ping gets through but phone unable to register?

[Ibrahim Jamil]

Hi Folks

I have to sites connected togather using 4 MBps Link over the tunnel terminated on asa 5510,the call manager in site 1  and the other users on the site 2 unable to register with call mamager on site while i have a suceesull ping goes from site 2 to site 1 (call manager ip) so why this phone its not registered ,so in term of network no problems coz the ping gets through and am rely on ping to confirm that no network problem

---what is the problem for that ?

----How i troubleshoot?

----is there any udp traffic problem that prevent the phone registration

Thanks

[manish arora]

SIP

SIP inspection NATs the SIP text-based messages, recalculates the  content length for the SDP portion of the message, and recalculates the  packet length and checksum. It dynamically opens media connections for  ports specified in the SDP portion of the SIP message as address/ports  on which the endpoint should listen.

SIP inspection has a database with indices CALL_ID/FROM/TO from the  SIP payload that identifies the call, as well as the source and  destination. Contained within this database are the media addresses and  media ports that were contained in the SDP media information fields and  the media type. There can be multiple media addresses and ports for a  session. RTP/RTCP connections are opened between the two endpoints using  these media addresses/ports.

The well-known port 5060 must be used on the initial call setup  (INVITE) message. However, subsequent messages might not have this port  number. The SIP inspection engine opens signaling connection pinholes,  and marks these connections as SIP connections. This is done for the  messages to reach the SIP application and be NATed.

As a call is set up, the SIP session is considered in the transient  state. This state remains until a Response message is received which  indicates the RTP media address and port on which the destination  endpoint listens. If there is a failure to receive the response messages  within one minute, the signaling connection is torn down.

Once the final handshake is made, the call state is moved to active  and the signaling connection remains until a BYE message is received.

If an inside endpoint initiates a call to an outside endpoint, a  media hole is opened to the outside interface to allow RTP/RTCP UDP  packets to flow to the inside endpoint media address and media port  specified in the INVITE message from the inside endpoint. Unsolicited  RTP/RTCP UDP packets to an inside interface will not traverse the  security appliance, unless the security appliance configuration  specifically allows it.

The media connections are torn down within two minutes after the  connection becomes idle. This is a configurable timeout and can be set  for a shorter or longer period of time.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008081042c.shtml#diag

Manish

[Ibrahim Jamil]

thanks for your support

[Ibrahim Jamil]

Pls check the Below:

packet-tracer input outside udp 172.16.3.2 4263  10.100.100.100 sip

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 3
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   192.0.0.0        255.255.0.0     DMZ
             
Phase: 4
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

[manish arora]

Umm , could please post the configuration of both asa's ?

also make sure that you remove passwords and change public ip from 1.1.1.1 to 1.x.x.1.

Packet tracer is showing packet drop because of access rules but vpn traffic should not be scanned against outside access rules unless sysopt vpn-connection is disabled.

Manish

[dijohn]

What type of phone is it?

SCCP/SIP?

Are these open for the phones to register?.

[Ibrahim Jamil]

Hi freind

on the site where i issued the packet tracer i have acl permit ip any any on the inside, and outside interfaces on ASA but in that site where the sip server exist that asa include to much rule, but pls tell me specific where i should check