CUBE to SIP provider problems

[Marko Rodic]

Hello...

I'm having trouble establishing SIP connection between SIP provider and my CUBE.

We are running CUCM 9, and everything was fine while we had only one location. Now, we have 2 locations with PUB on one and SUB on another, and 2 CUBEs, one on both sites.... The first one is doing all right, handling calls from both sites via SIP, and so on... Second one however, have problems establishing SIP connectivity. At least thats what I'm getting from debug ccsip...

We have received these information from SIP provider:

your IP: a.b.c.d (public IP)

our signaling IP: x.x.x.x, our media IP: y.y.y.y (both public IPs)

your DDI: 01234567890

codecs:  g711alaw, g711ulaw

Now, our first SIP provider(and actually all the SIP I have installed so far) had user/pass/realm delivered to us, and i was creating sip-ua, and register through it. Also, he used one server for everything, so I had no problems with that too. Here, I've tried establishing call without registration and trying to figure out which server does what... and looks like I'm failing :(

My initial idea was:

voice class sip-profiles 1
 request INVITE sip-header From modify "@a.a.a.a" "@x.x.x.x"
 request ACK sdp-header Audio-Attribute modify "recvonly" "sendrecv"
 response 200 sdp-header Audio-Attribute modify "recvonly" "sendrecv"
 request REINVITE sdp-header Audio-Attribute modify "inactive" "sendrecv"

where a.a.a.a is private IP address of CUBE, x.x.x.x is IP address of signaling server...

dial-peer voice 10 voip
 description FROM SIP to CUBE
 session protocol sipv2
 session target ipv4:y.y.y.y
 incoming called-number 01234567890
 voice-class codec 1 offer-all
 voice-class sip profiles 1
 dtmf-relay rtp-nte sip-notify
 no vad

etc, etc.... basically, I used media server IP as session target.

so, this haven't worked... i then tried using media in both dial peers and sip profile, signaling in both dial peers and sip profile, media in sip profile and signaling in dial peers... nothing is working. and debug says this:

Sent:
INVITE sip:00000000000@y.y.y.y:5060 SIP/2.0

Via: SIP/2.0/UDP a.a.a.a:5060;branch=z9hG4bK81130

Remote-Party-ID: "On-call" <sip:01234567890@a.a.a.a>;party=calling;screen=yes;privacy=off

From: "On-call" <sip:01234567890@y.y.y.y>;tag=3A07028C-21C4

To: <sip:00000000000@y.y.y.y>

Date: Sat, 06 Dec 2014 18:18:59 GMT

Call-ID: 2A25AAA3-7CAB11E4-803581AA-1EBB68C2@10.28.2.13

Supported: 100rel,timer,resource-priority,replaces,sdp-anat

Min-SE:  1800

Cisco-Guid: 0016643666-2336764232-0151027201-0169543145

User-Agent: Cisco-SIPGateway/IOS-15.3.3.M3

Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER

CSeq: 101 INVITE

Max-Forwards: 70

Timestamp: 1417889939

Contact: <sip:01234567890@a.a.a.a:5060>

Call-Info: <sip:a.a.a.a:5060>;method="NOTIFY;Event=telephone-event;Duration=2000"

Expires: 180

Allow-Events: telephone-event

Content-Type: application/sdp

Content-Disposition: session;handling=required

Content-Length: 241

and same message keeps going over and over and over... eventually it goes to state dead, and this is the error i receive:

Dec  6 18:19:12.763: //33/80C9F4170800/SIP/Call/sipSPICallInfo:
Disconnect Cause (CC)    : 16
Disconnect Cause (SIP)   : 200

Could anybody help me in any way? Where to put signaling IP, where to put media IP?

oh, and this is how topology looks:

phone--- skinny--- CUCM ---- h323 ----- CUBE ---- SIP ----- ASA ----- SIP ----- Provider i guess

CUBE has private IP, and IP they gave me as "your IP" is static NAT 1 on 1  on ASA going to CUBE... coming to think of it, i still havent tried combination where i would modify in sip profile my private CUBE IP to public CUBE IP they gave me.... hmmmm, i might try that, but question where to put signaling IP and where to put media IP still stands...

I know this all might sound a bit confusing... but any help would be greatly appreciated :)

[Suresh Subramanian]

https://supportforums.cisco.com/blog/154506

Hope this blog will answer the questions you have. Please go through it

[Marko Rodic]

oh... thanks a lot! there might be an answer for me there... i will try some of the things they suggested, and if i find an answer, i will post it here.

