Interesting concept, RTP

ahochau_2 · ‎09-23-2015

I have a need to allow remote SIP devices access to the enterprise Communications Manger. The thought was to have the devices register to CME in a DMZ and then do a SIP trunk from CME to the CUCM cluster.

Rules of engagement:

1) Remote devices will be on consumer class internet connections

2) No remote VPN devices allowed

3) Must be secure

4) buying traversal licenses for the VCS is not in the budget

I have put the CME in a DMZ and configured 1 to 1 NAT. ACLs have allowed traffic to and from CUCM and CME. If I put my client directly on the internet I can register and make calls anywhere in the world I would like. If I put the client behind NAT, the client can register but is not able to make calls. If I put the client behind a firewall I am not able to register with CME at all. Any suggestions on how to achieve the goal?

Dennis Mink · ‎09-23-2015

Interesting concept, RTP across Internet and behind a number of firewalls, typically a recipe for disaster. So you have multiple issues. Let me start with your client "behind NAT" I think the problem with voice being establish is the negotiation of the RTP end point IP address. are these phones using SIP to register on CME? can you add some debug info to the post (debug ccsip)

also, did you configure sip inspect on your firewall? (or something similar if it is not Cisco ASA)?

thanks

Please remember to rate useful posts, by clicking on the stars below.

ahochau_2 · ‎09-23-2015

Well, I made some progress. Since I am using +E.164 to call the world, at one point in testing I had set the "put this on beginning of dial string" option. Once I removed that I was able to get one client with a public IP registered and a second client with a private IP to register. I also had fits with my firewall, I was able to get those resolved by changing my ACLs (implicit deny any any at the bottom got me again). Since I have a cisco firewall my options were many. So everything in the diagram attached above is working as I want it too relating to call flow and capabilities. Yay!

Yes, the is only SIP, I'll see what I can do to add some of the debugs, will have to scrub heavily.

New problems to overcome:

1) It appears I can only have one device behind the firewall. Will need to keep playing with this one, may not be a show stopper.

2) If I move either of the devices outside of my firewall where my ISP just does nat, I have no audio.

My concern at this point is if I can make it work with whatever device "Bob's Bait and Internet" is providing to end users. I'm afraid of providers using NAT somewhere downstream from the device.

Terry Cheema · ‎09-23-2015

There are two other options you can explore depending on if the end points are Cisco:

1) Cisco Phone VPN - Using ASA anyconnect

2) CUBE - Remote Phone Proxy session

Ref: http://www.cisco.com/c/en/us/products/collateral/unified-communications/unified-border-element/data-sheet-c78-729692.html

Also Refer here: http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab10/collab10/mobilapp.html#pgfId-1539123

-Terry

Please rate all helpful posts

ahochau_2 · ‎09-23-2015

Neither the firewall nor the endpoints are Cisco. We looked at doing the CUBE proxy and all the configuration examples we saw said "do not use this for production" May have been for an earlier release and worth taking a second look at.

Everything I am seeing now lists Cisco phones as being supported. Do you know if the CUBE Phone Proxy works with third party SIP devices?

Thanks!

Terry Cheema · ‎09-23-2015

As I have referenced above - Though it says SIP based end points - I think it should, since the phone registers to CUCM and for non-cisco SIP phones you should be register as third party SIP phone in CUCM - but not 100% if it will support non-Cisco phones, may need to reach out to Cisco to confirm.

Refer here for config guide:

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube_interop/configuration/15-mt/cube-interop-15-mt-book/voi-cucm-lineside.html#task_C9A25BECD9894E92B62F5D1EE0E2C868

https://ciscocollab.wordpress.com/2014/04/08/cube-sip-lineside-phone-vpn-configuration/

Also refer here for a similar thread:

Ref: http://www.gossamer-threads.com/lists/cisco/voip/182839

-Terry

Please rate all helpful posts

ahochau_2 · ‎09-24-2015

Right now only have a 2800 to work with, so working on getting a 2900 or better so we can deploy a version of IOS that supports the feature for testing. The document states

For an IP phone to register on a CUCM through CUBE, CUBE must be configured to do the following requirements.

