SX10 unable to make calls to another standalone SX10

[Bharadwaj GK]

We have 2 SX10 devices. Each in 2 different cities.   

From city A to City B calls reach but when it is answered no video or audio and call is automatically placed on hold.

From city B to City A call dont go out. 

Both VC's are on natted IP's and when we call using public ip's its the same result too. 

We have checked all ports on Firewall and are open i.e rule in the firewall has been set to any ports.

1. SIP messages - Port 5060 - UDP/TCP
2. SIP messages - Port 5061 - TLS(TCP)
3. H.245 - Port Range 5555 to 5574 – TCP/UDP
4. Audio/Video - Port Range 2326 to 2485 - UDP/TCP both
5. Q.931 call Setup - Port 1720 – TCP
6. Q.931 call Setup - Port 1719 – TCP
7. Q.931 call Setup - Port 1718 – TCP
8. HTTP - Port 80
9. HTTPS - Port 443

Also if we make calls from A to B or B to A it shows A's local (natted/source) IP to B and B's to A respectively, Ideally we are expecting it to show the source public IP.

Any help will be appreciated :) 

[Bharadwaj GK]

Thank you I have upgraded the SX10 unit to CE8.2 and configured H.323 as given in the configuration for SX20. Now I can receive calls from out side but when I dial an IP address the call disconnects in a second. It just attempts and fails with a message "cannot connect call"

Currently, no NAT being used. Its configured over a public IP and I am dialing a public IP.

Pls advice what changes are required. 

[Patrick Sparkman]

If the SX10 is using a public IP without NAT, meaning the endpoint is actually sitting on the public internet wide open, don't have NAT configured on the SX10 of it is. 

Also, it highly advisable to not leave the SX10 on the public internet, you should set it up behind your firewall. For testing purposes, it's fine as is, but to prevent inbound attacks on the endpoint, you'll want to restrict access to it and place it behind you're firewall. 

[Bharadwaj GK]

Thanks Partick, Its just for testing right now isolating issues 1 by 1. Now I can receive calls from out side but when I dial an IP address the call disconnects in a second. It just attempts and fails with a message "cannot connect call" is there something that we need to do now? Pls advice. 

[Patrick Sparkman]

You should check the endpoint logs under Maintenance > System Logs, it should provide some information as to why the call is failing.

Something that comes to mind, what is H323 NAT set to? You can try and turn that to Off if it's already, default it's set to Auto and sometimes that can cause the call to fail under certain scenarios.

[Bharadwaj GK]

NAT is set to off already by me. 

Maintenance -> Call Logs tell me the below things.

Disconnect cause Service Unavailable

Disconnect cause code 503 (SIP)
Disconnect cause type NetworkRejected
Occurrence type NoAnswer
Is acknowledged Acknowledged

from System logs is there a specific one that I should check?

[Nil Laskar]

Is it a SIP or H323 call you are trying? If it's SIP, NAT is not required. We need to have the logs for the call to check the actual reason. Could you please get the logs as per below (if SIP call) and send the output to me on nlaskar@cisco.com

Open Putty and go to Logging, select All session output, browse to destination folder, give a name and save it.
Login to the codec as user admin
Type xconfig
Type xstatus
Type log ctx sippacket debug 9
Type log output on
Make a call and recreate the issue.
Type xstatus couple of time in between the call (no worry even if the lines are scrolling)
Type log output off
Type log ctx sippacket debug off
Please send the saved file to us along with calling and called number information.

Regards

Nil Laskar

[Bharadwaj GK]

Hi Nil,

I have sent the logs requested please check and advice. 

[Nil Laskar]

Have you had a check on the following document:

http://www.cisco.com/c/en/us/support/docs/collaboration-endpoints/telepresence-system-ex-series/119014-technote-telepresence-00.html 

Regards

Nil Laskar

[Wayne DeNardi]

Technically you don't make an "IP" call, you either make a H.323 or SIP call, which goes over the IP network.

If you're just dialling an IP address, then this will be a H.323 call, as a plain IP address is not a valid SIP URI.

Wayne
--
Please remember to rate responses and to mark your question as answered if appropriate.

[Patrick Sparkman]

CE8.2 introduced H323 support for the SX10, it might help using H323 with NAT.  For firewall ports, refer the document Cisco (ex-TANDBERG) IP & SIP Firewall Ports.