Don't see SIP INVITE messages on router

[Marko Rodic]

Hello,

We have a problem with our router dropping or not receiving INVITE messages(don't know which one) from PSTN.

Here is whats going on.

Our system looks like this:

CUCM<--SIP-->cisco router<--SIP-->PSTN

All the outbound calls works as they should. However, with inbound calls, we have 2 different situations, regarding calling numbers(called numbers are not affected, ie, behavior changes regarding calling numbers, not called numbers).

This 2 situations are(by looking at PSTN logs and ccsip messages on router)

Situation 1: Everything works fine(this is for most numbers... there is only some calling numbers that make problems).

Situation 2: Sometimes router doesn't answer SIP INVITE message, sometimes it does.(we just did debug logs to see can we see INVITE messages that weren't replied. one company called us 10 times at least, and only one call went through. that call is seen under ccsip messages. the ones that weren't connected, are not among ccsip messages)

Now, as you can see, I was looking at debug ccsip messages, and I don't see INVITE messages unless call went through. Basically, every time router doesn't answer INVITE call, I can't even see INVITE SIP message. So its not like he receive the message, and then decide to drop it. Nope. Its like he never received the message.

So the question goes, 

Is it possible for router to drop INVITE message before it starts processing it, and thus this message is not shown on debug ccsip messages? To best of my knowledge, if there is no INVITE message, it didn't arrive on router at all. But maybe I'm missing something.

If this is possible, how can I see those drop packages and what can be a cause of those?  

[Jonathan Schulenberg]

Yes, the router will silently discard SIP and H.323 packets from untrustworthy sources. The most likely explanation is that the source IPv4 address is not in your trust list. Anything listed as a “session target IPv4:” on a dial-peer is added automatically. You need to add anything else manually.
https://www.cisco.com/c/en/us/support/docs/voice/call-routing-dial-plans/112083-tollfraud-ios.html

You can test this by either disabling the trust list entirely - do this ONLY while testing - or telling the router to explicitly reject untrusted SIP sources using “no silent-discard untrusted” under voice service voip > sip.

[Marko Rodic]

its not from untrusted source. everything thats coming on router comes from same IP address(SIP address of PSTN). router is acting as SIP client with sip-ua registration

however, I will try what you suggested, with no silent-discard and see is anything different, and let you know about results. thanks!

[Marko Rodic]

tried with removing trusted list... no luck, still can't see INVITE being dropped.

is there any other thing that may block it? non-telephony reason for blocking? (router has no access lists as it serves only for telephony services)... if I can just see those packages, I'd know what to do or where to look... this way, I'm in dark, and PSTN provider claims error is on our side, and without being 100% sure router doesn't get INVITE, I can't make them to check anything(outside of their telephony side which does sent INVITE regularly)