Hi All,
I have an issue with calls over my SIP trunk where the rtp media flow between endpoints stops in both direction after exactly 5 minutes.
The SIP session stays ups. Call length can be extended by performing some sort of mid-call signalling (hold, then un-hold) during the call.
The environment looks like this:
Mobile Phone --> VTSP --> SIP --> CUBE/ZBFW --> SIP -->CUCM --> Cisco IP Phone
The issue can be resolved by disabling the ZBFW.
Here is a snippet of my CUBE/ZBFW config:
boot system flash:c2900-universalk9-mz.SPA.154-3.M3.bin
ip inspect log drop-pkt
!
parameter-map type inspect global
log dropped-packets enable
max-incomplete low 18000
max-incomplete high 20000
voice service voip
ip address trusted list
ipv4 {publisher-IP}
ipv4 {Subscriber 1 IP}
ipv4 {Subscriber 2 IP}
ipv4 {VTSP SIP Proxy IP}
address-hiding
mode border-element license capacity 50
allow-connections sip to sip
modem passthrough protocol codec g711alaw
sip
session refresh
midcall-signaling passthru
!
voice class codec 1
codec preference 1 g711alaw
codec preference 2 g711ulaw
!
!
voice class sip-profiles 100
request INVITE sip-header Remote-Party-ID remove
request INVITE sip-header Remote-Party-ID remove
class-map type inspect match-any SIP-TRAFFIC
description --All SIP Traffic--
match protocol sip
class-map type inspect match-all ICMP_Allow_CMAP
description --Allow ICMP Traffic--
match access-group name ICMP_Allow_ACL
!
policy-map type inspect VOICE-TRAFFIC
class type inspect SIP-TRAFFIC
inspect
class type inspect ICMP_Allow_CMAP
inspect
class class-default
drop
!
zone security INSIDE
zone security OUTSIDE
zone-pair security CUBE_TO_OUTSIDE_ZP source self destination OUTSIDE
service-policy type inspect VOICE-TRAFFIC
zone-pair security OUTSIDE_TO_CUBE_ZP source OUTSIDE destination self
service-policy type inspect VOICE-TRAFFIC
i
nterface GigabitEthernet0/0
description --Connection to Us/Inside--
ip address xx.xx.xx.xx 255.255.255.0
zone-member security INSIDE
duplex auto
speed auto
!
interface GigabitEthernet0/1
description --Connection to VTSP/Outside--
ip address xx.xx.xx.xx 255.255.255.248
zone-member security OUTSIDE
duplex auto
speed auto
dial-peer voice 100 voip
description --Voip in from Us/Inside--
huntstop
session protocol sipv2
incoming called-number .T
voice-class codec 1
voice-class sip profiles 100
dtmf-relay sip-kpml rtp-nte
no vad
dial-peer voice 200 voip
description --Voip in from VTSP--
huntstop
session protocol sipv2
incoming called-number 02XXXXXX..
voice-class codec 1
voice-class sip profiles 100
voice-class sip options-keepalive retry 3
dtmf-relay rtp-nte
fax-relay ecm disable
fax rate disable
no vad
!
dial-peer voice 201 voip
description --Voip out to CUCM 1--
preference 1
destination-pattern 02XXXXXX..
session protocol sipv2
session target ipv4:{Subscriber 1 IP}
voice-class codec 1
voice-class sip early-offer forced
voice-class sip options-keepalive retry 3
dtmf-relay sip-kpml
fax-relay ecm disable
fax rate disable
no vad
!
dial-peer voice 202 voip
description --Voip out to CUCM 2--
preference 2
destination-pattern 02XXXXXX..
session protocol sipv2
session target ipv4:{Subscriber 2 IP}
voice-class codec 1
voice-class sip early-offer forced
voice-class sip options-keepalive retry 3
dtmf-relay sip-kpml
fax-relay ecm disable
fax rate disable
no vad
At the 5 minute mark of a call, there is no indication in the logs of the CUBE that any UDP packets or SIP sessions are being dropped.
There are also no SIP BYE or RE-INVITE messages in the "debug ccsip messages" output.
My work around at the moment is to remove the SIP inspection and implement only UDP inspection between source/destination IP addresses.
It would much prefer to have SIP inspection only.
Am I missing something in my ZBFW configuration to allow SIP calls last longer than 5 minutes?
Perhaps SIP inspection is reacting to something within the SIP messages being sent/received?
Thanks
Kent
