Hello everyone,
I'm currently digging some SIP messages in my lab. I have some questions I need assistance for. I can see in my traces that after downloading the ITL and configuration file, the phone always send two (02) REFER request to the CUCM before sending the REGISTER. I'm trying to understand the meaning of these REFER. Sharing some details with you below.
Phone:
CP-7821: 192.168.15.20
DN: 7821
CUCM: 192.168.110.100
Highlighting below interesting points. I have no issue with the phone, it registers normally with CUCM after these two REFER
REFER sip:192.168.110.100 SIP/2.0
Via: SIP/2.0/TCP 192.168.15.20:50867;branch=z9hG4bK525f6d5b
From: "Laurent Robert" <sip:7821@192.168.15.20>;tag=c4b9cd80864700020acadc33-3512f52a
To: <sip:192.168.110.100>
Call-ID: c4b9cd80-86470002-1eb10ed0-2f2fc25e@192.168.15.20
Session-ID: 98b5223700105000a000c4b9cd808647;remote=00000000000000000000000000000000
Date: Wed, 15 Jan 2020 22:49:18 GMT
CSeq: 1000 REFER
User-Agent: Cisco-CP7821/11.5.1
Expires: 10
Max-Forwards: 70
Contact: <sip:e47a851c-de7c-3804-b05b-40f49816efd1@192.168.15.20:50867;transport=tcp>;+u.sip!devicename.ccm.cisco.com="SEPC4B9CD808647"
Require: norefersub
Referred-By: "Laurent Robert" <sip:7821@192.168.15.20>
Refer-To: cid:082f1702@192.168.15.20
Content-Id: <082f1702@192.168.15.20>
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
Content-Length: 570
Content-Type: application/x-cisco-alarm+xml
Content-Disposition: session;handling=required
<?xml version="1.0" encoding="UTF-8"?>
<x-cisco-alarm>
<Alarm Name="DeviceTLInfo">
<ParameterList>
<String name="DeviceName">SEPC4B9CD808647</String>
<String name="IPv4Address">192.168.15.20</String>
<String name="IPv6Address"></String>
<String name="CTL_Signature">Not Installed</String>
<String name="CTL_TFTP_Server">N/A</String>
<String name="ITL_Signature">3E 91 A3 5D A3 D6 BD B7 0F 09 21 98 18 3F 64 D3 B2 8E 80 15 </String>
<String name="ITL_TFTP_Server">pub.techvivi.local</String>
<String name="StatusCode">3</String>
</ParameterList>
</Alarm>
</x-cisco-alarm>
REFER sip:192.168.110.100 SIP/2.0
Via: SIP/2.0/TCP 192.168.15.20:50867;branch=z9hG4bK399c9a5d
From: "Laurent Robert" <sip:7821@192.168.15.20>;tag=c4b9cd80864700035188412b-15206e63
To: <sip:192.168.110.100>
Call-ID: c4b9cd80-86470003-49128325-06b80b98@192.168.15.20
Session-ID: 98b5223700105000a000c4b9cd808647;remote=00000000000000000000000000000000
Date: Wed, 15 Jan 2020 22:49:18 GMT
CSeq: 1000 REFER
User-Agent: Cisco-CP7821/11.5.1
Expires: 10
Max-Forwards: 70
Contact: <sip:e47a851c-de7c-3804-b05b-40f49816efd1@192.168.15.20:50867;transport=tcp>;+u.sip!devicename.ccm.cisco.com="SEPC4B9CD808647"
Require: norefersub
Referred-By: "Laurent Robert" <sip:7821@192.168.15.20>
Refer-To: cid:65877be3@192.168.15.20
Content-Id: <65877be3@192.168.15.20>
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
Content-Length: 1666
Content-Type: application/x-cisco-alarm+xml
Content-Disposition: session;handling=required
<?xml version="1.0" encoding="UTF-8"?>
<x-cisco-alarm>
<Alarm Name="LastOutOfServiceInformation">
<ParameterList>
<String name="DeviceName">SEPC4B9CD808647</String>
<String name="DeviceIPv4Address">192.168.15.20/24</String>
<String name="IPv4DefaultGateway">192.168.15.251</String>
<String name="DeviceIPv6Address"></String>
<String name="IPv6DefaultGateway"></String>
<String name="ModelNumber">CP-7821</String>
<String name="NeighborIPv4Address">192.168.15.252</String>
<String name="NeighborIPv6Address"></String>
<String name="NeighborDeviceID">3560_DC_SW.techvivi.local</String>
<String name="NeighborPortID">GigabitEthernet0/21</String>
<Enum name="DHCPv4Status">1</Enum>
<Enum name="DHCPv6Status">3</Enum>
<Enum name="TFTPCfgStatus">1</Enum>
<Enum name="DNSStatusUnifiedCM1">0</Enum>
<Enum name="DNSStatusUnifiedCM2">0</Enum>
<Enum name="DNSStatusUnifiedCM3">0</Enum>
<Enum name="DNSv6StatusUnifiedCM1">0</Enum>
<Enum name="DNSv6StatusUnifiedCM2">0</Enum>
<Enum name="DNSv6StatusUnifiedCM3">0</Enum>
<String name="VoiceVLAN">15</String>
<String name="UnifiedCMIPAddress">192.168.110.100</String>
<String name="LocalPort">50386</String>
<String name="TimeStamp">1579128304808</String>
<Enum name="ReasonForOutOfService">25</Enum>
<String name="LastProtocolEventSent">Sent:REGISTER sip:192.168.110.100 SIP/2.0 Cseq:336 REGISTER CallId:c4b9cd80-86470022-467f1380-3b60328a@192.168.15.20 </String>
<String name="LastProtocolEventReceived">Rcvd:SIP/2.0 200 OK Cseq:122 REGISTER CallId:c4b9cd80-86470003-6438bc5f-78ebaf4c@192.168.15.22 </String>
<String name="ReasonForOutOfServiceText">LastTimeInitialized</String>
</ParameterList>
</Alarm>
</x-cisco-alarm>
These are the questions I'm not able to find answer for.
Where does the phone gets the values "Refer-To" highlighted above from?
If the phone is trying to notify CUCM with these syslog events, why is it not using NOTIFY method instead of REFER?
Am I right when thinking the phone is trying to notify CUCM with the two alarm in blue?
I've seen something on the link below regarding the alarm DeviceTLInfo, but it doesn't answer my question.
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/err_msgs/10_x/ccmalarms1001.html
Thanks for your help
