SIP phone registering on SIP trunk

[impi]

Hi,

i have a UC 500 connected to our phone provider using a SIP trunk.

All the phones are SPA508 G

All is working fine !

Then, some days ago i added a SIP phone (extention 350) on the UC500, that also worked fine, and then after some minutes all our incoming/outgoing calls were blocked.

I called my provider that told me that our IP was banned because they have seen to much registration attempt from a bad user that was "350"

I can confirm with a "sh sip-ua register status" command that i had two sip registration : my SIP trunk and the SIP phone

Then it seems that the UC 500 is trying to register the SIP phone on the SIP trunk ?

What am i doing wrong ?

Is there a command to avoid that ?

Bellow is how the SIP phone and the SIP trunk are configured

Many thanks for your help, i was unable to find anything about that, but i guess somebody already had this problem !

The SIP phone -------------------------------------------------------------------------

voice service voip
 allow-connections h323 to h323
 allow-connections h323 to sip
 allow-connections sip to h323
 allow-connections sip to sip
 supplementary-service h450.12
 fax protocol none
 modem passthrough nse codec g711ulaw
 sip
  registrar server expires max 3600 min 120
  no update-callerid
!
voice class codec 1
 codec preference 1 g711ulaw
 codec preference 2 g729r8
!
!
voice register global
 mode cme
 source-address 10.1.1.1 port 5060
 max-dn 20
 max-pool 20
 load 9971 sip9971.9-2-2
 load 9951 sip9951.9-2-2
 load 8961 sip8961.9-2-2
 load 7971 term71.default
 authenticate register
 authenticate realm xxxxxx.com
 timezone 13
 hold-alert
 mwi stutter
 mwi reg-e164
 create profile sync 0636240803635305
!
voice register dn  1
 number 350
 name Conference
 label Conference
!
voice register pool  1
 id mac 1234.1234.1234
 number 1 dn 1
 username 350 password 1234
 codec g711ulaw
!
 

The SIP trunk ----------------------------------------------------------------------

sip-ua
 credentials username user1234 password 1234 realm sipgw9.provider.com
 authentication username user1234 password 1234 no remote-party-id
 retry invite 2
 retry register 10
 timers connect 100
 registrar dns:sipgw9.provider.com expires 3600
 sip-server dns:sipgw9.provider.com
 

[impi]

No idea ?

Is there something i did explain badly ?

Do you need more info ?

Regards

[impi]

I'm still searching on the forum, and maybe i found somthing related to my problem, not sure... any advice ?

Disable outbound proxy on voice register global as by default it will use the outbound proxy configured on the system which would not make sense

voice register global

  no outbound-proxy

found there : https://supportforums.cisco.com/discussion/10760741/uc500-sip-server-and-sip-trunk

[impi]

Hi,

really, nobody can help me with that ?

thanks

[tpoivre]

Reply error

[impi]

Ok, some news.

I went to the customer and first tried the "no-reg" solution under each "voice register dn". That was no enought and then i applied the second solution "voice register global - no outbound-proxy"

I'm using command "sh sip-ua register status"

From that i had still 2 extention that was still registering, and they were configured exactly as the other... really weird ! I just reloaded the uc500 and all was then ok.

I had another problem : my secondary extention into my ephone-dn were also registering  !!!

I had

ephone-dn 1

  number 123 secondary 0123456789 no-reg primary

Then extentions 0123456789 were trying to register also

i had to put everywhere :

  number 123 secondary 0123456789 no-reg both

I hope this won't be a problem...

And  then only my sip trunk was registering !

Thanks you for your help

[impi]

A little UP, please ?

Thanks

[Filipe Tavares · Accepted solution]

I would recommend that you disable the sip outbound-proxy under voice register global.

Under "sip" configuration, your timers doesn't appear to be by the book (registrar server expires max 3600 min 120). It should be "registrar server expires max 600 min 60", because you already specify the expires timer under the user-agent to 3600.

Is the phone registered correctly? 

Check this document (http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucme/troubleshooting/guide/ts_phreg.html#wp1054191). In case your problem persists, please add some debugs.

Thanks,

FT

[impi]

Hi Filipe,

thanks so much for this reply !

This confirm what i found (please see two posts bellow, in blue) and i'll try that.

I'll have to go to my Customer to test that next week or the following.

My provider is able to "white list" my IP during my test. If there is any problem i'll collect debugs.

If this is ok, i'll mark as "correct answer".

many thanks

edit : sorry i forgot to reply to your question; yes the phone is correctly registered, i can call and be called, no problem. The only problem is the registration to the phone provider.

[Filipe Tavares]

Hi impi,

No problem at all, i'm just here to help.

You can also under the sip configuration bind the signalling and media interface:

sip

 bind control source-interface INTERFACE

 bind media source-interface INTERFACE

Or

 bind all source-interface INTERFACE

Or you can specify it under the dial-peer side.

Please check this link for further explanation (http://www.cisco.com/c/en/us/td/docs/ios/voice/sip/configuration/guide/15_0/sip_15_0_book/sip_cg-bind.html)

Please rate if helpful.

Thanks,

Regards,

[ADAM CRISP · Accepted solution]

try:

voice register dn  1

no-reg

/Adam

[impi]

Many thanks for that Adam, this looks like a good idea !

I'll try and tell you (i guess next week)

regards

[ADAM CRISP]

Sure. 

When you have a Directory entry, sip phone-dn. E-ephone-Dan or pots dial-peer, the sip stack will try and register those resource/routes into a bigger dial plan. This is great in a large cm network, but Unfortunately sip service providers probably are not so interested. Using the no-reg statement under the directory entries changes this behaviour. In your case you tried to register the siphone extension with the service provider and they probably rejected it and there was some sort of loop which might look a bit like a dos or attempt to guess passwords...

Adam