Solved: 403 Forbidden on Inbound Calls - Page 3

mumbles202 · ‎02-11-2021

Working on a new install of CUCM cube. ISR 4300 as the gateway. It's a pre-existing CUCM environment with a MGCP gateway is current PsTN access. Setup a trunk from CUBE to CUCM, CSS for the trunk includes the partition with the internal DNs, and DNA shows inbound calls should ring the extension. Outbound calls through the CUBE are working but inbound I seem to be getting a 403 from CUCM. I can upload the debug from the gateway but wondering if something I should be looking at on either the CUCM or VG side. I can post up the configuration from the VG as well.

TONY SMITH · ‎03-19-2021

Can you take debugs and post them up? Also current configuration as I think there have been a few changes.

debug ccsip mess
debug voip dialpeer inout

mumbles202 · ‎03-19-2021

Thanks for the reply. I'll work on getting the debug posted, but in reviewing what i had taken (debug ccsip messages/debug voip ccapi inout) the correct dial peer was selected for the outbound call leg to the CUCM.

After taking some packet captures on both interfaces I found that the CUBE was sending calls the invites to the CUCM outbound over the interface facing the ITSP using the outbound-proxy address configured in voice services voip. Once I removed that I had a couple of inbound calls hit the CUCM but then subsequent calls failed to hit the CUBE from the carrier.

Roger Kallberg · ‎03-19-2021

Like @TONY SMITH wrote please post your full configuration and output of those two debugs. When you do that please please post them as attached files.

From what you wrote in your last post it’s quite apparent that there is something not correct in your configuration. You stated that the correct dial peer to the CM was selected, but then the call somehow anyway sent towards your ITSP. This is quite frankly not possible with the correct configuration in place.

TONY SMITH · ‎03-22-2021

@Roger Kallberg wrote:

... You stated that the correct dial peer to the CM was selected, but then the call somehow anyway sent towards your ITSP. This is quite frankly not possible with the correct configuration in place.

I agree. We need to see the configuration as it is now.

For what it's worth the configuration previously shared has overlaps between inbound patterns for CUCM, and wildcard patterns for the PSTN. In that case if the CUCM returns a 404 not found, the call will be placed to the ITSP. This could be incorrect CUCM configuration, or an unassigned DDI.

mumbles202 · ‎03-23-2021

Totally understand. I'll post the config here. In the debugs you could see the correct dial-peer selected, but when I took a packet capture of the interfaces at the same time I was seeing the invite being sent to 2755@publisher_ip, but the destination ip was the ITSP. Once I removed the outbound-proxy under voice services voip that stopped, but then the VG lost registration and calls stopped hitting the gateway after a few minutes.

Here's the current configuration:

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.03.18 15:17:00 =~=~=~=~=~=~=~=~=~=~=~=
4321VG#sh run
Building configuration...


Current configuration : 6000 bytes
!
! Last configuration change at 00:27:50 CST Sat Mar 13 2021
!
version 16.6
service timestamps debug datetime msec localtime
service timestamps log datetime msec
service internal
service sequence-numbers
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname 4321VG
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
logging buffered 10000000
no logging console
no logging monitor
!
no aaa new-model
clock timezone CST -6 0
clock summer-time CST recurring
!
!
!
ip domain name mydomain.org
!
!
!
!
!
!
!
!
!
!
subscriber templating
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice service voip
 ip address trusted list
  ipv4 172.27.32..10
  ipv4 172.27.32..11
  ipv4 111.111.222.222
  ipv4 111.111.111.111
 address-hiding
 mode border-element 
 allow-connections sip to sip
 supplementary-service h450.12
 fax protocol t38 version 0 ls-redundancy 2 hs-redundancy 0 fallback pass-through g711ulaw
 h323
  h225 timeout ntf 50
  h225 display-ie ccm-compatible
  call start slow
  call preserve 
 sip
  outbound-proxy ipv4:111.111.111.111
!
!
voice class uri ITSP sip
 host ipv4:111.111.111.111
 host ipv4:111.111.222.222
!
voice class uri CUCM sip
 host ipv4:172.27.32..10
 host ipv4:172.27.32..11
voice class codec 1
 codec preference 1 g711ulaw
 codec preference 2 g729r8
!
voice class h323 1
  h225 timeout tcp establish 3
!
!
!
voice class e164-pattern-map 1
 description E164 Pattern Map for called number to CUCM
  e164 1234562755
  e164 99999999..
  e164 1234567[3-4]..
  e164 2755
 !
!
voice class e164-pattern-map 2000
 description E164 Pattern Map for called number to ITSP
  e164 0T
  e164 [2-9]..[2-9]......
  e164 [2-9]......
 !
!
voice class server-group 1
 ipv4 172.27.32..10 preference 1
 ipv4 172.27.32..11 preference 2
 description CUCM server group
!
voice class server-group 2000
 ipv4 111.111.111.111 preference 1
 ipv4 111.111.222.222 preference 2
 description ITSP server group
!
voice class sip-options-keepalive 1
 description Used for Server Group SIP OPTIONS PING
!
!
voice iec syslog
!
!
voice translation-rule 20
 rule 1 /^[89].....\(....\)$/ /\1/
!
!
voice translation-profile PSTN-IN
 translate called 20
!
!
!
!
voice-card 0/1
 no watchdog
!
license udi pid ISR4321/K9 
diagnostic bootup level minimal
spanning-tree extend system-id
!
!
!

