DID forwarding mystery

the-lebowski · ‎09-07-2022

We have a SIP trunk that terminates on a 2911 in Malaysia managed by a 3rd party (totally inept but besides the point) CUCM.

We own the CUBE/SIP trunk and DIDs and currently 1 number is being forwarded but nobody can tell me who is forwarding it. I can see on the logs on the CUBE that the number is being forwarded but there is no translation pattern to do that so I am at a loss as to where it is happening.

If I can create a translation pattern on the CUBE I will if someone can show me the way to do that. I have no access to CUCM and the vendor is beyond useless so I need to do this on the CUBE or somehow figure out where its being forwarded and have them change it.

Called from: 2403411099

Called to: 0376119000

Forwarded to: 01548770088

Can someone take a look at these logs and help me understand this?

Log Buffer (4096 bytes):
 SIP/2.0/UDP 172.16.1.134:5060;branch=z9hG4bK06B761b2674eb19dd56
From: <sip:+12403411099@172.16.1.134;pstn-params=9084818088>;tag=gK06462a68
To: <sip:0376119000@10.99.4.26>;tag=73DAF3F8-51F
Call-ID: 1141271787_13249496@172.16.1.134
CSeq: 2480 PRACK
Max-Forwards: 70
RAck: 8397 2479 INVITE
Content-Length: 0


1343043: *Sep  6 22:41:16.422: //1566156/CBAC9395B504/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 200 OK
Via: SIP/2.0/UDP 172.16.1.134:5060;branch=z9hG4bK06B761b2674eb19dd56
From: <sip:+12403411099@172.16.1.134;pstn-params=9084818088>;tag=gK06462a68
To: <sip:0376119000@10.99.4.26>;tag=73DAF3F8-51F
Date: Tue, 06 Sep 2022 14:41:16 GMT
Call-ID: 1141271787_13249496@172.16.1.134
Server: Cisco-SIPGateway/IOS-15.7.3.M5
CSeq: 2480 PRACK
Session-ID: 00744f0f06155049a4190b69c9d071e2;remote=47a827b456065976ad394e48a7425013
Content-Length: 0


1343045: *Sep  6 22:41:16.830: //1566157/CBAC9395B504/SIP/Msg/ccsipDisplayMsg:
Received:
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.99.4.26:5060;branch=z9hG4bKAD51AE2
From: <sip:0376119000@10.99.4.26>;tag=73DAF160-5DE
To: <sip:01548770088@172.16.1.134>;tag=gK02f0be93
Call-ID: CBAE680D-2D2811ED-B50ABBC4-FDDB1712@10.99.4.26
CSeq: 101 INVITE
Accept: application/sdp, application/isup, application/dtmf, application/dtmf-relay,  multipart/mixed
Contact: <sip:01548770088@172.16.1.134:5060>
Allow: INVITE,ACK,CANCEL,BYE,REGISTER,REFER,INFO,SUBSCRIBE,NOTIFY,PRACK,UPDATE,OPTIONS
Require: timer
Supported: timer
Session-Expires: 1800;refresher=uac
Content-Length:  233
Content-Disposition: session; handling=required
Content-Type: application/sdp

v=0
o=Sonus_UAC 26822 18710 IN IP4 172.16.1.134
s=SIP Media Capabilities
c=IN IP4 172.16.1.135
t=0 0
m=audio 15362 RTP/AVP 8 101
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=sendrecv
a=ptime:10

1343046: *Sep  6 22:41:16.834: //1566157/CBAC9395B504/SIP/Msg/ccsipDisplayMsg:
Sent:
ACK sip:01548770088@172.16.1.134:5060 SIP/2.0
Via: SIP/2.0/UDP 10.99.4.26:5060;branch=z9hG4bKAD723C1
From: <sip:0376119000@10.99.4.26>;tag=73DAF160-5DE
To: <sip:01548770088@172.16.1.134>;tag=gK02f0be93
Date: Tue, 06 Sep 2022 14:41:15 GMT
Call-ID: CBAE680D-2D2811ED-B50ABBC4-FDDB1712@10.99.4.26
Max-Forwards: 70
CSeq: 101 ACK
Allow-Events: kpml, telephone-event
Session-ID: 47a827b456065976ad394e48a7425013;remote=00744f0f06155049a4190b69c9d071e2
Content-Length: 0


1343047: *Sep  6 22:41:16.838: //1566156/CBAC9395B504/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 200 OK
Via: SIP/2.0/UDP 172.16.1.134:5060;branch=z9hG4bK06B761a3459eb19dd56
From: <sip:+12403411099@172.16.1.134;pstn-params=9084818088>;tag=gK06462a68
To: <sip:0376119000@10.99.4.26>;tag=73DAF3F8-51F
Date: Tue, 06 Sep 2022 14:41:16 GMT
Call-ID: 1141271787_13249496@172.16.1.134
CSeq: 2479 INVITE
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
Allow-Events: kpml, telephone-event
Remote-Party-ID: <sip:01548770088@10.99.4.26>;party=called;screen=no;privacy=off
Contact: <sip:0376119000@10.99.4.26:5060>
Supported: replaces
Supported: sdp-anat
Server: Cisco-SIPGateway/IOS-15.7.3.M5
Session-ID: 00744f0f06155049a4190b69c9d071e2;remote=47a827b456065976ad394e48a7425013
Session-Expires:  1800;refresher=uac
Require: timer
Supported: timer
Content-Type: application/sdp
Content-Disposition: session;handling=required
Content-Length: 244

v=0
o=CiscoSystemsSIP-GW-UserAgent 8723 3409 IN IP4 10.99.4.26
s=SIP Call
c=IN IP4 10.99.4.26
t=0 0
m=audio 20324 RTP/AVP 8 101
c=IN IP4 10.99.4.26
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=ptime:10

1343048: *Sep  6 22:41:16.858: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
ACK sip:0376119000@10.99.4.26:5060 SIP/2.0
Via: SIP/2.0/UDP 172.16.1.134:5060;branch=z9hG4bK06B761d6ee8eb19dd56
From: <sip:+12403411099@172.16.1.134;pstn-params=9084818088>;tag=gK06462a68
To: <sip:0376119000@10.99.4.26>;tag=73DAF3F8-51F
Call-ID: 1141271787_13249496@172.16.1.134
CSeq: 2479 ACK
Max-Forwards: 70
Content-Length: 0

TechLvr · ‎09-07-2022

Edit:
The debug messages you sent are incomplete. Could you please send the complete output of the following commands.
debug ccsip messages
debug voice ccapi inout

the-lebowski · ‎09-08-2022

I figured out with the help of TAC...there was one line in the configuration which was forwarding the call..
num-exp 0376119000 90XXXXXXXXX
Once we changed that and updated the below translation rule to strip the 9 I was able to forward it to the new number.
voice translation-rule 1
rule 1 /^90\(.*\)/ /+\1/
I didn't even know what num-exp did and missed it a bunch of times when looking at the config.

TechLvr · ‎09-08-2022

Ah ok. Glad you got it resolved with TAC.

Roger Kallberg · ‎09-07-2022

As @TechLvr wrote your output is incomplete. Please include the whole SIP dialog for the inbound call and for the outbound call for the call forward.