ping gets through but phone unable to register?

[Ibrahim Jamil]

Hi Folks

I have to sites connected togather using 4 MBps Link over the tunnel terminated on asa 5510,the call manager in site 1  and the other users on the site 2 unable to register with call mamager on site while i have a suceesull ping goes from site 2 to site 1 (call manager ip) so why this phone its not registered ,so in term of network no problems coz the ping gets through and am rely on ping to confirm that no network problem

---what is the problem for that ?

----How i troubleshoot?

----is there any udp traffic problem that prevent the phone registration

Thanks

[manish arora]

Hi Ibrahim,

what are you using for signaling protocol ? For example SIP or MGCP etc , you have to enable inspection for this protocols on the ASA.

post sh service-policy from the ASA's

Manish

[Ibrahim Jamil]

HI

The signaling protocol is SIP and inspection has been enabled under policy map

but the ping its gets trough,can u expain this?

can u help more?

policy-map global_policy
class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sip 
  inspect netbios
  inspect tftp

[manish arora]

Ok, run packet tracer to see where is the packet being dropped, run it on the far end ASA where the SIP server is. check out the example on how to use packet tracer tool :-

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807c35e7.shtml

Manish

[Ibrahim Jamil]

what do u mean by Packets droped? is it ping packet? pings packets goes with any lose?can u help more in term of CLI Debug

[manish arora]

Ok , when you will run packet tracer , it gives you various options , like source ip , source port , destination ip dest port and then interface with direction and check for the whole path and tells you why the packet was dropped.

so , do couple of things on the ASA where the sip server is :-

1> sh service-policy inspect sip  ( This will show if the sip packets are being dropped )

2> run packet tracer

a-fw01# packet-tracer input outside udp SOURCE_IP  4263  SIP_SERVER_IP sip

This will tell you where and why the packets are getting dropped.

manish

[Ibrahim Jamil]

My Freind,can u explain why the ping packet goes back in forth with no packet lose?

[manish arora]

Because it is ICMP , not tcp/udp , if the firewall is allowing ICMP doesnot means that will allow other protocols be it layer 3 or any other upper layer protocols. That is why is have being telling you to run packet tracer and see by your self that why icmp is not being dropped and sip traffic is being dropped.

manish

[Ibrahim Jamil]

Thanks for ur reply!

so i will issue command on the asa where the call manager exist?am i right

2nd I wont rely just on ICMP to confirm that evry thing is perfect?pls correct me if  am wrong

[manish arora]

so i will issue command on the asa where the call manager exist?am i right

---> YES

2nd I wont rely just on ICMP to confirm that evry thing is perfect?pls correct me if  am wrong

---> YES , incase of firewall , if icmp work doesn;t mean that its perfect. you could have inspections/rules dropping other packets.

Manish

[Ibrahim Jamil]

hi

Pls check the below

asa5510# sh service-policy inspect sip

Global policy:
  Service-policy: global_policy
    Class-map: inspection_default
      Inspect: sip , packet 180, drop 0, reset-drop 0
               tcp-proxy: bytes in buffer 0, bytes dropped 0

[manish arora]

So, that looks perfect as inspection isn't dropping anything.

can you please run the packet tracer command  :-

packet-tracer input outside udp SOURCE_IP  4263  SIP_SERVER_IP sip

where SOURCE_IP = ip add of the client to the sip server.

and

SIP_SERVER_IP = ip add of the sip server itself.

manish

[Ibrahim Jamil]

Hi

if the sip inspection is not configure thus we will face packet drop?am i right?

[manish arora]

Yes, that is generally the case

Manish

[Ibrahim Jamil]

My Freind What this inspection looks lile?