TCP must be used for registration.
The MAC address of the device (device ID) and the device name, present in the CONTACT header of the REGISTER message, need to be copied to the outgoing messages and passed to the CUCM intact.

So I am not having warm and fuzzy feelings about non-Cisco devices since the third party devices use the sip digest user and not the mac address for registration. Anyway, step one is get a hold of a device capable of running the required software. Thanks for the suggestion!

ahochau_2 · ‎09-23-2015

Doh!

Other issue is caller ID only showing the DN. Purely cosmetic, but people will be upset.

Need to get it to 15.1 as well.

version 12.4
!
hostname dmz-sbc
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 1024000
no logging console
no logging monitor
enable secret <Removed>
enable password <Removed>
!
clock timezone PST -8
clock summer-time PDT recurring

ip domain name mycompany.net
no ipv6 cef
!
multilink bundle-name authenticated
!
voice service voip
allow-connections sip to sip
redirect ip2ip
fax protocol t38 ls-redundancy 0 hs-redundancy 0 fallback cisco
sip
bind control source-interface GigabitEthernet0/0
bind media source-interface GigabitEthernet0/0
session transport tcp
registrar server expires max 1200 min 300
no update-callerid
g729 annexb-all
!
voice class codec 100
codec preference 1 g722-64
codec preference 2 g711ulaw
codec preference 3 g729r8
!
voice register global
mode cme
source-address 10.10.10.19 port 5060
timeouts interdigit 5
max-dn 200
max-pool 100
authenticate register
authenticate realm mycompany.net
date-format D/M/Y
mwi stutter
voicemail 8000
tftp-path flash:
create profile sync 000394280920404A
!
voice register dn 1
number 1233
call-forward b2bua busy 8000
call-forward b2bua mailbox 1233
call-forward b2bua noan 8000 timeout 20
allow watch
name Tommy Tester
label +19193921233
mwi
!
voice register dn 2
number 1234
call-forward b2bua busy 8000
call-forward b2bua mailbox 1234
call-forward b2bua noan 8000 timeout 20
allow watch
name Sally Sample
label +19193921234
mwi
!
voice register pool 1
busy-trigger-per-button 2
id mac 1919.0392.1233
session-transport tcp
number 1 dn 1
presence call-list
dtmf-relay rtp-nte
voice-class codec 100
username 1233 password 12345
description Tommy_Tester_1233
no vad
!
voice register pool 2
busy-trigger-per-button 2
id mac 1919.0392.1234
session-transport tcp
number 1 dn 2
presence call-list
dtmf-relay rtp-nte
voice-class codec 100
username 133830 password 12345
description Sally_Sample_133830
no vad
!
voice-card 0
dsp services dspfarm
!
voice-card 1
dsp services dspfarm
!
username <Removed> privilege 15 password <Removed>
archive
log config
hidekeys
!
ip ssh version 2
!
class-map match-any VoIP-Control
match ip dscp cs3
match ip dscp af31
class-map match-any VoIP-RTP
match ip dscp ef
!
policy-map VoIP-QOS
class VoIP-RTP
priority percent 70
set ip dscp ef
class VoIP-Control
bandwidth percent 5
set ip dscp cs3
class class-default
fair-queue
set ip dscp default
!
interface GigabitEthernet0/0
description ** Connection to DMZ **
ip address 10.10.10.19 255.255.255.0
duplex auto
speed auto
no mop enabled
service-policy output VoIP-QOS
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 10.10.10.1
no ip http server
no ip http secure-server
!
control-plane
!
sccp local GigabitEthernet0/0
sccp ccm 10.10.10.19 identifier 1 priority 1 version 7.0
sccp
!
sccp ccm group 1
