Network duplicate MACs for voice

[Mokhalil82]

Hi

We have a network with Avaya Telephony. The question is more regarding the network aspect. We have 3 phone servers in 3 locations. When phones register with on of the servers they are dropping packets and calls drop etc. 

I have done a packet capture on my desk phone at 10.152.39.38 when it registers with the troubled server 10.10.6.4

I have noticed the capture showing duplicate packet detected for 10.10.6.4 as show on the attached screenshot.

The 2 macs mentioned 6c:a8:49:8a:77:7f and a4:25:1b:c5:79:d8 belong to ip phones on the same network and the actual mac on the phone server is different as the phone server is at the DC and I have checked its mac address there.

Has anyone seen anything similar or have any ideas.

Thanks

[Carlos Villagran]

Hi!

Is there a way you can check the leased addresses from your DHCP server?

As per my understanding of the situation the server should have the 10.10.6.4 address, instead two phones are getting this IP, is this right?

Best Regards!

JC

[Mokhalil82]

Well it seems like that from the captures, but the server is at another site and the 10.10.6.0 subnet is not configured at the site where these phones are. These phones would be routed to the 10.q0.6.0 subnet.

The capture has only been taken from the site where the phone is.

This may not be what is causing the packet loss but its something to make sense out of

Thanks

[Carlos Villagran]

This is how I see it. The ARP request should not be happening there, the only way I can see that ARP should be happening is if the destination IP address were in the same subnet (This is perceived by the host based on its mask).  In this case, the phone may have a /8 mask and therefore it believes that 10.152.0.0 is actually in the same subnet.

Can you check the actual ARP table in the switch?

Is the 10.10.6.4 really configured in a4:25:1b:c5:79:d8? If this is true, maybe the issue is really about the DHCP assignated address.

BR.

JC

[Mokhalil82]

Ok that capture was a red herring. Not really related to the issue. After troubleshooting I have narrowed the issue at one site which has a voice gateway. The issue affects phones that use this gateway but not phones other gateways.

I have a core switch connected to an ASA on a stick setup so all voice traffic goes via the ASA.

The issue is load related as because when i moved a whole site to another server to reduce the traffic to this server, then the issue disappears. None of the links are fully utilized either. 

I was to take the firewall out the equation so want to troubleshoot here. 

Will disabling SIP inspection on the ASA help?