[7051688@gmail.com]

I actually have some recent experience with this and may be able to help you. First, install a SIP softphone for troubleshooting (I use XLite). Makes things MUCH easier. Make sure XLite can reach your CUBE. Get your voice flowing between CUBE and ITSP before tying into CUCM. Which ITSP are you using? Do they require registration or can you signal straight to them without username and password?

[Marko Rodic]

they don't use registration... at least we didn't get any info about registration.

the problem is getting voice flow between cube and istp :D although, i am thinking that problem might be cause of cube-cucm connection, as i have bind h323  on local interface, and i'm nat-ing that same interface outside for sip connection... it shouldn't make those problems, as they are two separate call legs, but it is something that confuses me too :s

[7051688@gmail.com]

Are you using a single interface on your CUBE or are you using two? Either way you should not need to use the bind command. And you don't want to NAT your local (CUCM) interface to the outside. The outside world doesn't need to know about your CUCM server. That's the CUBE's job. It mediates between CUCM and the world. Can you post your CUBE config?

[Marko Rodic]

i am not nat-ing CUCM, im nat-ing CUBE ip :)

yes, we use single interface on CUBE, and that interface is for LAN and is also 1 on 1 NAT to public IP...

this is configuration, i just removed numbers and ip addresses... it will be far more complex after we get this thing going, but for now, i just want to establish connection with ITSP

[7051688@gmail.com]

I didn't mean NAT CUCM, I meant the interface towards it. But since you're using a single interface then yes that is what you NAT. You have a lot going on in that config. Probably a lot more than you need. Like I said you should work on this in two legs. CUBE to ITSP, and then CUCM to CUBE. You're trying to make the whole thing work in one shot which is going to cause you some headaches.

Install XLite free version. In the account settings set your UserID to a generic 10 digit phone number, domain to something generic, then at the bottom set the Proxy Address to the IP of your CUBE. The media ports will be negotiated dynamically between the CUBE and the ITSP. Since you said you're not registering you will also need to give the ITSP YOUR peer IP (this is how they secure the trunk) which is whatever IP you're sourcing from when you leave your network (what you're NAT'ing the CUBE to).

For testing, reduce your config to something like this:

voice service voip
 allow-connections sip to sip
 allow-connections h323 to sip
 no supplementary-service sip moved-temporarily
 no supplementary-service sip refer
 signaling forward none
 sip

dial-peer voice 10 voip
description CUBE_TO_ITSP
session protocol sipv2
session target ipv4:SIGNALING IP PROVIDED BY ITSP
destination-pattern [2-9].........
codec g711ulaw
dtmf-relay rtp-nte sip-notify
no vad

dial-peer voice 20 voip
description ITSP_TO_CUBE
destination-pattern .
session protocol sipv2
session target ipv4:Eventually your CUCM IP...for now set it to your computers IP.
codec g711ulaw
dtmf-relay rtp-nte sip-notify
no vad

Use XLite to place a phone call from your PC (if you have a mic and speakers you can have audio if the call connects). This should come pretty close to getting your outward leg established. Once you get this part working you can add in more codecs and translation profiles if you want. Let me know what happens. Include any debug or packet cap results if you can.  

[Marko Rodic]

well, since this is like 10th cucm-cube-itsp config i'm doing, i thought i'm gonna make it all in one try :D

this is actually what was bothering me all along :

session target ipv4:SIGNALING IP PROVIDED BY ITSP

also, im in europe, we are using alaw, and our deftination pattern is a bit different, but i got what you are saying...

thanks for your advice!!!! really appreciate it! i will try it out tomorrow and will let you know the results :)

[Marko Rodic]

OK, everything is working fine now... Mistake was rather silly one, as usual... Colleague of mine has mistyped nat address, so CUBE nated on wrong IP... Its amazing how the hardest problems are uncovered by the most simple solutions :D

Again, many thanks Steve, that signaling tip was great :)

[7051688@gmail.com]

Anytime!

That reminds me I also forgot to mention an issue with passing SIP through an ASA. The SIP inspection map doesn't work in both directions if you use ANY / ANY for your source and destination security interfaces in your NAT rule. So the SIP payload will get translated on the egress, but won't get translated back on the ingress. Your inbound packet will hit the CUBE but the SIP media header info will have your public IP in it, which the CUBE knows nothing about and your calls will fail. The simple fix is to use something like Outside / Inside or Outside / DMZ on your NAT rule. It's a quirk with the state table on ASA.

But if calls are flowing you must already have it set right! Good work!