Buy or Renew
Buy or Renew
This forum is no longer in read-only mode. See this post for updates
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1095
Views
0
Helpful
2
Replies

UC540 + ASA5505 SIP issue

lukaszzyla
Level 1
Level 1

‎07-27-2013 12:47 PM - edited ‎03-21-2019 07:36 AM

Hi Guys!

I am no professional, just an enthusiast. I am managing smb office with 20 employees.

We have just purchased UC540 as a new voip device.

We have ASA5505 (8.2 with asdm 7.1(3)) with security plus licence.

ASA is configured as a router/firewall with a public ip.

inside network is 192.168.1.0, UC is connected through LAN port and data network is set to 192.168.1.2

DHCP on UC data network is disabled and windows DC takes care of it (DHCP relay configured)

WAN port on UC is disabled.

voice network is 10.1.1.1

CUE is 10.1.10.2

I configured static route on UC for 0.0.0.0/0.0.0.0 with default gateway being ASA.

I managed to register with my voip provider and can make calls, but cannot receive any ;-(

My ACL and NAT knowlegde on ASA is very limited and everything i have configured was through experiments.

unfortunatelly I am using ASDM and not CLI - my CLI knowledge is next to none ;-)

I have been trying to make it work for 2 weeks already and am very close to giving up.

Can somebody help me please?

I believe problem lies with ASA config, as when testing UC with directly connected WAN I did not have issues.

I configured many things on ASA and made so many different versions of config that I do not know where to look for the problem now.

I read too many documents and forums. I am not even sure know where to go next and what to try

I am hoping maybe one of you could help?

My question is:

1. what should my acl look like?

In the beginning i allowed on the OUTSIDE interface:

ANY to OUTSIDE INTERFACE

UDP/4000-6500

UDP/10000-20000

tcp-udp/5060

tcp-udp/5061

udp/domain

udp/snmp

udp/ntp

udp/snmptrap

What am I doing wrong here?

2. NAT

inside:

i configured NAT EXEMPT for:

inside network to 10.1.10.0

10.1.10.0 to inside network

also added static policies for:
original: src: 10.1.10.2 (tried also with UC data ip 192.168.1.2) TRANSLATED: interface:outside address:outside interface with DNS rewrite for:

udp/5060-5061

tcp/5060-5061

wasnt able to forward port ranges for rtp(udp: 4000-6500 and 10000-20000)

i also experimented with service policy rules:

added:

global policy:

global class, match, any, any, default inspection: sip, sccp, h323 h225, h323 ras

Please help!

is there anybody who could help??!!

I'm despaired!

Regards

Lukasz

Labels:
0 Helpful
2 Replies 2

lukaszzyla
Level 1
Level 1

‎07-27-2013 01:02 PM

here is my config:

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address WAN1 255.255.255.0

ipv6 enable

!

interface Ethernet0/0

switchport access vlan 2

dns domain-lookup inside

dns server-group DefaultDNS

name-server DC

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object-group network obj_any

object-group icmp-type DM_INLINE_ICMP_1

icmp-object echo

icmp-object echo-reply

icmp-object time-exceeded

icmp-object traceroute

icmp-object unreachable

object-group service DM_INLINE_SERVICE_1

service-object tcp eq sip

service-object udp eq domain

service-object udp eq ntp

service-object udp eq snmp

service-object udp eq snmptrap

object-group service DM_INLINE_TCP_1 tcp

port-object eq www

port-object eq https

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

object-group service DM_INLINE_SERVICE_2

service-object tcp-udp eq sip

service-object udp eq domain

service-object udp eq ntp

service-object udp eq snmp

service-object udp eq snmptrap

service-object tcp-udp eq 5061

object-group service DM_INLINE_UDP_1 udp

port-object range 10000 20000

port-object range 4000 6500

access-list outside_access_in extended permit icmp any interface outside object-group DM_INLINE_ICMP_1 inactive

access-list outside_access_in remark do zmiany z any na ip providera? ew ntp i moze inne protokoly do osobnych

access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any interface outside

access-list outside_access_in extended permit tcp any interface outside object-group DM_INLINE_TCP_1

access-list outside_access_in extended permit tcp any interface outside eq smtp

access-list outside_access_in extended permit tcp any interface outside eq 8080

access-list outside_access_in extended permit udp any interface outside object-group DM_INLINE_UDP_1

access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any interface outside

access-list inside_nat0_outbound extended permit ip any 192.168.1.240 255.255.255.240

access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.1.240 255.255.255.240

access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 ucvoice-network 255.255.255.0

access-list inside_nat0_outbound extended permit ip ucvoice-network 255.255.255.0 192.168.1.0 255.255.255.0

access-list inside_access_in extended permit ip host IIS any

access-list inside_access_in extended permit ip any any

access-list inside_access_in extended permit ip host NAS any

access-list inside_access_in extended deny tcp any any eq smtp

arp timeout 14400

global (inside) 1 interface

global (outside) 101 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 101 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface https IIS https netmask 255.255.255.255  dns tcp 200 200 udp 200

static (inside,outside) tcp interface www IIS www netmask 255.255.255.255  dns tcp 200 200 udp 200

static (inside,outside) tcp interface smtp IIS smtp netmask 255.255.255.255  dns

static (inside,outside) tcp interface pop3 IIS pop3 netmask 255.255.255.255  dns

static (inside,outside) tcp interface 8080 NAS 8080 netmask 255.255.255.255  dns

static (inside,outside) udp interface 5061 10.1.10.2 (tried also with 192.168.1.2 - UC Data network) 5061 netmask 255.255.255.255  dns

static (inside,outside) tcp interface 5061 10.1.10.2 5061 netmask 255.255.255.255  dns

static (inside,outside) udp interface sip 10.1.10.2 sip netmask 255.255.255.255  dns

static (inside,outside) tcp interface sip 10.1.10.2 sip netmask 255.255.255.255  dns

access-group inside_access_in in interface inside

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 x.x.x.x

route inside 10.1.1.0 (ucvoice-network) 255.255.255.0 192.168.1.2 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

0 Helpful

davetechfreak
Level 1
Level 1
In response to lukaszzyla

‎08-05-2013 05:27 AM

Hi Lukasz,

When you say you cannot receive calls does that mean one way audio or phones not ringing at all?

If they are not ringing it would be something stopping the traffic on the ASA. I would allow all traffic from IP addresses of your sip provider to the public IP (the NAT-ed) address on the ASA for the sake of this test. Then go onto the UC and do a debug (debug ccsip messages) and see if something comes up when you dial the SIP number.

Cheers,

David

0 Helpful
Customers Also Viewed These Support Documents