bind interface GigabitEthernet0/0
associate ccm 1 priority 1
associate profile 1 register DMZ-xCode
associate profile 2 register DMZ-Conf
!
dspfarm profile 1 transcode
codec g711ulaw
codec g711alaw
codec g729ar8
maximum sessions 24
associate application SCCP
!
dspfarm profile 2 conference
codec g711ulaw
codec g711alaw
codec g729ar8
codec g729r8
maximum sessions 8
associate application SCCP
!
dial-peer voice 9101 voip
description ** PSTN thru CCM1 **
preference 1
destination-pattern +T
voice-class codec 100
session protocol sipv2
session target ipv4:10.1.1.11
dtmf-relay sip-kpml rtp-nte
no vad
!
dial-peer voice 9102 voip
description ** PSTN thru CCM2 **
preference 2
destination-pattern +T
voice-class codec 100
session protocol sipv2
session target ipv4:10.1.1.12
dtmf-relay sip-kpml rtp-nte
no vad
!
dial-peer voice 9103 voip
description ** PSTN thru CCM3 **
preference 3
destination-pattern +T
voice-class codec 100
session protocol sipv2
session target ipv4:10.2.1.11
dtmf-relay sip-kpml rtp-nte
no vad
!
dial-peer voice 10001 voip
description ** OnNet to CCM1 **
preference 1
destination-pattern [1-8]...$
voice-class codec 100
session protocol sipv2
session target ipv4:10.1.1.11
incoming called-number 1[2-5]..$
dtmf-relay sip-kpml rtp-nte
no vad
!
dial-peer voice 10002 voip
description ** OnNet to CCM2 **
preference 2
destination-pattern [1-8]...$
voice-class codec 100
session protocol sipv2
session target ipv4:10.1.1.12
dtmf-relay sip-kpml rtp-nte
no vad
!
dial-peer voice 10003 voip
description ** OnNet to CCM3 **
preference 3
destination-pattern [1-8]...$
voice-class codec 100
session protocol sipv2
session target ipv4:10.2.1.11
incoming called-number 1[2-5]..$
dtmf-relay sip-kpml rtp-nte
no vad
!
presence
presence call-list
allow subscribe
!
sip-ua
retry invite 2
timers trying 200
timers connect 200
mwi-server ipv4:10.1.1.21 expires 3600 port 5060 transport udp unsolicited
presence enable
!
telephony-service
sdspfarm units 2
sdspfarm tag 1 DMZ-xCode
sdspfarm tag 2 DMZ-Conf
conference hardware
max-ephones 10
max-dn 20
ip source-address 10.10.10.19 port 2000
time-zone 5
voicemail 800000
max-conferences 8 gain -6
transfer-system full-consult dss
transfer-pattern 9T
create cnf-files version-stamp Jan 01 2002 00:00:00
!
banner motd ^C

**************************** NOTICE TO USERS *******************************
* *
* This is an official computer system and is for authorized users only. *
* Unauthorized use is prohibited. Use (Authorized or Unauthorized) may *
* be subject to one or more of the following actions: *
* *
* 1. Interception *
* 2. Monitoring *
* 3. Recording *
* 4. Auditing *
* 5. Inspection *
* 6. Report to security and/or law enforcement agencies both *
* domestic and foreign. *
* *
* By using this system, the user consents to these actions. Unauthorized *
* or improper use of this system may result in administrative disciplinary *
* action as well as civil and criminal penalties. *
* By accessing this system you indicate your awareness of and conset to *
* these terms and conditions of use. Discontinue access immediately if *
* you do not agree to the conditions stated in this notice. *
* *
****************************************************************************

^C
!
line con 0
line aux 0
line vty 0 4
password <Removed>
transport input ssh
!
scheduler allocate 20000 1000
ntp server 71.19.145.222
end

CME Over the Internet