VCSE not passing calls to a registered Polycom HDX9000

[George wiley]

Hi All:

I have a VCSE that is outside the firewall with an EX90, C40, and Polycom HDX 9000 registered to it from inside the firewall.

I can make calls to external system from any of the three systems.

I can make both SIP and H.323 calls from the outside to either the EX90 or C40.

I can not make either SIP or H.323 calls to the Polycom HDX 9000 from the outside.

I also can not make either SIP or H.323 calls from either the EX90 or C40 to the Polycom.

Here is a Search History result of call the Polycom from an outside EX60. I removed specific IP address data for security reasons.

Any help would be very appreciated.

• Search (191)
  
• • 
    
  • State: Completed
    
  • Found: False
    
  • Reason: Temporarily Not Available
    
  • Type: SIP (INVITE)
    
  • CallSerial Number: 8eeaadaa-af1e-11e1-b818-0010f32009dc
    
  • Tag: 8e36a21a-af1e-11e1-80e2-0010f320f466
    
  • StartTime: 2012-06-05 09:55:58
    
  • Duration: 10.18
    
  • Source (1)
    
    • Authenticated: False
      
    • Aliases (1)
      
      • Alias (1)
        
        • Type: Url
          
        • Origin: Unknown
          
        • Value: EX60GW@64.Removed address for security
          
    • Zone (1)
      
      • Name: DefaultZone
        
      • Type: Default
        
    • Path (1)
      
      • Hop (1)
        
        • Address: 64.Removed address for security:5060
          
      • Hop (2)
        
        • Address: 127.0.0.1
          
  • Destination (1)
    
    • Alias (1)
      
      • Type: Url
        
      • Origin: Unknown
        
      • Value: sip:279@vcse.Removed address for security.com
        
  • SubSearch (1)
    
    • Type: Transforms
      
    • Action: Not Transformed
      
    • ResultAlias (1)
      
      • Type: Url
        
      • Origin: Unknown
        
      • Value: 279@vcse.Removed address for security.com
        
    • SubSearch (1)
      
      • Type: Admin Policy
        
      • Action: Proxy
        
      • ResultAlias (1)
        
        • Type: Url
          
        • Origin: Unknown
          
        • Value: 279@vcse.Removed address for security.com
          
      • SubSearch (1)
        
        • Type: FindMe
          
        • Action: Proxy
          
        • ResultAlias (1)
          
          • Type: Url
            
          • Origin: Unknown
            
          • Value: 279@vcse.Removed address for security.com
            
        • SubSearch (1)
          
          • Type: Search Rules
            
          • SearchRule (1)
            
            • Name: Local zone - no domain
              
            • Zone (1)
              
              • Name: LocalZone
                
              • Type: Local
                
              • Protocol: SIP
                
              • Found: False
                
              • Reason: Not Found
                
              • Gatekeeper (1)
                
                • Address: 173.(Rest of address removed for security):0
                  
                • Alias (1)
                  
                • Type: E164
                  
                • Origin: Unknown
                  
                • Value: 279
                  
                • Type: E164
                  
                • Origin: Unknown
                  
                • Value 279
                  

  • Zone (2)
    
    • Name: LocalZone
      
    • Type: Local
      
    • Protocol: H323
      
    • Found: False
      
    • Reason: Unreachable destination
      
    • Gatekeeper (1)
      
    • • Address: 173.(Rest of address removed for security
        
      • Alias (1)
        
      • Type: E164
        
      • Origin: Unknown
        
      • Value: 279
        

[awinter2]

Hi George,

what brand/model firewall are you using? Is this firewall H323-aware?

It would be nice if you can verify by looking at the registration page for the HDX what type of firewall traversal protocol is being used for the HDX registration, but I assume that the HDX is registered to the VCS-E using H.460 firewall traversal, while the EX90 and C40 are registered using Assent.

The 'Unreachable destination' reason indicates a network/firewall issue, so I would check if any H323/SIP ALG/inspection is available and enabled in the firewall that you are using.

If you are able to register the HDX to the VCS-E using SIP TLS it would also be interesting to know what the result is if you attempt to place a SIP call from the EX90 or C40 to the HDX when all of the devices are registered with SIP TLS (Since it is less likely, although still possible with certain firewalls, that the firewall will be performing ALG/inspection when using encrypted SIP).

Also, is there any NAT between these endpoints and the VCS-E?

[George wiley]

Thank you very much for your reply and advice.

I will investigate the answers to your questions tomorrow.

I do know the EX90 and C40 use Assent to register to the VCSE. Should I change Assent to H.460?

George

George Wiley

George Wiley Consulting Group, Inc

29 Commerce Drive

Bedford, NH 03110

P: 603-512-9271

F: 603-878-9151

web: www.wileycg.com

Video IP: 74.10.86.21

ISDN: 603-391-3000

Audio/Video & Videoconferencing Solutions

[George wiley]

Hi Andreas,

The firewall is a Cisco ASA 5505.

