CIPC on VPN experience no-way audio ** RESOLVED**

[fei he]

Hi All

We have users are remote based workers and they are on VPN.

user1 - DN 3575 (remote VPN)

user2 - DN 3574 (remote VPN)

user3 - DN 3576 (HQ office)

The issue is 2 remote users dial 4 digit DN to each, both party experience no-way audio once. But it works fine when they dial user in HQ office (non VPN user).

The ccm trace logs seems to be fine. I could not see codec miss match issue, nor obvious error why it failed. Any idea?

Fei

[Manish Gogna]

A detailed callmanager trace is needed to check the codec / ip address / port numbers for working and non working calls.

Manish

[fei he]

Hi Manish

What i don't understand how come no-audio path only occurs when dial full number as is the call flow are exactly the same either dial internal DN or full number. All region, MRGL and IP should be same. When i said full number, it's been translate into internal DN range. 

Regards

Fei

[Manish Gogna]

Hi Fei,

Please make sure that you are using a CIPC version 8.6.X because of the following bug

https://tools.cisco.com/bugsearch/bug/CSCsv63788

Symptom:
Cannot place International phone calls prefix with a plus sign (+).

Conditions:
Numbers written with a plus sign (+) before the phone number.

Workaround:
None. Not yet supported.


Further Problem Description:
This is being considered for upcoming 8.6 release

HTH

Manish

[fei he]

Hi Manish

This is not a issue on outbound external call. Issue happens when 2 users dial each other with full mask rather than internal DN. I don't think your bug apply to this case.

Regards

Fei

[Manish Gogna]

Can you provide the cipc version details ?

If you check the bug details closely it says 'Numbers written with a plus sign (+) before the phone number' , it is not just for international calls.

HTH

Manish

[fei he]

Hi Manish

We do not use + sign.

Cheers

[Brian Meade]

I'm guessing the issue is 2 VPN clients not being able to communicate to each other directly.  Can the 2 VPN clients ping each other with the VPN addresses?  What are you using for VPN?  You could probably use a Trusted Relay Point or an MTP if you don't want to allow VPN clients to be able to communicate directly.

[fei he]

Hi Brian

2 VPN clients cannot ping each other. Is this a routing issue or VPN block IP packet?

Regards

Fei

[Brian Meade]

Are you using ASA?  Which version?

Might just need to add "same-security-traffic permit intra-interface" to the config.

[fei he]

Hi Brian

Just OS, Win 7 but using pre-shared secret. VPN server is ISA 2006.

Regards

Fei

[fei he]

Hi Brian

Issue is resolved now. We are ending up that open UDP high ports and allowed ping on ISA/VPN server.

Thanks for your helpful comments.

Fei

[James Hawkins · Accepted solution]

It is something to do with the setup of your VPN.

Most VPN solutions do not by default allow VPN users to communicate with each other.

The solution I normally use is the Trusted Relay Point option mentioned by Brian. This is simple and works well for most cases.