!
redundancy
 mode none
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0/0
 ip address dhcp
 negotiation auto
!
interface GigabitEthernet0/0/1
 ip address 172.27.32..8 255.255.255.0
 negotiation auto
!
interface Service-Engine0/1/0
!
interface GigabitEthernet0
 vrf forwarding Mgmt-intf
 no ip address
 negotiation auto
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http client source-interface GigabitEthernet0/0/1
ip route 10.145.24.0 255.255.254.0 172.27.32..1
ip route 172.16.19.0 255.255.255.0 172.27.32..1
!
!
!
!
!
!
control-plane
!
!
voice-port 0/1/0
!
voice-port 0/1/1
!
voice-port 0/1/2
!
voice-port 0/1/3
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
sccp local GigabitEthernet0/0/1
sccp ccm 172.27.32..10 identifier 1 version 7.0 
sccp ccm 172.27.32..11 identifier 2 version 7.0 
sccp
!
sccp ccm group 1
 associate ccm 1 priority 1
 associate ccm 2 priority 2
 switchover method immediate
!
!
!
dspfarm profile 2 transcode  
 associate application CUBE
 shutdown
!
dspfarm profile 1 mtp  
 codec g711ulaw
 codec pass-through
 maximum sessions software 200
 associate application CUBE
!
dial-peer voice 1 voip
 description Incoming calls from ITSP
 translation-profile incoming PSTN-IN
 session protocol sipv2
 incoming uri via ITSP
 voice-class codec 1  
 voice-class sip bind control source-interface GigabitEthernet0/0/0
 voice-class sip bind media source-interface GigabitEthernet0/0/0
 dtmf-relay rtp-nte digit-drop
 no vad
!
dial-peer voice 5 voip
 description Incoming calls from CUCM
 session protocol sipv2
 incoming uri via CUCM
 voice-class codec 1  
 voice-class sip bind control source-interface GigabitEthernet0/0/1
 voice-class sip bind media source-interface GigabitEthernet0/0/1
 dtmf-relay rtp-nte sip-kpml
 no vad
!
dial-peer voice 11 voip
 description Outgoing calls to CUCM
 session protocol sipv2
 session server-group 1
 destination e164-pattern-map 1
 voice-class codec 1  
 voice-class sip options-keepalive profile 1
 voice-class sip bind control source-interface GigabitEthernet0/0/1
 voice-class sip bind media source-interface GigabitEthernet0/0/1
 dtmf-relay rtp-nte sip-kpml
 fax-relay sg3-to-g3
 fax rate 14400
 fax nsf 000000
 fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none
 no vad
!
dial-peer voice 15 voip
 description Outgoing calls to ITSP
 session protocol sipv2
 session server-group 2000
 destination e164-pattern-map 2000
 voice-class codec 1  
 voice-class sip options-keepalive profile 1
 voice-class sip bind control source-interface GigabitEthernet0/0/0
 voice-class sip bind media source-interface GigabitEthernet0/0/0
 dtmf-relay rtp-nte digit-drop
 no vad
!
!
gateway 
 timer receive-rtp 1200
!
sip-ua 
 credentials username 1234562755 password 7 455354567B101F504F5643 realm 111.111.222.222
 authentication username 1234562755 password 7 455354567B101F504F5643 realm 111.111.222.222
 retry invite 2
 retry response 3
 retry register 4
 timers expires 300000
 registrar ipv4:111.111.222.222 expires 3600
 sip-server ipv4:111.111.222.222
 host-registrar
!
!
line con 0
 transport input none
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 login local
 transport input ssh
line vty 5 15
 login local
 transport input ssh
!
ntp server 129.6.15.28
ntp server 129.6.15.29
wsma agent exec
!
wsma agent config
!
wsma agent filesys
!
wsma agent notify
!
!
end

4321VG#

TONY SMITH · ‎03-23-2021

OK that makes sense. You can enable the proxy globally in voice service, but disable it on individual dial peers.

dial-peer voice 11 voip
 no voice-class sip outbound-proxy

TONY SMITH · ‎03-23-2021

I'd still prefer something to firmly differential between CUCM bound calls and ITSP bound. For example at the moment any 10 digit pattern starting 99999999 matches rules from both dial peers ...

voice class e164-pattern-map 1
 description E164 Pattern Map for called number to CUCM
  e164 1234562755
  e164 99999999..
  e164 1234567[3-4]..
  e164 2755
 !
!
voice class e164-pattern-map 2000
 description E164 Pattern Map for called number to ITSP
  e164 0T
  e164 [2-9]..[2-9]......
  e164 [2-9]..

First one in pattern map 1 is the more specific match, but it will follow the less specific match if the preferred dial peer is out of service or the call fails in certain ways.

I've taken to using Class of Restriction to ensure that calls inbound from ITSP can route only to CUCM, and vice versa.

Roger Kallberg · ‎03-23-2021

Totally agree with @TONY SMITH on this. You should not have overlap matches with your dial peers. As an option to CoR I would suggest DPG. This is what we nowadays normally use when we'd want to hard code the defined path from the inbound dial peer to use a specific set of outbound dial peer(s).

For example if the inbound dial peer is DP 1 and the outbound is 10 you add this configuration.

voice class dpg 1
 dial-peer 10
!
dial-peer voice 1 voip
 destination dpg 1

For more information on DPG and dial peer matching in general take a look at my favorite document. In Depth Explanation of Cisco IOS and IOS-XE Call Routing - Cisco

mumbles202 · ‎03-25-2021

Thanks for this. Implemented that as well and will review the document in depth and possibly incorporate that into future builds.

mumbles202 · ‎03-25-2021

Thanks, if only there was a way to award more than 5 points. That worked like a charm.

TONY SMITH · ‎03-26-2021

No problem. I can't believe I missed the proxy in your first configuration.