.0.12|5060|SIP-TRUE-DC|10.20.0.23|5060|3,100,14,21233652.658^10.20.13.197^*|1401530610|E295204A-F0DB11EA-82E9C2A0-4C6778AB@10.20.0.23|UPDATE
2020/09/08 14:29:46.187|SIPT|38186994|UDP|IN|10.20.0.12|5060|SIP-TRUE-DC|10.20.0.23|54782|2,100,10,1.19902451^10.20.0.23^*|1401530612|E295204A-F0DB11EA-82E9C2A0-4C6778AB@10.20.0.23|200 OK
2020/09/08 14:29:48.255|SIPL|38187020|TCP|IN|10.20.0.13|5060|TCT206136|10.20.0.17|5060|3,100,14,21381534.1693^10.20.0.17^*|197003469|10a7d680-f57132ea-2f05bd-d00140a@10.20.0.13|200 OK
2020/09/08 14:29:48.257|SIPL|38187020|TCP|OUT|10.20.0.13|5060|SEPCC9891D1CAC6|10.20.13.197|51263|3,100,14,21381534.1693^10.20.0.17^*|197003471|10a7d680-f57132ea-2f05bc-d00140a@10.20.0.13|CANCEL
2020/09/08 14:29:48.264|SIPT|38186994|UDP|OUT|10.20.0.12|5060|SIP-TRUE-DC|10.20.0.23|5060|3,100,14,21381534.1693^10.20.0.17^*|1401530756|E295204A-F0DB11EA-82E9C2A0-4C6778AB@10.20.0.23|200 OK
2020/09/08 14:29:48.264|SIPL|38187020|TCP|OUT|10.20.0.13|5060|TCT206136|10.20.0.17|5060|3,100,14,21381534.1693^10.20.0.17^*|197003472|10a7d680-f57132ea-2f05bd-d00140a@10.20.0.13|ACK
2020/09/08 14:29:48.264|SIPL|38187020|TCP|OUT|10.20.0.13|5060|TCT206136|10.20.0.17|5060|3,100,14,21381534.1693^10.20.0.17^*|197003473|10a7d680-f57132ea-2f05bd-d00140a@10.20.0.13|SUBSCRIBE
2020/09/08 14:29:48.267|SIPT|38186994|UDP|IN|10.20.0.12|5060|SIP-TRUE-DC|10.20.0.23|54782|2,100,10,1.19902454^10.20.0.23^*|1401530757|E295204A-F0DB11EA-82E9C2A0-4C6778AB@10.20.0.23|ACK
2020/09/08 14:29:48.290|SIPL|38187020|TCP|IN|10.20.0.13|5060|SEPCC9891D1CAC6|10.20.13.197|51263|3,100,14,21233652.660^10.20.13.197^*|197003475|10a7d680-f57132ea-2f05bc-d00140a@10.20.0.13|200 OK
2020/09/08 14:29:48.292|SIPL|38187020|TCP|IN|10.20.0.13|5060|SEPCC9891D1CAC6|10.20.13.197|51263|3,100,14,21233652.661^10.20.13.197^*|197003476|10a7d680-f57132ea-2f05bc-d00140a@10.20.0.13|487 Request Cancelled
2020/09/08 14:29:48.293|SIPL|38187020|TCP|OUT|10.20.0.13|5060|SEPCC9891D1CAC6|10.20.13.197|51263|3,100,14,21233652.661^10.20.13.197^*|197003477|10a7d680-f57132ea-2f05bc-d00140a@10.20.0.13|ACK
2020/09/08 14:29:48.375|SIPL|38187020|TCP|IN|10.20.0.13|5060|TCT206136|10.20.0.17|5060|3,100,14,21381534.1694^10.20.0.17^*|197003490|10a7d680-f57132ea-2f05bd-d00140a@10.20.0.13|200 OK
2020/09/08 14:29:48.391|SIPL|38187020|TCP|IN|10.20.0.13|5060|TCT206136|10.20.0.17|25693|3,100,14,20999950.3299^10.20.0.17^*|197003494|10a7d680-f57132ea-2f05bd-d00140a@10.20.0.13|NOTIFY
2020/09/08 14:29:48.395|SIPL|38187020|TCP|OUT|10.20.0.13|5060|TCT206136|10.20.0.17|25693|3,100,14,20999950.3299^10.20.0.17^*|197003496|10a7d680-f57132ea-2f05bd-d00140a@10.20.0.13|200 OK
2020/09/08 14:31:15.985|SIPT|38186994|UDP|IN|10.20.0.12|5060|SIP-TRUE-DC|10.20.0.23|54782|2,100,10,1.19902563^10.20.0.23^*|1401537256|E295204A-F0DB11EA-82E9C2A0-4C6778AB@10.20.0.23|BYE
2020/09/08 14:31:15.989|SIPL|38187020|TCP|OUT|10.20.0.13|5060|TCT206136|10.20.0.17|5060|2,100,10,1.19902563^10.20.0.23^*|197009148|10a7d680-f57132ea-2f05bd-d00140a@10.20.0.13|BYE
2020/09/08 14:31:15.989|SIPT|38186994|UDP|OUT|10.20.0.12|5060|SIP-TRUE-DC|10.20.0.23|5060|2,100,10,1.19902563^10.20.0.23^*|1401537257|E295204A-F0DB11EA-82E9C2A0-4C6778AB@10.20.0.23|200 OK
2020/09/08 14:31:15.997|CC|RELEASE|38186994|38187020|16

[TONY SMITH]

You'll need to explain the call flow that you have configured in CUCM, for example when a call comes in from the SIP provider what's the first thing it matches?  Hunt Pilot?  Translation Pattern? DN?

