Monitor SIP registration and shut interface

[valagappan]

Hi, 

I am just wondering if anyone can help me with EEM on the Cisco Cube to proactively monitor the SIP Trunks and then shut the Loopback interfaces if the registration is failed with the service provider. We recently had an outage and we need to deploy a solution to automate the SIP trunk failover. 

Cube has 2 SIP trunks, one to the provider and the other to the CUCM. 

CUCM could see the trunk up and kept sending the calls into the Cube which failed as it has lost registration to the provider. 

We thought of having the SIP OOD Options ping, but this will only work with error codes 503, 505 and no response: 

https://www.cisco.com/c/en/us/td/docs/ios/voice/cube/configuration/guide/vb_book/vb_book/vb_9321.html

We saw SIP message on the debugs as "404 Not Found" when this happened. This was only noticed during the SIP debugs. No other syslog message was generated on this outage. 

We saw the sip was not registered when running cli: "show sip register status"

I was hoping if someone can please assist to develop EEM so we can shut both Loopback interfaces (to provider and CUCM) so this is automatically taken care of. 

I can only think of running the command 'show sip register status' are regular intervals to keep track of the SIP registration unless there is other ways (other ideas welcome). 

We also need to generate a syslog message to drop a line that SIP was unregistered and interfaces shut, so this generates an automated ticket in our system. 

And of course if the registration is restored later, the interfaces should automatically be brought back up as part of EEM. 

Regards,

Veera

[Joe Clarke]

What does the output of "show sip register status" look like? 

[valagappan]

Hi Joe,

Thanks for looking into it. 

The output will be as below: 

rtr007#show sip register status
Line peer expires(sec) reg survival P-Associ-URI
================================ ========== ============ === ======== ============
Y204970Z -1 187 yes normal

Just to be clear: 

We can see the Line(circuit), peer, expires(sec), reg, survival and P-Associ-URI.

I am interested to check 'reg' status. In this case we see 'yes'. 

But when the SIP Session protocol was not registered, we saw a 'no' under 'reg'. 

Please let me know if you need more info.

Thanks,

Veera

[valagappan]

Hi,

I have further looked up the traces on this failure and could see 404 error on all failed calls when the registration had failed with ITSP.

Can someone confirm if the below script would work based on 404 error please ?

*************************************
Applet to monitor 404 error using OID
*************************************
event manager applet cube-monitor-sip-404-inbound
description Poll OID for SIP 404 errors ingress to CUBE every 60 seconds. If incrementing over previous poll, generate critical level syslog alert.
event snmp oid 1.3.6.1.4.1.9.9.152.1.2.4.9.0 get-type exact entry-op ge entry-val 1 entry-type increment exit-op eq exit-val 0 exit-type increment poll-interval 60
action 1.0 syslog priority critical msg "SIP 404 Not Found messages are incrementing inbound. Check SIP network health."

*******************************************************************
Applet to monitor critical msg on syslog and shut SIP trunk to CUCM
*******************************************************************
event manager applet shutloopbacks
event syslog pattern "SIP 404 Not Found messages are incrementing inbound. Check SIP network health." period 1
action 1.0 syslog priority critical msg "Interface Loopback82 shutdown by EEM"
action 2.0 cli command "enable"
action 2.1 cli command "config t"
action 2.2 cli command "interface loopback 82"
action 2.3 cli command "shutdown"
action 3.0 cli command "end"

If the above loopback interface is successfully shutdown by EEM, we should get an event raised by internal ticket system.

Thank you,

Veera

[DeanD]

Did this work?