Hello Maurice, Thank you very much. > Check the time on your WLC again. If it's still set to GMT the time most likely is now behind one hour. Yes, indeed. > Check the time on your WLC again. If it's still set to GMT the time most likely is now behind one hour. I did this, time is correct now on the WLC. As for the CUCME, time is correct on the Cisco 8821 phones, but the timezone I set is still "timezone 22" which corresponds to "Greenwich Standard Time +0"... Best regards. ... View more

Hello, The Cisco Aironet 1830 Series Mobility Express failed to synchronize with <cisco_isr_4331_router> because this last device's firewall was dropping NTP traffic. I configured the Wifi WLC like this: (Cisco Controller) > config time timezone location 13 Now, time is correct on the Wifi WLC. The problem is that the 13 timezone location corresponds to  "(GMT) London, Lisbon, Dublin, Edinburgh" and I am in France...   Also, I configured the CUCME for SIP phones like that: cisco_isr_4331_router(config)# voice register global cisco_isr_4331_router(config-register-global)# timezone 22 cisco_isr_4331_router(config-register-global)# no create profile cisco_isr_4331_router(config-register-global)# create profile cisco_isr_4331_router(config-register-global)# reset Now, the phones have a correct time. The problem is that timezone 22 corresponds to "Greenwich Standard Time +0" and again, I am in France... I don't get this stuff. Best regards. ... View more

Hello and thank you for your answer. Below is how NTP was configured by default:   (Cisco Controller) >show time Time............................................. Wed Oct 31 11:34:13 2018 Timezone delta................................... 0:0 Timezone location................................ (GMT +1:00) Amsterdam, Berlin, Rome, Vienna NTP Servers NTP Version.................................. 3 NTP Polling Interval......................... 86400 Index NTP Key Index NTP Server Status NTP Msg Auth Status ------- --------------------------------------------------------------------- 1 0 0.ciscome.pool.ntp.org In Sync AUTH DISABLED 2 0 1.ciscome.pool.ntp.org Not Tried AUTH DISABLED 3 0 2.ciscome.pool.ntp.org Not Tried AUTH DISABLED Note that the time "Wed Oct 31 11:34:13 2018" is not correct. The correct time is "Wed Oct 31 10:34:13 2018".   I ran the following commands: (Cisco Controller) > config time ntp server 1 <ip_of_cisco_isr_4331_router> (Cisco Controller) > config time ntp delete 2 (Cisco Controller) > config time ntp delete 3 After running these commands, I get no synchronization with <ip_of_cisco_isr_4331_router> and the time is still not correct: (Cisco Controller) >show time Time............................................. Wed Oct 31 11:50:56 2018 Timezone delta................................... 0:0 Timezone location................................ (GMT +1:00) Amsterdam, Berlin, Rome, Vienna NTP Servers NTP Version.................................. 3 NTP Polling Interval......................... 86400 Index NTP Key Index NTP Server Status NTP Msg Auth Status ------- --------------------------------------------------------------------- 1 0 <ip_of_cisco_isr_4331_router> Not Synched AUTH DISABLED Please help me setup this properly. Best regards.   ... View more

@Dennis Mink Actually, you were right to ask the question, I also received undesired TCP SIP messages. So I added the rule "deny tcp any any eq 5060 log" after the rule "deny udp any any eq 5060 log" in the "ACL_TEST" access list. Still, I don't know how to "inject" the ACL rules into the zone-based firewall so that I can get rid of the ACL "ACL_TEST"... Best regards.   ... View more

Thanks a lot for this helpful clarification. Please note that I started another thread in "Cisco Community -> Technology and Support -> Security -> Firewalls" which is https://community.cisco.com/t5/firewalls/zone-based-firewall-isr4331-sip-traffic/m-p/3699863#M172467 If you feel like going on helping me... Best regards. ... View more

Hello,   > looking at the log entry, your acl denies UDP to port 5060. > are you allowing that 188. IP address in your object group?   No, I am not allowing that "188." IP address in my object group. In my object group, are only my SIP provider ranges of IP addresses. > is this expected traffic? No, this is not expected traffic. To me, this ACL is doing a good job. But my zone-based firewall doesn't do this job. What I don't know is how to "inject" this ACL in my zone-based firewall. I would like to get rid of this ACL and fix my zone-based firewall. BR. ... View more

Hello. Only UDP, because that's all the SIP trunk provider was asking for. This guy has some arguments: "In short, VoIP traffic is best left as UDP traffic for both server load and call quality reasons. " Source: https://www.onsip.com/blog/sip-via-udp-vs-tcp But how do this relate to my issue? It's "more blocking" and "less allowing" that I need in the zone-based firewall... BR. ... View more

Hello, Sorry for my late answer. I have set up a zone-based firewall on an ISR4331. I think that this firewall only allows SIP traffic from inside my system to my SIP trunk provider with inspect rule. And because its default policy is to drop packets, I think I am not accepting any connection from the outside... Yet, I still have these attempts which end up with "SIP/2.0 488 Not Acceptable Media" or "SIP/2.0 403 Forbidden" messages. So I don't know if that firewall is correctly setup or not. Note that no abusive call was placed on behalf of my system. If I observe these log messages does it mean that some undesired traffic passed through the firewall? Or are these just attempts that were recorded in the logs and were successfully blocked by the firewall? (Just as a reminder, I ran "debug ccsip messages"). Best regards. ... View more

Indeed, you are right, it looks odd. I wish I could explain this... Best regards. ... View more

Hello and thank you for your answers. > When a call comes in with g711ulaw codec, the 488 is expected behavior from the router. Ok. Thank you. > Yes, this looks like a bot somewhere in your network. How can there be such a bot in my network? > The INVITE at line 25 is coming from User-Agent: Linksys-SPA942. Please check that device. I have no such device on my network. > The 403 forbidden is again expected from the router as the source IP for that INVITE message is not trusted. Ok. Thank you. Can you explain to me what are these bots trying to do? Are they trying to place phone calls on behalf of my system and phone subscription? (Sorry if it looks paranoïd). Is this normal for my system to receive all these attempts? You nicely explained above it is normal behavior but ecologically speaking isn't it a huge loss of energy? Is there something I can do to prevent these attempts better? Or do I have to let them be? Thank you. ... View more

Thank you for your answers. I solved my problem. @pieterh The Cisco device is an ISR4331 and the protocol I use is SIP. The firewall is a Cisco zone-based firewall. For some reason I do not understand properly, packets from W1.X1.Y1.33 to W1.X1.Y1.34 were dropped. W1.X1.Y1.33 is a sub-interface on the Cisco router. W1.X1.Y1.34 is the IP of the CUC VM (Cisco Unity Connection Virtual Machine). I permitted TCP and UDP traffic from any machine on the subnet W1.X1.Y1.0/24 to any machine on this same subnet W1.X1.Y1.0/24 Best regards. ... View more

Hello and thank you for your answer. The "g711ulaw" is not a codec that is supported by my SIP trunk provider. My SIP trunk provider supports codecs "g722-64", "g711alaw" and "g729r8". For now, my telephony system is in a "lab" state. What I mean is that I am not expecting phone calls from the outside. The only "valid" phone calls that can come from the outside are the ones I make myself for my tests. > I'm seeing that the INVITE that comes with "m=audio 25282 RTP/AVP 0 101", the router responds with 488. So, is it some kind of bot trying to do something and what?   > There is another INVITE that arrives with "m=audio 5075 RTP/AVP 18 0 8 101" and this one is accepted by the router. Is this INVITE message the one at line 251? Is the message "SIP/2.0 403 Forbidden" at line 277 related to that INVITE? Thank you. ... View more