You could have a quick look with Dialed Number Analyser if you're finding your way around the system.  Go to the Publisher IP address but with /dna on the path for example 10.10.10.10/dna   Select Trunks from the Analysis menu, find your SIP trunk and put in your whateven number the SIP trunk presents that should route on to 206197. 

[thiraponphetklai7501]

The number 206197 will match with translation pattern 02783xxxx (02783-6197) replace with last 4 digits 

i found 206197  setting fwd to 206071 but this call alerting to number 206136 at the same time

Please find analyzer results

Results Summary
Calling Party Information
Calling Party = 90628295194
Partition =
Device CSS = CSS_Inbound
Line CSS =
AAR Group Name =
AAR CSS =
Dialed Digits = 027836197
Match Result = RouteThisPattern
Matched Pattern Information
Pattern = 206197
Partition = PT_Internal
Time Schedule =
Called Party Number = 206197
Time Zone = Asia/Bangkok
Call Classification = OnNet
InterDigit Timeout = NO
Device Override = Disabled
Outside Dial Tone = NO
Call Flow
TranslationPattern :Pattern= 02783XXXX
Partition = PT_Translation-Pattern
Positional Match List = 206197
Calling Party Number = 90628295194
PreTransform Calling Party Number = 90628295194
PreTransform Called Party Number = 027836197
Calling Party Transformations
External Phone Number Mask = NO
Calling Party Mask =
Prefix =
CallingLineId Presentation = Default
CallingName Presentation = Default
Calling Party Number = 90628295194
ConnectedParty Transformations
ConnectedLineId Presentation = Default
ConnectedName Presentation = Default
Called Party Transformations
Called Party Mask = 20XXXX
Discard Digits Instruction = None
Prefix =
Called Number = 206197
Directory Number :DN= 206197
Partition = PT_Internal
TypeCFACSSPolicy = Use System Default
Call Classification = Unknown
Forwarding Information
Forward All : DN = VoiceMail = No CSS =
Forward Busy
Internal : DN = 206071 VoiceMail = No CSS = CSS_Internal
External : DN = 206071 VoiceMail = No CSS = CSS_Internal
Forward No Answer
Internal : DN = 206071 VoiceMail = No CSS = CSS_Internal
External : DN = 206071 VoiceMail = No CSS = CSS_Internal
Forward No Coverage
Internal : DN = VoiceMail = No CSS =
External : DN = VoiceMail = No CSS =
Forward Unregistered
Internal : DN = 206071 VoiceMail = No CSS = CSS_Internal
External : DN = 206071 VoiceMail = No CSS = CSS_Internal
CFDF : DN = VoiceMail = No CSS =
Pickup Group Number = 60001012
Device :Type= Cisco Dual Mode for iPhone
Device Status = UnKnown
Device Name = TCT206197
Ignore Presentation Indicators = Disabled
Logged Into Hunt Groups = Enabled
Alerting Name = Phatcharee C. 206197
Dual Mode = Enabled
Do Not Disturb(DND)
DND Status = Disabled
DND Option = Call Reject
DND Incoming Call Alert = Disable
Automated Alternate Routing (AAR)
AAR Group Name =
AAR Calling Search Space =
AAR VoiceMail Status = Disabled
AAR Destination Mask =
AAR Prefix Digits =
Device :Type= Cisco Dual Mode for Android
Device Status = UnKnown
Device Name = BOT206197
Ignore Presentation Indicators = Disabled
Logged Into Hunt Groups = Enabled
Alerting Name = Phatcharee C. 206197
Dual Mode = Enabled
Do Not Disturb(DND)
DND Status = Disabled
DND Option = Call Reject
DND Incoming Call Alert = Disable
Automated Alternate Routing (AAR)
AAR Group Name =
AAR Calling Search Space =
AAR VoiceMail Status = Disabled
AAR Destination Mask =
AAR Prefix Digits =
Device :Type= Cisco 8841
Device Status = Registered
Device Name = SEPCC9891D1F3AA
Ignore Presentation Indicators = Disabled
Logged Into Hunt Groups = Enabled
Alerting Name = 206197
Dual Mode = Disabled
Do Not Disturb(DND)
DND Status = Disabled
DND Option =
DND Incoming Call Alert =
Automated Alternate Routing (AAR)
AAR Group Name =
AAR Calling Search Space =
AAR VoiceMail Status = Disabled
AAR Destination Mask =
AAR Prefix Digits =
Alternate Matches
Note: Information Not Available

[TONY SMITH · Accepted solution]

Do you have a pickup group configured?   

If I'm reading your post correctly you have this particular DN presented on several devices as a shared line.  Do those devices ring?  You say the call rings on 206136 "at the same time" so that suggests either Pickup Group or Mobility is configured.

[thiraponphetklai7501]

Thanks for your help Tony , I have configured visual alert on call pickup function so this call alert to two number at the same time.