SRST Testing

[Rohit Khajuria]

HI All

Is this possible to test SRST with the following ways ? Also please tell me if there is any difference in testing normal SRST & SIP SRST.

Method 1

For Example my CCM IP is 10.10.1.24

Add the following route:

ip route 10.10.0.0 255.255.255.0 null0

Method 2

Applying the Access LIst

ip access-list extended ACL-VOIP-CONTROL
deny tcp any any eq 5060
deny udp any any eq 5060
deny tcp any any eq 5061
deny udp any any eq 5061
deny tcp any any eq 2000
deny tcp any any eq 2443
deny udp any any range 16384 32767
permit ip any any

Apply the access control list to the WAN interface

interface X/X
ip access-group ACL-VOIP-CONTROL in

Please let me know if there is any other way to test the SRST .

Regards

Rohit

[Roger Kallberg]

Hi,

my prefered method is to use routes to null, primarily because it's much easier and less prone to mistakes. Given your example this would be what I would use.

ip route 10.10.1.24 255.255.255.255 null0

This way you only affect traffic to CM, it will not block any other traffic from the site.

Sincerely

Roger

[Carlo Poggiarelli]

Hi

+5 Roger...

Also stoppoing callmanager service is a way ;)

Cheers

Carlo

[Rohit Khajuria]

HI Carlo Thanks for your reply. Stopping Call Manager service seems to be an easy way but I believe it also affects other services.

[Carlo Poggiarelli · Accepted solution]

Hi Rohit.

Not really.

What is affected is devices registration media resources registration Hunt lists also calls are preserved...

So depending on CUCM load I think you could proceed also in this way

Regards

Carlo

[Rohit Khajuria]

Ok. Thanks a lot for your reply and the information. Regards Rohit Khajuria

[Ayodeji Okanlawon]

Hi Rohit,

Using ip route XXXXXX null0 is not the recommended approach to test SRST. The reason is because you can have an environment where static routes are being distributed into other routing protocols such as ospf, or BGP. If this happens it means that your cucm server will be black holed and no body will be able to reach it. 

So the best and safest approach is to use ACL and then apply it to the vlan of the phones you want to force into SRST. 

[Rohit Khajuria]

Hi Ayodeji

Thanks for your reply. SO please tell me if the below mentioned ACL works to test SRST.

ip access-list extended ACL-VOIP-CONTROL
deny tcp any any eq 5060
deny udp any any eq 5060
deny tcp any any eq 5061
deny udp any any eq 5061
deny tcp any any eq 2000
deny tcp any any eq 2443
deny udp any any range 16384 32767
permit ip any any

Apply the access control list to the WAN interface

interface X/X
ip access-group ACL-VOIP-CONTROL in

[Ayodeji Okanlawon]

No those rules need to be adjusted 

deny tcp any any eq 5060.. Ok
deny udp any any eq 5060..ok
deny tcp any any eq 5061.. Remove
deny udp any any eq 5061.. Remove
deny tcp any any eq 2000.. Ok
deny tcp any any eq 2443.. . Remove
deny udp any any range 16384 32767.. Remove 

Don't apply to Wan interface. Apply to phone vlan. 

So you should only have these three rules and your permit ip any any

deny tcp any any eq 5060
deny udp any any eq 5060

deny tcp any any eq 2000

[Rohit Khajuria]

Thanks a lot for your reply and the information.

Regards

Rohit Khajuria

[Dennis Mink]

i'd go even one step further and just block all phone traffic to cucm.  and apply this to the phone vlan SVI.

so deny ip host <ip address of single phone>  host <ip address of cucm>

this will give you the option to test a single phone, and at leats will let you test SRST registration and PSTN calls.

of course te access list can be expanded to cover the whole voice subnet

but i like the Null0 routing option as well, 

[Rohit Khajuria]

Yes, I think rather than testing all phones we can have the same test with one IP phone. That really sounds great. Thanks a lot for this idea Dennis.

[Ayodeji Okanlawon]

Well.. Now we get to the political and ethical side of business. If you have a contractual agreement to provide SRST for all sites. Then you have to ensure that all phones on that site is tested for SRST. You must put the whole site into SRST. It is nice to be able to test a single phone, but does that meet the contract you signed? This is where it gets interesting. Personally I don't do that except for lab purposes. Another issue you have not actually tested how SRST will work for the whole site until all affected phones are in SRST. 

Just my two scents 

[Carlo Poggiarelli]

Guys.

In my experience, all customers who bought SRST feature, asked me to show them that it was working on all phones in al sites.

That's why simulating a callmanager failure by stopping callmanager service remains for me the smartest solution

Just my thought

Cheers

Carlo

[Ayodeji Okanlawon]

Carlo, 

Stopping cucm service works when all you have us a single site. What if you have multiple sites. And these sites are added to the IPT system at different times and for each site you need to provide and test SRST. You can't stop cucm service here because you impact other sites.