Yes the Polycom is using H.460 and the two Cisco endpoints are using Assent.

I can not get the Polycom to register as a SIP device. I disabled the H.323 gatekeepers settings, enabled SIP settings, set the Transport Protocol from Auto to TLS and rebooted the Polycom.

The Polycom would not register as a sip device nor as an H.323 device.

I re-enabled the H.323 settings and the Polycom registered as an H.323 device.

I also registered the Polycom to and other VCSE on at my office which is a completely different network.

The Polycom acted the same. It would make calls out but would not accept inbound calls.

From what I am being told, NAT is not in use.

Again thanks for any help.

George

George Wiley

George Wiley Consulting Group, Inc

29 Commerce Drive

Bedford, NH 03110

P: 603-512-9271

F: 603-878-9151

web: www.wileycg.com

Video IP: 74.10.86.21

ISDN: 603-391-3000

Audio/Video & Videoconferencing Solutions

[Garvan Long]

Hi

Have you taken a diagnostic trace or a netlog of the SIP registration of the Polycom. It may not register as the URI configuration on the Polycom is incorrect and does not match a configured SIP domain on the VCS?

Do you even see the registration attempt appear on the VCSE if not can you telnet to the vcse IP address  for port 5061 from outside your network

Garvan

[George wiley]

HI Garvan,

The Polycom, for some reason, does not register to the VCSE as SIP only as H.323.

Can you tell me how to take a diagnostic trace or a netlog?

Thanks

George

George Wiley

George Wiley Consulting Group, Inc

29 Commerce Drive

Bedford, NH 03110

P: 603-512-9271

F: 603-878-9151

web: www.wileycg.com

Video IP: 74.10.86.21

ISDN: 603-391-3000

Audio/Video & Videoconferencing Solutions

[Garvan Long]

Hi George if you are on version X7 tracing is enabled from the Maintenance menu. If you are on earler versions the traces are taken from the commad line of the tandberg admin login using the netlog command. If you are not familar with tracing i suggest that you engage your support parther or the Cisco TAC to gudie you through this.

Logging will place and impact on the processor of the VCS and you need to ensure that you stop logging when completed.

There is also a VCS troubleshooting guide:

http://www.cisco.com/en/US/docs/telepresence/infrastructure/vcs/troubleshooting/Cisco_VCS_Troubleshooting_Procedures.pdf

[George wiley]

Hi Garvan,

I tried to develop a solid environment that would allow comparative test calls from my EX60 to a C40 that I am able to connect to and the Polycom HDX 9000 which I cannot connect to.

My calling system is a Cisco EX60 and is registered to a VCSE at my calling location.

The C40 and the Polycom are at another location registered to that locations VCSE.

The C40 has an E.164 alias of 285. The Polycom has an E.164 alias of 279.

For my test I

1) neighbored the two VCSE’s.

2) I enabled a log trace on my VCSE

3) Called alias 285.

4) Call was successful

5) I stopped the log and copied the log to a word file

6) I enabled a log trace on my VCSE

7) Called alias 279

8) Called failed

9) I stopped the log

10) I copied the log to a word file.

I then compared the two logs.

I followed both logs until I found a wording difference.

The successful log reads:

Jun 8 09:12:14 Wileycg-VCSE UTCTime="2012-06-08 13:12:14,50" Module="developer.licensemanager.service.manager" Level="INFO" CodeLocation="licensemanager(133)" Detail="License granted" local_call_id="903709e8-b16b-11e1-9d00-0010f320f466" lic_type="traversal"

Jun 8 09:12:14 Wileycg-VCSE licensemanager: Level="INFO" Detail="License granted" local_call_id="903709e8-b16b-11e1-9d00-0010f320f466" lic_type="traversal" UTCTime="2012-06-08 13:12:14,50"

The unsuccessful log reads:

Jun 8 09:14:07 Wileycg-VCSE tvcs: UTCTime="2012-06-08 13:14:07,645" Module="developer.sip.transaction" Level="INFO" CodeLocation="ppcmains/sip/siptrlay/siptranssfsm.cpp(812)" Method="::SIPTRANS_doSipTrnspHandleMsgExcpt" Thread="0x7fbf1a2d9700": SipTrans(nn=2) Got EOF, but have retransmitted already 1 times, ignoring

Does this wording provide any clues as to why I can not connect to the Polycom?

Thanks for any help

George

George Wiley

George Wiley Consulting Group, Inc

29 Commerce Drive

Bedford, NH 03110

P: 603-512-9271

F: 603-878-9151

web: www.wileycg.com

Video IP: 74.10.86.21

ISDN: 603-391-3000

Audio/Video & Videoconferencing Solutions