IP Phone 7961 Stuck Registering

[KJ7BZC]

Hi all,

I've got a 7961 phone I'm attempting to register with a 2851 ISR running CME (old platform I know...), having a bit of trouble getting the phone to register properly. The phone and the router's GigabitEthernet0/0 port are on a Catalyst 2960 with no special configuration, the switch is connected to the rest of my network. DNS and DHCP are handled by a Windows server, Option 150 is set for the IP address of the 2851 (192.168.0.100) and both the router and phone are able to get an IP without issue. The phone is able to connect to the 2851 via TFTP, it successfully downloads it's firmware and configuration file without any issue, it just gets stuck on "Registering" and retries indefinitely. I have also set up a DHCP pool internal to the router and put the phone on port 0/1, the exact same behavior occurs this way as well.

I have enabled "debug ephone register" and "debug sccp all" on the router, I do not get any output from either during this process.

On the phone's status messages I see the following messages:

Error Updating Locale
Error Updating Locale
DNS Unknown Host
DNS Unknown Host
SEP001E136CB77C.cnf.xml
No CTL Installed

I downloaded the phone's configuration file from the router manually, it contains the following:

<device>
<versionStamp>{7960 Sep 01 2023 13:22:41}</versionStamp>
<ipAddressMode>0</ipAddressMode>
<allowAutoConfig>false</allowAutoConfig>
<devicePool>
<dateTimeSetting>
<dateTemplate>M/D/Y</dateTemplate>
<timeZone>Mountain Standard/Daylight Time</timeZone>
</dateTimeSetting>
<callManagerGroup>
<members>
<member  priority="0">
<callManager>
<ports>
<ethernetPhonePort>2000</ethernetPhonePort>
</ports>
<processNodeName>192.168.0.100</processNodeName>
</callManager>
</member>
</members>
</callManagerGroup>
</devicePool>
<commonProfile>
<callLogBlfEnabled>3</callLogBlfEnabled>
</commonProfile>
<loadInformation></loadInformation>
<userLocale>
<name>English_United_States</name>
<langCode>en</langCode>
</userLocale>
<networkLocale>United_States</networkLocale>
<networkLocaleInfo>
<name>United_States</name>
</networkLocaleInfo>
<idleTimeout>0</idleTimeout>
<authenticationURL></authenticationURL>
<directoryURL>http://192.168.0.100:80/localdirectory</directoryURL>
<idleURL></idleURL>
<informationURL></informationURL>
<messagesURL></messagesURL>
<proxyServerURL></proxyServerURL>
<servicesURL>http://192.168.0.100:80/CMEserverForPhone/serviceurl</servicesURL>
<dscpForSCCPPhoneServices>0</dscpForSCCPPhoneServices>
<dscpForCm2Dvce>96</dscpForCm2Dvce>
</device>

192.168.0.100 is indeed the correct IP of the router, I have checked for duplicated on both it and the IP of the phone itself. All the settings in the phone's interface mirror what is in this XML file, and all the options that it gets from DHCP are correct as well.


Here is my "show version" output:

Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 15.1(4)M9, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Fri 12-Sep-14 10:45 by prod_rel_team

ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)

Router uptime is 6 hours, 56 minutes
System returned to ROM by power-on
System restarted at 15:26:50 LOCAL Wed Sep 6 2023
System image file is "flash:c2800nm-adventerprisek9-mz.151-4.M9.bin"
Last reload type: Normal Reload


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Cisco 2851 (revision 1.0) with 505856K/18432K bytes of memory.
Processor board ID FHK1128F0PU
2 Gigabit Ethernet interfaces
2 Serial interfaces
2 terminal lines
2 Channelized T1/PRI ports
2 Channelized (E1 or T1)/PRI ports
1 Virtual Private Network (VPN) Module
6 Voice FXO interfaces
DRAM configuration is 64 bits wide with parity enabled.
239K bytes of non-volatile configuration memory.
500472K bytes of ATA CompactFlash (Read/Write)


License Info:

License UDI:

-------------------------------------------------
Device#   PID                   SN
-------------------------------------------------
*0        CISCO2851             xxx



Configuration register is 0x2102

And "show run":

Building configuration...



