CUCM upgrade 12.5.1.12900-115 to 12.5.1.17900-64 ISE DACL Issue

[S Leigh]

Hi all.

So i upgradeed our CUCm cluster from 129 to 179 last night and now all of our desk phones have 1 way voice.
I have narrowed it down to the dACL we have on ISE.

This was working yesterday prior to the change.
Any one know of any changes to port numbers etc between the two versions?

permit udp any eq bootpc any eq bootps
permit udp any host 10.226.225.4
permit udp any host 10.226.225.14
permit udp any host 10.226.224.4
permit tcp any host 10.226.225.4 eq 8080
permit tcp any host 10.226.225.14 eq 8080
permit tcp any host 10.226.224.4 eq 8080
permit tcp any host 10.226.225.4 eq 2000
permit tcp any host 10.226.225.14 eq 2000
permit tcp any host 10.226.224.4 eq 2000
permit tcp any host 10.226.225.4 eq 2443
permit tcp any host 10.226.225.14 eq 2443
permit tcp any host 10.226.224.4 eq 2443
permit tcp any host 10.226.225.4 eq 2445
permit tcp any host 10.226.225.14 eq 2445
permit tcp any host 10.226.224.4 eq 2445
permit tcp any host 10.226.225.4 eq 3804
permit tcp any host 10.226.225.14 eq 3804
permit tcp any host 10.226.224.4 eq 3804
permit tcp any host 10.226.225.4 range 5060 5061
permit tcp any host 10.226.225.14 range 5060 5061
permit tcp any host 10.226.224.4 range 5060 5061
permit tcp any host 10.226.225.4 eq 6970
permit tcp any host 10.226.225.14 eq 6970
permit tcp any host 10.226.224.4 eq 6970
permit tcp any eq 80 host 10.225.18.160
permit tcp any eq 80 host 10.225.18.163
permit tcp any eq 80 host 10.225.118.160
permit tcp any eq 80 host 10.225.118.162
permit tcp any eq 80 host 10.225.123.113
permit tcp any eq 443 host 10.225.18.160
permit tcp any eq 443 host 10.225.18.163
permit tcp any eq 443 host 10.225.118.160
permit tcp any eq 443 host 10.225.118.162
permit tcp any eq 22 host 10.225.18.160
permit tcp any eq 22 host 10.225.18.163
permit tcp any eq 22 host 10.225.118.160
permit tcp any eq 22 host 10.225.118.162
permit icmp any any echo-reply
deny ip any any

[Divya Jain]

HI,
usually the RTP port r anges from 16384 - 32767 UDP. ( This is for Voice packets). 5060 and 5061 are for SIP negotiation.
Refer to community discussion : https://community.cisco.com/t5/ip-telephony-and-phones/rtp-port-range/td-p/1345511#:~:text=RTP%20has%20a%20broad%20range%20of%20ports%20assigned%2016384%20%2D%2032767%20UDP.

I would suggest that you take a packet capture or check your CUCM logs to undertsand what ports are being used and then just double check with your dAcl or any other device in network.


 

-------------------------------------------------------------
If you find my reply solved your question or issue, kindly click the 'Accept as Solution' button and vote it as helpful.

You can also learn more about ISE through our live Ask the Experts (ATXs) session. Check out Cisco ATXs Resources [https://community.cisco.com/t5/security-knowledge-base/cisco-endpoint-security-ask-the-experts-resources/ta-p/4394492] to view the latest schedule for upcoming sessions, as well as the useful references, e.g. online guides, FAQs.
-------------------------------------------------------------



Regards,
Divya Jain


 

[Roger Kallberg]

Not related to your question as such, but may I ask why you did select to upgrade to SU7 when SU7a is out? Very likely there where some serious defects in the originally released version of SU7, at least serious enough so that it merited a new release just a few days later. My advice would be to be on SU7a, not SU7.

[S Leigh]

 So just as an update it turns out that the issue was with Cisco ISE and a patch has been released to resolve this. (Patch 6)
I will be implementing the patch shortly and will get back with the results and then maybe look at going to 7a..