VCS Expressway Failed to Connect

[Rhonda Shepard]

Hi,

I have just set up a VCS Control and a VCS Expressway. I have set up the traversal client on the VCS Control using port 6001 H.323 and 7001 SIP.  I have set up the traversal server on the VCS Exp using the same ports.  I keep getting "H.323 Failed to connect to x.x.x.x:6001 no response from system".

The SIP will not connect either "connection failed".

There is not access list from the VCS Control to the VCS Expressway.  Authentication is turned off.  They are both pointed to the same NTP.

Any ideas?

Thanks!!

[awander]

What kind of firewall is between teh E and teh ?

Do you have the ports opened?

If an "H.460-aware" firewall, is that turned OFF?

Andy

[Rhonda Shepard]

Hi Andy,

It is an ASA 5550. All ports are open from the internal VCS to the VCS Exp. The ASA does not support H.460 so the traffice should just pass through.

Rhonda

[samuel.gay]

Last time that I got this error it was just an mismatch with the password between VCS-C and VCS-E ...

[Rhonda Shepard]

Samuel,

I reset the passwords and they match....that didn't seem to be the issue.

Rhonda

[awinter2]

Hi Rhonda,

when you are seeing 'No response from system' on H323 and 'Failed to connect' for SIP in the zone status on the VCS Control, then this is normally accurate information. For SIP, it means that the VCS-C was unable to set up a TCP connection towards the specified port and IP address of the VCS Expressway, and for H323 it means that the VCS Control has sent a UDP-based keepalive prope towards the VCS Expressway without getting any response.

Are you absolutely sure that traffic on these ports is allowed from the Control to the Expressway in the ASA? Are there no other devices with packet filtering capabilites in between the Control and Expressway? Have you tried disabling H323 and SIP inspection in the ASA?

Best regards

Andreas

[Rhonda Shepard]

Andreas,

I have watched over the network admin's shoulder and I see that all of the ports are open from the VCS-C to the VCS-E.  There are no other devices between the VCS's except the ASA.  I just had him disable the H.323 and SIP inspection and this didn't work either.

I appreciate everyone's help!  Keep the ideas coming please!

Thanks!

Rhonda

[awinter2]

Rhonda,

could you attach the xconf and xstat output from both the VCS-C and VCS-E please?

Thanks,

Andreas

[Rhonda Shepard]

Thanks Andreas, Here they are:

Info removed

[Rhonda Shepard]

Here is the expressway.

Info Removed

[awinter2 · Accepted solution]

Rhonda,

at a glance, the configuration looks OK. Can you clarify what other types of layer 3 devices exist between the VCS-C and VCS-E apart from the ASA?

If firewalling is not the issue, the problem could be caused by routing problems. If you allow ICMP from the Control towards the Expressway, you can check if routing works by logging in as root (With SSH) to the VCS-C and issuing the command

traceroute x.x.x.x

where x.x.x.x is the IP address of your Expressway.

Thanks,

Andreas

[Rhonda Shepard]

It turned out to be a firewall issue, the engineer had to engage Cisco TAC.  I am trying to get the details of the problem and I will post them back here for reference.

Thanks so much for your help!

[mikecrowe4ICS_2]

Rhonda --

Any update on the details for the firewall issue that was causing the problem?  We've got a new VCS-C/VCS-E setup, and I'd like to make sure I don't end up with the same issue.

Thanks!

[awander · Accepted solution]

Rhonda:

You can rule out the firewall by temporarily putting the expressway on your inside network, and seeing if the connection works.

Andy Wander, CTS, TCE I / TCE II

Vice President, Engineering

Verrex Corporation

Americas Headquarters

1130 Route 22 West

Mountainside, NJ 07092 USA

Direct: +1 908 664 8353

Tel: +1 908 232 7000

Mobile: +1 610 389 4819

awander@verrex.com

www.verrex.com<>

EMEA/Verrex Limited: +44 (0) 1992 667 000

Asia Pacific/Verrex Asia Limited: +852 3713 4200

Global Conferencing & Communication Solutions

New York | Boston | Tampa | Toronto | London | Mumbai | Singapore | Hong Kong | Shanghai | Sydney

Please join us in working & living environmentally responsibly. Consider the environment before printing this email.