Issue with ISR4221

[Cisco7777]

Hello,

having IP phones connectivity issue with ISR 4221 Router, internet working fine, below is the configuration:

Router(config)#do s

Current configuration : 1752 bytes
!
! Last configuration change at 04:37:06 UTC Wed Jan 22 2020
!
version 16.5
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname Router
!
boot-start-marker
boot-end-marker
!
no shell processing
!
!
no aaa new-model
!

ip dhcp excluded-address 192.168.2.1
!
ip dhcp pool LAN_POOL
network 192.168.2.0 255.255.255.0
default-router 192.168.2.1
dns-server 8.8.8.8 8.8.4.4
lease 200
class 1
address range 192.168.2.100 192.168.2.240
!
!
ip dhcp class 1
!
!
ip dhcp global-options
dns-server 77.232.5.12 77.250.1.15
!
!
subscriber templating
!
!
multilink bundle-name authenticated
!
!
diagnostic bootup level minimal
spanning-tree extend system-id
!
!
!
redundancy
mode none
!
!
interface GigabitEthernet0/0/0
ip address 77.162.22.201 255.255.255.0
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/1
ip address 192.168.2.1 255.255.255.0
ip nat inside
negotiation auto
!

threat-visibility
ip default-gateway 77.162.22.1
ip nat inside source static tcp 192.168.2.2 80 interface GigabitEthernet0/0/0 80
ip nat inside source list 1 interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
no ip http server
ip http secure-server
ip route 0.0.0.0 0.0.0.0 77.162.22.1
!
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
!
!
access-list 1 permit 192.0.0.0 0.255.255.255
!
control-plane
!
!
line con 0
transport input none
stopbits 1
line vty 0 4
login
!
no network-clock synchronization automatic
!
!
end

Router(config)#

[Seb Rupik · Accepted solution]

Hi there,

Try disabling SIP ALG:

no ip nat service sip tcp port 5060
no ip nat service sip udp port 5060

cheers,

Seb.

[Cisco7777]

Thanks for reply,

so the Router blocks all ports by default?

[Seb Rupik]

By default the routers Application Layer Gateway will perform NAT on traffic using port 5060. In most instances using various vendors, if there is problems with VOIP traffic traversing an internet gateway router, disabling SIP ALG is a good place to start.

cheers,

Seb.

[Cisco7777]

Also i forgot to mention, I tested the internet speed using Cisco 4221 it shows 30-40 mbit/s, while old Zywall USG showed 160 mbit/s to the same server. What could be the issue? 

[Seb Rupik · Accepted solution]

Believe it or not, the ISR series have performance licenses, the 4221 is pegged at 35 Mbps (!). You need to purchase FL-4220-PERF-K9 to go up to 75 Mbps.

See table 6 here:

https://www.cisco.com/c/en/us/products/collateral/routers/4000-series-integrated-services-routers-isr/data_sheet-c78-732542.html

cheers,

Seb.

[Joseph W. Doherty]

Or, to possibly obtain the prior 160 Mbps, you'll need a "boost" license, table 7 in Seb's reference. NB: the "performance" license generally "guarantees" you can obtain the licensed performance but the "boost" license basically uncaps the device, so actual top performance may vary greatly depending on your configuration and/or traffic mix.

[Cisco7777]

Hi,

we have got a 1 Gbit/s internet link, does ISR4221 capable for 1gbit/s with boost license or better to switch to another model?

[Georg Pauwen]

Hello,

the boost license on the 4221 will bring the throughput to 1.2 Gbps. Check the document linked below.

https://www.cisco.com/c/en/us/products/routers/4000-series-integrated-services-routers-isr/models-comparison.html

[Cisco7777]

Hi,

IP phones are working, thanks mate.