Call VoIP phone to mobile phone issue

[DariuszD]

Hello

I am trying to find information about the audio stream that is sent between callers making calls:

Scenario 1: A user calls from one Voip phone in the office to another Voip phone in the office: Audio communication (the user's call goes over the RTP protocol ). Everything works fine
Scenario 2: User calls from an office Voip phone to a mobile phone number. He dials "0" on the Voip phone and then enters the correct mobile phone number of the person he is calling. The problem is that the person answering on the mobile phone cannot hear what the person on the VoIP phone is saying to him, which has been tested on various VoIP phones and various mobile phones.

In my network access infrastructure, I control a Cisco ISE and there I have the following dACL for the Voice vlan:

permit ip any host y.y.y.y # CCM_IP_1
permit ip any host x.x.x.x # CCM_IP_2
permit udp any (VoIP phone IP) range 16384 32767 //RTP protocol
permit udp any (VoIP phone IP) range 16384 32767 //RTP protocol
deny ip any any

Does the audio streaming for the Voip connection to the mobile phone use other ports than the RTP protocol, if so which ones.

Regards

[Roger Kallberg]

To make a call to anything external to you the call have to go via a gateway. The audio path will be from the internal phone to the gateway for the internal call leg and then from there via the public telephone network for the external call path. One way audio is for the most caused by network traffic not reaching between the two parts of the call leg.

[DariuszD]

Thank you very much for your reply,
On the switch port to which the Voip phone is connected I have added an ACL:

I have added acl on IN : ip access-group ACL-PREAUTH in

ip access extend ACL-PREAUTH
10 permit udp any eq bootpc any eq bootps
20 permit udp any any eq domain
30 permit tcp any host x.x.x.x eq www  # ISE_1 IP
40 permit tcp any host y.y.y.y eq www  # ISE_2 IP
50 permit tcp any host x.x.x.x eq 8443 # ISE_1 IP
60 permit tcp any host y.y.y.y eq 8443 # ISE_2 IP
70 permit tcp any host x.x.x.x eq 443 # ISE_1 IP
80 permit tcp any host y.y.y.y eq 443 # ISE_2 IP
110 deny icmp any any echo
120 deny tcp any any range 22 telnet
130 deny icmp any any echo-reply
140 deny ip any any

All problems disappear when I remove the following from the configuration of the switch port to which the Voip phone is connected: ip access-group ACL-PREAUTH in

Do you have any idea why the specified ACL might cause an audio problem for a Voip -> mobilephone connection?

[Roger Kallberg]

AFAIKT the ACL does not allow any traffic that pertains to calls or for that matter communication with CM. In your first post you mentioned an ACL that would I assume be assigned by ICE if some specific condition is met. I don’t know how ICE operates well enough to know give advice on that. That sort of question might be better asked in the Security part of the community. If my assumption is correct have you verified that the ACL is changed out to the one you mentioned in your first post on the switch port facing the phone?

[DariuszD]

Thank you very much for your reply.

As you wrote the Cisco ISE system after the device is authenticated on the network overwrites the ACL the connected device then gets a dACL below :

permit ip any host y.y.y.y # CCM_IP_1
permit ip any host x.x.x.x # CCM_IP_2
permit udp any (VoIP phone IP) range 16384 32767 //RTP protocol
permit udp any (VoIP phone IP) range 16384 32767 //RTP protocol
deny ip any any

That is, communication to my Callmanager and RTP ports are allowed. This works fine, before adding entries for RTP to this dACL I had an identical Audio problem but with connections between Voip phones as the current problem with Voip connection to mobile phone adding entries :

permit udp any (VoIP phone IP) range 16384 32767 //RTP protocol
permit udp any (VoIP phone IP) range 16384 32767 //RTP protocol

fixed audio problem for Voip to Voip connection

Currently I have the same problem, but with VoIP connection to Mobile Phone, I thought the problem is that for connection to Mobile phone it is necessary to add some more permit lines for some ports to dACL.

[Roger Kallberg · Accepted solution]

Thanks for the clarification. You’d need to add RTP ports to/from the voice gateway(s) to/from the phones in the ACL.

[DariuszD]

Thank you very much for your help Roger. Now everything works fine  

[Ibrahim AlQumairi]

To add some of clarification for the RTP traffic bath:

Internal calls: Phone A > Phone B

Mobile Calls: Phone A > Voice Gateway > ISP Gateway

So Upon that you need to open RTP ports all over the voice call bath as shown up