Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Tim Harman
Stats
Member since
11-11-2013
13
Posts
0
Helpful
0
Solutions
Created by
Tim Harman
in ATAs, Gateways and Accessories
in ATAs, Gateways and Accessories
05-09-2019
12:17 PM
05-09-2019
12:17 PM
Hi Jorge, Yes, I've rebooted a number of times after installing the root CA and I'm not having any problems. I no longer even host the certificate on my website, and rebooting it still works. What does it show at the bottom of the Voice screen, does it show provisioned OK and what the root CA is?
... View more
Created by
Tim Harman
in ATAs, Gateways and Accessories
in ATAs, Gateways and Accessories
05-08-2019
03:06 PM
05-08-2019
03:06 PM
Hi Jorge, I only used the root certificate in the end - adding in an intermediate caused all sorts of problems (it didn't work) Try that - post back if it doesn't work or you have issues, I spent a lot of time debugging this so can offer you pointers to help debug further if you're stuck.
... View more
Created by
Tim Harman
in ATAs, Gateways and Accessories
in ATAs, Gateways and Accessories
04-27-2019
07:23 PM
04-27-2019
07:23 PM
Thanks again. I swear I tried that yesterday and it didn't work, but I must have had the wrong root CA or not done it correctly, because as soon I tried it this time, it worked straight away!! THANK YOU
... View more
Created by
Tim Harman
in ATAs, Gateways and Accessories
in ATAs, Gateways and Accessories
04-27-2019
03:02 AM
04-27-2019
03:02 AM
Really appreciate your prompt reply in pointing me in the right direction, however, I'm still stuff. I've created a CA file, with both the root CA and the intermediate CA file in it. OpenSSL tells me it's valid if I force it to use that file as the CA: [21:56:03] root :: micro ➜ /var/www/micro » openssl s_client -CAfile ./chatterbox.pem -connect tls.2talk.co.nz:5061 | grep return depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA verify return:1 depth=1 C = US, O = GeoTrust Inc., CN = RapidSSL SHA256 CA verify return:1 depth=0 CN = tls.2talk.co.nz verify return:1 Verify return code: 0 (ok) I've uploaded this (via http) to the Cisco SPA112. I see it collecting the file: 192.168.0.10 - - [27/Apr/2019:21:55:15 +1200] "GET /chatterbox.pem HTTP/1.1" 200 3089 "-" "Cisco/SPA112-1.4.1(SR3) (CCQ173101N7)" I see in the Information section right at the bottom of the SPA112 Information screen: Custom CA Status Custom CA Provisioning Status: Last provisioning succeeded on 04/27/2019 21:55:13 Custom CA Info: Installed - /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA Yet still it fails. This time it fails with Err code 2, which to me indicates that it isn't reading in the Intermediate CA certificate. But it's there, you can view the CA file here: http://micro.muppetz.com/chatterbox.pem I've also changed the order of the two certs, in case it wanted the Root First then the Intermediate, or the other way around. Still always Err 2: Apr 27 22:00:07 chatterbox [0: 0]SIP/TCP:Connecting(12)... Apr 27 22:00:07 chatterbox [0: 0]SIP/TCP:Connecting(12)... Apr 27 22:00:07 chatterbox [0: 0]SIP/TCP:Connect=0 Apr 27 22:00:07 chatterbox [0: 0]SIP/TCP:Connect=0 Apr 27 22:00:07 chatterbox [0: 0]SIP/TLS:Connecting(12)... Apr 27 22:00:07 chatterbox [0: 0]SIP/TLS:Connecting(12)... Apr 27 22:00:07 chatterbox ssl cert err 2 Apr 27 22:00:07 chatterbox [0: 0]SIP/TLS:Connect=-1 Apr 27 22:00:07 chatterbox [0: 0]SIP/TLS:Connect=-1 Apr 27 22:00:07 chatterbox [0: 0]SIP/TLS:Connect Failed Apr 27 22:00:07 chatterbox [0: 0]SIP/TLS:Connect Failed Is there some other knob/setting I've got to hit here? Thanks!
