IP phone over VPN getting TCP Reset-I

bkootstra · ‎11-29-2007

I have our asa5520 (local network) talking lan2lan VPN to a asa5505 (remote network) for a "remote office". I have a cisco IP phone communicating to the Call Manager over the VPN connection. The problem I have is that the phone will reset and come back or just reset and spin its wheels trying to come back. Checking the syslogs on each ASA device and the Remote device shows a TCP Reset-O, while the local network ASA is showing the TCP Reset-I message. What should I look for to keep the reset from happening and killing my IP phone connection?

hadbou · ‎12-06-2007

When the PIX Firewall terminates any TCP connection, it generates a log message (which can be collected using a syslog server) that provides a reason for the termination. For example, if a TCP connection has been established between two hosts across the PIX, a TCP RESET-I in the log message means that the server from the inside is sending a reset to the PIX (which instructs the PIX to drop the connection). The PIX then drops the connection and logs a RESET-I

james.irwin · ‎12-07-2007

this might sound odd, but does the remote office have a static ip or dhcp from the provider?

if dhcp, people will commonly config the default route to the wan interface:

ip ro 0.0.0.0 0.0.0.0 int fa4

if that is the case, instead, try this:

ip ro 0.0.0.0 0.0.0.0 dhcp

this action installs a default route into the table. the ip phone and data flow will stabilize.

timkaye · ‎12-10-2007

Inspection of skinny?

r.stockton · ‎01-04-2008

Am seeing a similar issue in a live environment. ASA at HQ Site, 2811 at Remote Site. VPN Tunnel does not drop but phone reboot.

We've seen some SLIP and Clocking errors so we are going down that route w/the provider, however, I'm not seeing phones goto SRST.

I'm debugging:

ephone error

ephone keepalive

ephone registration.

I'm wondering if onsite for packet traces in in order. Look for traffic on port 2000

tbentley · ‎03-27-2009

i had the same problem with my asa and a remote access vpn try turning off skinny traffic inspection for that network.