SX20 standalone drops calls with WebEx CMR room after 12min

[Jeff Bull]

Good afternoon,

      I deployed two SX20's as standalone units, and have a new WebEx CMR account setup as well. When I make a call from one of the unit's to my personal CMR room (jbull@redwoodcu.webex.com), it establishes yet drops at exactly 12 minutes. Some background on our deployment as of today:

• Both SX20 end-point's connect to the internet through our Edge ASA (5510)
  • I've configured ACL entries to allow outbound calls from both unit's internal IP addresses to ANY via the following
  • TCP 80,389,443,1720,2776-2777,5060-5061
  • UDP 1721-1722,2326-2486,16384-32766,36000-59999
• Both SX20 end-point's are configured to use H323 in Direct mode
  • We do not have an VCS or other device acting as H323/SIP gateway
• Both SX20 end-point's are able to call each other, without any issues

I have an open TAC case on this, but wanted to see if anyone else might have experienced similar problems and have insight. Thanks in advance!

[George Thomas]

I would turn off SIP inspection on the ASA if not already.

[Jeff Bull]

George,

     Would that matter even if I have SIP Mode on the SX20 and can only dial out using H323? Also, are you referring to modifying the policy-map that has the inspect statements by removing "inspect sip"?

Ex:

policy-map global_policy
 description MCW connection timeouts
 class inspection_default
  inspect icmp
  inspect icmp error
  inspect ip-options
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
  inspect ipsec-pass-thru
  inspect pptp
  inspect dns migrated_dns_map_1

[George Thomas]

It shouldnt matter if you have SIP mode on. I am guessing you are dialing using SIP.

Correct, please remove inspect sip from the policy-map.

[Jeff Bull]

I've turned SIP Mode Off on the SX20, but regardless I am dialing to a WebEx CMR room using H323 (just ran another test and verified that it's the only option and that It was selected for the call to WebEx).

In that case, should I remove the inspect H323 statement(s)? What problem is that statement causing for the communication path?

[George Thomas · Accepted solution]

If you are using H323, yes then remove the H323 related commands. Out of curiosity, why are you not using SIP?

The ASA does deep packet inspection on the sessions, when media is flowing there are no packets flowing and the ASA sees that as a stale connection and disconnect the call. You will have to tweak the H323 settings if you would like to leave it on but thats more work than its worth (IMO).

[Jeff Bull]

Good question! For the moment, we have two SX20 end-points and are only using them to connect either directly (across the LAN) or to one of our WebEx CMR room's. Down the road we will be adding more end-points and will bring in a VCS; For now though I don't have a SIP gatekeeper to register with so we do these as direct dial calls.

That is damn good info!!! Thank you. Giving it a try now.

[nnah-inyang]

I am interested in this setup can u give me a more detailed step by step how you configured your SX20 standalone with CMR.

I will realy appreciate, this has been a challenge and pain on my neck.

Thanks in advance

[Jeff Bull]

Thanks again George, that did the trick. I've been able to maintain a call now for almost an hour after making the change.

[btmulgrew]

Hi Jeff - do you mind me asking how you managed to get SIP URI dialling to the CMR when using standalone / direct dial?  My understanding is we can only dial via IP address when standalone and CMR does not support SIP standalone endpoints. 

Thanks

Brian

[Patrick Sparkman]

You can dial a URI address using H323 as long as you're running TC5 software or later.  Which is what Jeff is doing above.  What codec and software version are you using, and how are you trying to dial into the CMR?

[btmulgrew]

Thanks Patrick - the customer is looking at:

1 x MX800

1 x MX300

1 x SX20

1 x SX10

All running the latest TC release.  So, tehcnically we should be ok across these for Annexe0 dialing with the exception of the SIP only SX10?

Thanks again

Brian

T

[Patrick Sparkman]

Correct, the SX10 to work standalone must call out using the format alias@IP.  You might be able to do a dns lookup of the CMR domain you're trying to dial into, and it might work by formatting the address as CMR_ID@CMR_IP, where CMR_IP is the CMR domain - just an off the wall theory, and completely untested.

Don't forget to rate helpful replies.

[btmulgrew]

Thanks Patrick