... View more
Created by
Tim Harman
in ATAs, Gateways and Accessories
in ATAs, Gateways and Accessories
04-26-2019
09:30 PM
04-26-2019
09:30 PM
Hi, My Cisco SPA112 has been working great with my provider, until the new firmware released a few days ago, 1.4.1SR3. It was on SR1 previous. The new SR3 has been created it seems to fix a problem where bad actors could submit a false/bad certificate for the TLS session. But now I can't establish a SIP session to my provider using TLS anymore, I've had to downgrade back to UDP to get it to work. My provider is 2talk, a well known New Zealand SIP provider. Here's a log of an SSL tester against their server tls.2talk.co.nz Testing server defaults (Server Hello) TLS extensions (standard) "renegotiation info/#65281" "session ticket/#35" "heartbeat/#15" Session Ticket RFC 5077 hint 300 seconds, session tickets keys seems to be rotated < daily SSL Session ID support yes Session Resumption Tickets: yes, ID: yes TLS clock skew Random values, no fingerprinting possible Signature Algorithm SHA256 with RSA Server key size RSA 2048 bits Server key usage Digital Signature, Key Encipherment Server extended key usage TLS Web Server Authentication, TLS Web Client Authentication Serial / Fingerprints 70CBFCC2A2BA4D48D15226C757BD6CDE / SHA1 02624ACFBC81C2C21DA23D3FB5DA275E791FE61B SHA256 FD1B1B042D4CBEC1F5B46C974ADECE7FA9E530AFB8E788B6B9AF77A60EC4E80E Common Name (CN) tls.2talk.co.nz subjectAltName (SAN) tls.2talk.co.nz Issuer RapidSSL SHA256 CA (GeoTrust Inc. from US) Trust (hostname) Ok via SAN and CN (same w/o SNI) Chain of trust Ok EV cert (experimental) no "eTLS" (visibility info) not present Certificate Validity (UTC) 145 >= 60 days (2016-07-21 12:00 --> 2019-09-20 11:59) # of certificates provided 2 Certificate Revocation List http://gp.symcb.com/gp.crl OCSP URI http://gp.symcd.com OCSP stapling not offered OCSP must staple extension -- DNS CAA RR (experimental) not offered Certificate Transparency yes (certificate extension) You can see both the certificate itself and the SNI are the same value. However, in the logs of the Cisco SPA112 when I try to establish a TLS session, I get the following: Apr 26 22:12:58 chatterbox [0]SIP/TCP NewLocalPort:5078 Apr 26 22:12:58 chatterbox [0]SIP/TCP NewLocalPort:5078 Apr 26 22:12:58 chatterbox [0: 0]SIP/TCP:Connecting(12)... Apr 26 22:12:58 chatterbox [0: 0]SIP/TCP:Connecting(12)... Apr 26 22:12:58 chatterbox [0: 0]SIP/TCP:Connect=0 Apr 26 22:12:58 chatterbox [0: 0]SIP/TCP:Connect=0 Apr 26 22:12:58 chatterbox [0: 0]SIP/TLS:Connecting(12)... Apr 26 22:12:58 chatterbox [0: 0]SIP/TLS:Connecting(12)... Apr 26 22:12:58 chatterbox ssl cert err 20 Apr 26 22:12:58 chatterbox [0: 0]SIP/TLS:Connect=-1 Apr 26 22:12:58 chatterbox [0: 0]SIP/TLS:Connect=-1 Apr 26 22:12:58 chatterbox [0: 0]SIP/TLS:Connect Failed Apr 26 22:12:58 chatterbox [0: 0]SIP/TLS:Connect Failed Apr 26 22:12:58 chatterbox RSE_DEBUG: getting alternate from domain:tls.2talk.co.nz Apr 26 22:12:58 chatterbox RSE_DEBUG: All server is down:43 Apr 26 22:12:58 chatterbox RSE_DEBUG: Domain: tls.2talk.co.nz, type=SRVHOST Apr 26 22:12:58 chatterbox RSE_DEBUG: Total Address:1, up addr:0, ref id:0, ref cnt:1 Apr 26 22:12:58 chatterbox RSE_DEBUG: Current addr:NULL Apr 26 22:12:58 chatterbox RSE_DEBUG: curr timestamp::42757, pri:600, scnd:600 Apr 26 22:12:58 chatterbox RSE_DEBUG: pri:0, addr: 