CME 3.2 Over VPN unable to register

craig.corbett · ‎10-04-2007

Hi, I have setup a CME 3.2 system at work with 2 phones on can call between no problem.

On the single switch at work both phones register successfully to the CME router and I?m able to place calls to and from each other. At another location I have an 1801 router with a point to point VPN to the office Pix.

On the 1801 router I have set option 150 to point the CME router. When I plug the phone into the 1801, I get the following message on the CME router and the phone fails to register. The phone keeps on trying to register and the same message appears.

Oct 4 09:14:35.457: %IPPHONE-6-REG_ALARM: Name=SEP000E386DCFEB Load=CP79050101S

CCP030530B.zup Last=Initialized

Oct 4 09:14:35.457: %IPPHONE-6-REGISTER: ephone-2:SEP000E386DCFEB IP:192.168.1.

53 Socket:2 DeviceType:Phone has registered.

Oct 4 09:14:36.475: %IPPHONE-6-UNREGISTER_ABNORMAL: ephone-2:SEP000E386DCFEB IP

:192.168.1.53 Socket:2 DeviceType:Phone has unregistered abnormally.

MY setup:

192.168.103.X ------- 2950 Switch ----- CME Router

|

Pix External IP (DHCP for 192.168.103.X LAN)

|

IP Sec VPN

|

1801 External IP (DHCP for 192.168.1.X LAN with option 150 pointing at CME)

|

192.168.1.X

Any pointers will be greatly appreciated.

Thanks

Craig.

vmoopeung · ‎10-10-2007

The Cisco IOS Firewall did not previously support Skinny inspection, because outgoing packets are converted to H323 or SIP. As a result, there is no need for Skinny inspection. However, ACLs can be used to filter out unwanted packets/traffic as a way to support incoming Skinny packet inspection. Cisco IOS Firewall has added H.323 inspection support for any locally generated traffic, thus making it possible to deploy Cisco Unified CME and IOS Firewall on the same router.

http://www.cisco.com/en/US/products/sw/voicesw/ps4625/products_implementation_design_guide_chapter09186a00805f07a8.html

craig.corbett · ‎10-12-2007

Thanks for the info but the IOS firewall is not enabled on the 1801 ?

paolo bevilacqua · ‎10-12-2007

Hi,

from a PC on the remote lan, try:

telnet 2000.

If it fails, you have VPN issues, likely in the PIX config. that has many access-lists to set correctly.

craig.corbett · ‎10-16-2007

Hi, I can telnet cme-address 2000.

Its not a problem with multicast is it ?

craig.corbett · ‎10-16-2007

I think tftp may be timing out, any ideas ?