DTMF tones and firewall

[leam2]

Hello.

I have two Cisco phones 1 and 2, on my desk and on the same LAN.

• If phone 1 makes a call to phone 2, DTMF tones are handled properly.

• If I make a call to phone 1 from the outside (with my mobile phone), DTMF tones are not handled at all.

• If I make a call to phone 1 from the outside (with my mobile phone) and if I remove the Firewall from the Cisco router, DTMF tones are handled properly.

So the firewall is responsible for this malfunction.

Do you know what can be responsible for that?

Thank you.

[pieterh]

please describe more of your VOIP environment, e.g. are you using a local PBX? 

are you using SIP? etc.

The name DTMF tones is misleading.

Real DTMF is using audio to transfer tones over the phone-network.

this way of signalling is not other than voice and so the firewall will not block it.

But your mobile phone will not always sent DTMF codes! you must tell it to do so.

if not keys can will be passed to the destination using a signalling protocol.

No audio tone is sent, but a data-packet that tells what key is pressed.

Some provider networks do not support real DTMF.

 If the packet comes through, the receiving phone converts the data packet to an audible tone if configured to do so. just as the PBX sends a command "ring bell".

[Mohammed al Baqari]

Any reason why you are inspecting SIP or SCCP on your firewall. Exclude SIP
and SCCP inspection and see if its working fine.

If SIP/SCCP inspection is disabled and still not working, then you have
problem with DTMF relay

[leam2]

Thank you for your answers.
I solved my problem.

@pieterh
The Cisco device is an ISR4331 and the protocol I use is SIP.

The firewall is a Cisco zone-based firewall.
For some reason I do not understand properly, packets from W1.X1.Y1.33 to W1.X1.Y1.34 were dropped.
W1.X1.Y1.33 is a sub-interface on the Cisco router.
W1.X1.Y1.34 is the IP of the CUC VM (Cisco Unity Connection Virtual Machine).
I permitted TCP and UDP traffic from any machine on the subnet W1.X1.Y1.0/24 to any machine on this same subnet W1.X1.Y1.0/24

Best regards.

[pieterh]

good to hear you found an option to solve this.

but your solution describes traffic WITHIN the subnet must be allowed by your firewall?

sounds a little odd? but if this works for you its ok and no need to dig deeper.

regards,

Pieter

[leam2]

Indeed, you are right, it looks odd.
I wish I could explain this...
Best regards.