27.111.14.65:5061, status=DOWN, visited=TRUE, ttl=102757, pri=PRIM Apr 26 22:12:58 chatterbox [0]SIP/TCP Backoff 1000 ms Does anyone have any suggestions? I assume Cisco is using OpenSSL here, and from a bit of Googling (so maybe incorrect) an error 20 is: verify error:num=20:unable to get local issuer certificate But every other unix system I have connects to tls.2talk.co.nz:5061 just fine: {16:28}~ ➭ openssl s_client -connect tls.2talk.co.nz:5061 CONNECTED(00000003) depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA verify return:1 depth=1 C = US, O = GeoTrust Inc., CN = RapidSSL SHA256 CA verify return:1 depth=0 CN = tls.2talk.co.nz verify return:1 --- Certificate chain 0 s:/CN=tls.2talk.co.nz i:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA 1 s:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA --- What's going on? Is 1.4.1(SR3) buggy?? This was working fine in 1.4.1(SR1)
... View more
04-27-2016
02:29 PM
I realise I'm dragging up a 5 year old threat, but I've been searching and I can't find anything.
This solution doesn't work anymore. Even though I am giving it the correct username and password, the html I get returned is the login screen. If I change the xuser or xpassword, I get given a 401. So the user/pass is being accepted, but I'm still not passing some other form of authentication.
I have firmware 1.2.6
Anyone have a solution for this?
... View more
Created by
Tim Harman
in Small Business Routers
in Small Business Routers
12-15-2013
06:21 PM
12-15-2013
06:21 PM
Hi, I have a SRP527-U running 1.2.6 Firmware. I have a supported USB Stick 3G and it's working fine. I am using the Voice Module of the SRP for Phone services. The problem I face is that Mobile data is quite expensive, therefore I'd like to ensure that under a failure scenario (that is, the ADSL Link is down) that only the Voice Module gets Internet access via the 3G connection, but standard Web Browsing etc for the end users fails. Is this something that's possible? The Source IP address of the Voice Module isn't obvious to me - is it always the active WAN IP address? Is it an Internal IP that's NAT'd? Is what I'm trying to do even possible, or is this outside the capabilities of this device? Kind Regards, Tim
... View more
Labels:
Created by
Tim Harman
in Small Business Routers
in Small Business Routers
12-15-2013
06:14 PM
12-15-2013
06:14 PM
Hi, I have a SRP527-U running 1.2.6 . I have a simple setup, a ADSL connection to the Internet and a bunch of PC's behind that with Internet access. I've setup a host on the same VLAN as the other devices and I've set it up running squid. What I'd like to do is use the Policy Based Routing function to force all users trying to browse the Internet through that squid instance. That is Source of 192.168.0.20/32 Port 80 -> Policy Based Route to Destination of 192.168.0.50 port 3128 Is that possible with this device, or is that outside of its capabilities? I've looked at the PBR section, but it seems to imply forcing all traffic out through a WAN Interface which isn't what I want to achieve. Kind Regards, Tim
... View more
Labels:
Created by
Tim Harman
in Small Business Routers
in Small Business Routers
12-09-2013
12:13 PM
12-09-2013
12:13 PM
Just in case anyone else is reading this, I can confirm this does work! My only issue is that the web interface is now rather slow when accessed remotely, but otherwise it's working great.
