Make sure the gateways and gatekeepers are NTP synchronised. The time difference between the 2 devices has to be within around 30 seconds of each other otherwise they will not authenticate.
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121t/121t1/h323v2p2.htm#xtocid255056
"The security mechanisms described above require the gateway and
gatekeeper clocks to be synchronized within 30 seconds of each other by
using a Network Time Protocol (NTP) server."
If you don't have access to a NTP server, set up the gatekeeper as a NTP master and set the router clock, then point the gateways to the gatekeeper so they sync their time off it:
gatekeeper router -
ntp master
gateway router -
ntp server
The radius server needs to have a username of the remote router and a corresponding password in it's database. You also need the following line in the gatekeeper config-
security token required-for all
Here are configs for 2 gateways authenticating to a gatekeeper -
multi-3-3#sh run
Building configuration...
Current configuration : 1534 bytes
!
version 12.1
no service single-slot-reload-enable
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname multi-3-3
!
logging buffered 250000 debugging
logging rate-limit console 10 except errors
enable password cisco
!
memory-size iomem 10
ip subnet-zero
!
!
no ip finger
no ip domain-lookup
!
isdn switch-type basic-net3
call rsvp-sync
cns event-service server
!
!
!
!
!
!
!
!
interface Loopback0
ip address 33.1.1.1 255.255.255.0
h323-gateway voip interface
h323-gateway voip id Gatekeeper3_4 ipaddr 34.1.1.1 1718
h323-gateway voip h323-id Gateway3_3
h323-gateway voip bind srcaddr 33.1.1.1
!
interface FastEthernet0/0
ip address 10.1.1.3 255.255.255.0
speed 10
half-duplex
!
interface BRI1/0
no ip address
isdn switch-type basic-net3
isdn incoming-voice voice
!
interface BRI1/1
no ip address
isdn switch-type basic-net3
!
router eigrp 1
network 10.0.0.0
network 33.0.0.0
no auto-summary
no eigrp log-neighbor-changes
!
ip kerberos source-interface any
ip classless
no ip http server
!
!
!
voice-port 1/0/0
compand-type a-law
!
voice-port 1/0/1
!
dial-peer cor custom
!
!
!
dial-peer voice 100 pots
destination-pattern 1
port 1/0/0
!
dial-peer voice 200 voip
destination-pattern 2........
session target ras
dtmf-relay cisco-rtp
ip precedence 5
!
gateway
security password 0822455D0A16 level all
!
!
gatekeeper
shutdown
!
!
line con 0
transport input none
line aux 0
line vty 0 4
password cisco
login
!
no scheduler allocate
ntp server 10.1.1.4
end
multi-3-3#
multi-3-4#sh run
Building configuration...
Current configuration : 1499 bytes
!
! Last configuration change at 18:52:04 UTC Mon Dec 10 2001
! NVRAM config last updated at 18:52:41 UTC Mon Dec 10 2001
!
version 12.1
no service single-slot-reload-enable
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname multi-3-4
!
logging rate-limit console 10 except errors
aaa new-model
aaa authentication login h323 local
aaa accounting connection h323 start-stop group radius
enable password cisco
!
username Gateway3_3 password 0 cisco
username Gateway3_5 password 0 cisco
memory-size iomem 30
ip subnet-zero
!
!
no ip finger
no ip domain-lookup
!
call rsvp-sync
cns event-service server
voice rtp send-recv
!
!
!
!
!
!
!
!
interface Loopback0
ip address 34.1.1.1 255.255.255.0
h323-gateway voip bind srcaddr 34.1.1.1
!
interface Ethernet0/0
ip address 10.1.1.4 255.255.255.0
half-duplex
!
router eigrp 1
network 10.0.0.0
network 34.0.0.0
no auto-summary
no eigrp log-neighbor-changes
!
ip kerberos source-interface any
ip classless
ip http server
!
!
!
voice-port 1/0/0
!
voice-port 1/0/1
!
voice-port 1/1/0
!
voice-port 1/1/1
!
dial-peer cor custom
!
!
!
gateway
!
!
gatekeeper
zone local Gatekeeper3_4 cisco.com 34.1.1.1
zone prefix Gatekeeper3_4 1*
zone prefix Gatekeeper3_4 2*
security token required-for all
gw-type-prefix 1* gw ipaddr 33.1.1.1 1720
gw-type-prefix 2* gw ipaddr 35.1.1.1 1720
no shutdown
!
!
line con 0
transport input none
line aux 0
line vty 0 4
password cisco
line vty 5 15
!
ntp master
end
multi-3-4#
multi-3-5#sh run
Building configuration...
Current configuration : 1655 bytes
!
! Last configuration change at 18:50:14 UTC Mon Dec 10 2001
!
version 12.1
no service single-slot-reload-enable
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname multi-3-5
!
logging rate-limit console 10 except errors
enable password cisco
!
memory-size iomem 15
ip subnet-zero
!
!
no ip finger
no ip domain-lookup
!
isdn switch-type basic-net3
call rsvp-sync
cns event-service server
!
!
!
!
!
!
!
!
interface Loopback0
ip address 35.1.1.1 255.255.255.0
h323-gateway voip interface
h323-gateway voip id Gatekeeper3_4 ipaddr 34.1.1.1 1718
h323-gateway voip h323-id Gateway3_5
h323-gateway voip bind srcaddr 35.1.1.1
!
interface FastEthernet0/0
ip address 10.1.1.5 255.255.255.0
duplex auto
speed auto
!
interface Serial0/0
no ip address
shutdown
!
interface BRI1/0
no ip address
isdn switch-type basic-net3
isdn incoming-voice voice
!
interface BRI1/1
no ip address
isdn switch-type basic-net3
!
router eigrp 1
network 10.0.0.0
network 35.0.0.0
no auto-summary
no eigrp log-neighbor-changes
!
ip kerberos source-interface any
ip classless
ip http server
!
!
!
voice-port 1/0/0
compand-type a-law
!
voice-port 1/0/1
!
dial-peer cor custom
!
!
!
dial-peer voice 200 pots
destination-pattern 2
port 1/0/0
!
dial-peer voice 100 voip
destination-pattern 1........
session target ras
dtmf-relay cisco-rtp
ip precedence 5
!
gateway
security password 1511021F0725 level all
!
!
gatekeeper
shutdown
!
!
line con 0
transport input none
line aux 0
line vty 0 4
password cisco
login
line vty 5 15
login
!
no scheduler allocate
ntp clock-period 17179886
ntp server 10.1.1.4
end
multi-3-5#
