Unable to get IP Phones to Register with CME

[jameskuder]

I am currently using a 2811 router with CME. I have a 24 port Cisco 3560. As for the DHCP, we are using our Juniper SSG5 firewall to provide the addressing. This is the same setup that we have working at other sites. I have went through the configs and compared them to the working setups and it all looks fine. I am now sure what else to try. This is a new build for me. The others were built by a vendor. Any assistance is appreciated!

[jyoung]

Is the DHCP scope handing out option 150 to the phones so they know where to register?  Are the phones SCCP or SIP?

[jameskuder]

Yes, option 150 is setup and the phones are SCCP...specifically, 6921 and 7962G

[jyoung]

Can you verify on the phone it is getting an ip and cme ip?

[jyoung]

Jim let me know via email that the phone is not getting an IP

[jyoung]

Is the 3560 being used as a layer 3 switch?

[jyoung]

Do you have an ip helper address on the vlan interface for the phone vlan?

[jyoung]

On the vlan interface:  

Ip helper-address xxx.xxx.xxx.xxx

Where xxx is the ip address of the firewall (dhcp server)

[gavenm10240]

First I would verifiy the following:

1.     Unplug and plug back the IP Phone and observ the registration process.

check if the IP Phone  is getting DHCP, IP Address, TFTP (CallManager Address) and check the default router address. All this you can check on the IP PHONE settings.

2.     Run "debug tftp events" then unplug and plug back the IP Phone. On the debug screen you suppose to see the phone registration process and what the IP phone is looking for durring registration.

3.     Make sure that the IP Phone is configured on the voice vlan on the switch.

It would be much easier if you can supply the swicth configuration of the IP Phone and the CME configs with a copy debug "tftp events"

Goodluck!

[jameskuder]

I have attached the configs. I do not get anything on the debug. FE0/0 of the 2811 router is connect to port Fa0/24 of the 3560 switch. Port Fa0/23 of the 3560 is connected to port eth0/5 of the Juniper SSG5 Firewall which is configured for the voice vlan and is also setup as the DHCP server with option 150. The phone is currently connected to port Fa0/9 of the 3560

[gavenm10240]

Well based on your setup, try and PING the voice vlan (vlan 5) from the switch.

1.     Is VLAN 5 configured on the Juniper router and is it up?

2.     Can you ping vlan 5 from the 2811 router and from the switch

3.     I port 5 on the Juniper router UP  UP?

[jameskuder]

1. Yes

2. Yes

3. Yes

I did find that I cannot ping from the router to the switch

[rebeccamcbride]

James, I have been trying for days to get SCCP to work through the SSG5 firewall. The juniper tech support team keeps telling me it will not work. I have CME on a 2811 router and have phones on both sides of the SSG5. I can make SIP calls no problem, but when I change the phone inside the firewal to SCCP I get one way audio - no audio from outside the SSG5. The SSG5 is not translating the MIP address of the internal phone, have you seen this issue? Any thoughts will be greatly appreciated.

[jyoung]

Jim,

Does the phone still not have an IP address?  If it does not, you  may need to do some troubleshooting on the Juniper firewall.  If it is on the same vlan as the phones and has dhcp enabled on it, there is an issue with it handing out addresses.  Did you try plugging a pc into the phone vlan to see if it gets and address?  According to your configs, the Firewall is on Vlan1 and the Phones are on VLAN5.  You need to put an IP address on the VLAN 5 interface and an IP helper address to the ip of the Firewall for it to work that way.

[jyoung]

Any update on this Jim?