... View more
Created by
Tim Harman
in Small Business Routers
in Small Business Routers
12-08-2013
02:14 PM
12-08-2013
02:14 PM
Thanks David, I thought that might be the case. No worries with support from Telstra, this was a 2nd hand purchase being used as a home ADSL/VoIP device. Last question if you wouldn't mind - if I do put the 1.2.x firmware on it but don't like it etc, downgrading is possible? Assuming I do the factory reset as you mentioned again? Kind Regards, Tim
... View more
Created by
Tim Harman
in Small Business Routers
in Small Business Routers
12-08-2013
09:59 AM
12-08-2013
09:59 AM
Hi, I've bought a SRP527W. Looking at the info for it, it's a SRP527W-K9-G4-TLS This is the "Telstra" model with 128Mb DRAM and 64 Mb Flash. Does anyone know if it can run the -U firmware? That is the 1.2.x firmware for these SRPs? Would be glad if it can, but I don't want to flash it to it in case it breaks. It has the upgraded hardware, but not the "U" in the hardware name.
... View more
Labels:
Created by
Tim Harman
in ATAs, Gateways and Accessories
in ATAs, Gateways and Accessories
11-12-2013
09:30 AM
11-12-2013
09:30 AM
Is there any way to get the Line 1 status from the web page without having to login? Or is there a way to login programatically using wget etc?
... View more
Created by
Tim Harman
in ATAs, Gateways and Accessories
in ATAs, Gateways and Accessories
11-11-2013
08:19 PM
11-11-2013
08:19 PM
Hi, I have a Cisco SPA112, though this would apply to the Cisco SPA122 as well. It has the latest 1.3.2 firmware on it. I want to monitor the status of Line 1. If I changes to being Unregistered, I want to know. How are people doing this at the moment? I can SNMP walk the device, but I can't see an obvious OID there that gives me the status. How are people monitoring the status of their ATA's? Thanks! Tim
... View more
Created by
Tim Harman
in ATAs, Gateways and Accessories
05-09-2019
05-09-2019
Hi Jorge, Yes, I've rebooted a number of times after installing the root
CA and I'm not having any p...
Created by
Tim Harman
in ATAs, Gateways and Accessories
05-08-2019
05-08-2019
Hi Jorge,I only used the root certificate in the end - adding in an
intermediate caused all sorts of...
Created by
Tim Harman
in ATAs, Gateways and Accessories
04-27-2019
04-27-2019
Thanks again.I swear I tried that yesterday and it didn't work, but I
must have had the wrong root C...
Created by
Tim Harman
in ATAs, Gateways and Accessories
04-27-2019
04-27-2019
Really appreciate your prompt reply in pointing me in the right
direction, however, I'm still stuff....
Created by
Tim Harman
in ATAs, Gateways and Accessories
04-26-2019
04-26-2019
Hi,My Cisco SPA112 has been working great with my provider, until the
new firmware released a few da...
04-27-2016
I realise I'm dragging up a 5 year old threat, but I've been searching
and I can't find anything. Th...
12-15-2013
Hi,I have a SRP527-U running 1.2.6 Firmware.I have a supported USB Stick
3G and it's working fine. I...
12-15-2013
Hi,I have a SRP527-U running 1.2.6.I have a simple setup, a ADSL
connection to the Internet and a bu...
Created by
Tim Harman
in Small Business Routers
12-09-2013
12-09-2013
Just in case anyone else is reading this, I can confirm this does
work!My only issue is that the web...
Created by
Tim Harman
in Small Business Routers
12-08-2013
12-08-2013
Thanks David, I thought that might be the case.No worries with support
from Telstra, this was a 2nd ...
Created by
Tim Harman
in Small Business Routers
12-08-2013
12-08-2013
Hi,I've bought a SRP527W. Looking at the info for it, it's a
SRP527W-K9-G4-TLSThis is the "Telstra" ...
Created by
Tim Harman
in ATAs, Gateways and Accessories
11-12-2013
11-12-2013
Is there any way to get the Line 1 status from the web page without
having to login?Or is there a wa...
Created by
Tim Harman
in ATAs, Gateways and Accessories
11-11-2013
11-11-2013
Hi,I have a Cisco SPA112, though this would apply to the Cisco SPA122 as
well.It has the latest 1.3....
Public Statistics
| Date Registered | 11-11-2013 08:16 PM |
| Date Last Visited | 05-15-2019 12:03 AM |
| Total Messages Posted | 13 |