Current configuration : 4417 bytes
!
! Last configuration change at 20:33:48 LOCAL Wed Sep 6 2023
! NVRAM config last updated at 20:11:37 LOCAL Wed Sep 6 2023
! NVRAM config last updated at 20:11:37 LOCAL Wed Sep 6 2023
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec localtime
service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
! card type command needed for slot/vwic-slot 1/1
enable password xxx
!
no aaa new-model
!
clock timezone LOCAL -6 0
no network-clock-participate slot 1
no network-clock-participate wic 1
no network-clock-participate wic 3
!
dot11 syslog
ip source-route
!
!
ip cef
!
ip dhcp excluded-address 172.21.69.0
ip dhcp excluded-address 172.21.69.1
!
ip dhcp pool LAN
 network 172.21.69.0 255.255.255.0
 option 150 ip 172.21.69.1
 dns-server 8.8.8.8 8.8.4.4
 default-router 172.21.69.1
!
!
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
voice service voip
 allow-connections sip to sip
 sip
  registrar server
!
!
voice register global
 mode cme
 source-address 192.168.0.100 port 5060
 max-dn 10
 max-pool 5
!
voice register dn  1
 number 1002
 allow watch
 name SIP Test
!
voice register pool  1
 id mac 0004.F289.D928
 number 1 dn 1
!
!
!
voice translation-rule 1
 rule 1 /\([2-9]..[2-9]......\)/ /1\1/
!
!
voice translation-profile PSTN-OUT
 translate called 1
!
!
voice-card 0
!
voice-card 1
!
!
application
 service announcement flash:announcement.vxml
 !
!
crypto pki token default removal timeout 0
!
!
!
!
license udi pid CISCO2851 sn xxx
!
redundancy
!
!
controller T1 0/1/0
!
controller T1 0/3/0
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
 description WAN
 ip address dhcp
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 description LAN
 ip address 172.21.69.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface Async0/2/0
 no ip address
 encapsulation slip
 shutdown
!
interface Async0/2/1
 no ip address
 encapsulation slip
!
ip forward-protocol nd
ip http server
no ip http secure-server
!
!
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 255.255.255.0 GigabitEthernet0/0
!
access-list 1 permit 172.21.69.0 0.0.0.255
!
!
!
!
!
tftp-server flash:term61.default.loads
tftp-server flash:jar41sccp.8-4-1-23.sbn
tftp-server flash:cnu41.8-4-1-23.sbn
tftp-server flash:apps41.8-4-1-23.sbn
tftp-server flash:dsp41.8-4-1-23.sbn
tftp-server flash:cvm41sccp.8-4-1-23.sbn
!
control-plane
!
!
voice-port 0/0/0
 pre-dial-delay 0
 timing digit 50
 timing inter-digit 50
 connection plar 1001
 caller-id enable type 1
!
voice-port 0/0/1
!
voice-port 1/0/0
!
voice-port 1/0/1
!
voice-port 1/0/2
!
voice-port 1/0/3
!
!
!
mgcp profile default
!
!
dial-peer voice 1000 pots
 description Testing PSTN Trunk
 translation-profile outgoing PSTN-OUT
 huntstop
 destination-pattern [2-9]..[2-9]......
 port 0/0/0
!
dial-peer voice 2000 pots
 description Announcement Test
 service announcement
 port 0/0/1
!
!
presence
 presence call-list
 watcher all
 allow subscribe
!
!
!
telephony-service
 pin <redacted>
 max-ephones 5
 max-dn 10
 ip source-address 192.168.0.100 port 2000
 system message <redacted>
 cnf-file perphone
 load 7961 SCCP41.8-4-2S
 time-zone 6
 time-format 24
 max-conferences 8 gain -6
 moh lotus.au
 web admin system name admin password <redacted>
 dn-webedit
 transfer-system full-consult
 transfer-pattern .T
 secondary-dialtone *
 login timeout 60
 create cnf-files version-stamp Jan 01 2002 00:00:00
!
!
ephone-dn  1
 number 1001
 label Test 1
 name Test 1
 allow watch
!
!
ephone  1
 device-security-mode none
 mac-address 001E.136C.B77C
 username "xxx" password xxx
 blf-speed-dial 3 1002 label "1002"
 blf-speed-dial 4 1001 label "1001"
 type 7961
 button  1:1
!
!
!
!
line con 0
line aux 0
line 0/2/0
 session-timeout 5
 exec-timeout 5 0
 timeout login response 15
 password xxx
 logging synchronous
 login
 modem Dialin
 monitor
 transport input all
 stopbits 1
 speed 115200
line 0/2/1
 stopbits 1
 speed 115200
 flowcontrol hardware
line vty 0
 session-timeout 120
 exec-timeout 120 0
 password xxx
 logging synchronous
 login
 transport input telnet
line vty 1 4
 login
 transport input all
!
scheduler allocate 20000 1000
ntp server pool.ntp.org
end

Two things to note about the configuration: There is a VXML application "service announcement" set up here on port 0/0/1 which simply plays "lotus.au" from flash, I have tried removing it's configuration from the router to ensure it is not interfering and it does not make a difference. There is also one SIP phone at register-dn 1, it does not seem to be the cause either.

So far I have tried deleting and re-creating CNF files, hard resetting the 7961 using the key sequence, rebooting everything in various orders, leaving it for long periods of time, setting a static IP on the phone, and removing/adding back the ephone's configuration. The only other idea I haven't tried is wiping and redoing the router's configuration, however I would like to see if there's another solution before trying this. It seems like the phone is just unable to reach the router for registration, but it is able to connect for TFTP without issue. Based on it's status messages it almost implies that it is trying to DNS lookup the CME address (which doesn't make sense), though I have checked logs on the server and don't see any requests from it.

I'm honestly out of ideas, so I'd appreciate any insight others may have. I'm completely open to provide additional debugs and information on this setup.

Thank you,
Keith