Naughty MOH

Unanswered Question
Dec 14th, 2006
User Badges:

MOH is driving me nuts.

2 Site, Intercluster non Gatekeeper Controlled. When i make Call from Site1 to Site2 and hit the HOLD button from PhoneA (Site1) i hear music. From PhoneB (Site2) doing the same thing i got the busy tone. Firewall logs shows that he droped Packets from CCM Source port being (56560):

Attack Name: Dynamic Ports

reason: tried to open a known service port,protocol: udp

But this port is not mentined anywhere in the Cisco Doc, Am i missing something here?

See Ports on CCM 4.1

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
fred.s.mollenkopf Thu, 12/14/2006 - 08:13
User Badges:
  • Gold, 750 points or more

We need to know a little more about the firewall setup, preferrably the vendor and version. Usually most firewalls provide translations/conns for internal devices but not for external unless they are manually set. Cisco uses fixups to handle outside to inside dynamic translations for voice. If this is a PIX, and not using same level security interface, then one side is going to be higher security than the other. If no fixup exists for H323 then the dynamic RTP traffic will not be accounted for.

Here is a sample document explaining fixups for voice.

Please rate any helpful posts



fred.s.mollenkopf Thu, 12/14/2006 - 08:29
User Badges:
  • Gold, 750 points or more


Also if you could post your settings for both side of the Trunks. Depending on if you are using H323 slow start or fast start, the signaling ports changes. Slow start uses a dynamic range I believe so you want to make sure the trunks are not using it. This of course will affect your fixups.




This Discussion