9971 VPN Phone Disconnect Problem

[Chi Fai Leung]

Hi All Experts,

I developed a Cisco VPN deskphone solution on my company, that the deskphone is using the ASA firewall as the SSL VPN, then it can touch the CM 9.1. The VPN phone solution was working as a long time.

But recently, the 9971 VPN phone had disconnected problem. Oppositely, the 7962 VPN phone would not have the disconnected problem, even the 7962 and 9971 is using the same Internet network.

The 9971 was disconnected the SSL VPN network regularly around two more mins, that would be disconnected the SSL VPN every 2 more mins.

PS: If the 9971 use the 9.3 version phone load, that cannot make the registration, that cannot use the VPN phone.

PS: If the 9971 use the 9.2 version phone load, that can make the SSL VPN and register to CM 9.1, but that would be make the disconnection problem regularly.

[Manish Gogna]

Is the 7962 also using SIP Firmware?

To start with you will need the phone console logs from the 9971 first to look at any suspicious messages corresponding to the time stamp of the phone losing registration with the callmanager. A parallel packet capture from the 9971 and the Callmanager to which it is registered , covering a duration of a few minutes before the issue until the issue occurs will help as it will let us know if there are any packets which are failing to be delivered from IP phone to the CUCM or vice versa.

HTH

Manish Gogna

[Chi Fai Leung]

Thanks for yr reply~

Actually, the 9971 VPN Phones are resumed normally. But I do not turn anythings.

Now, I need to explain the reaons why the 9971 hv the VPN reconnection issue, but the 7962 hv not.

But I cannot see the SSL VPN reconnection issue again already.

Any idea for that? the Internet issue? the ASA issue? the CM issue?

[Manish Gogna]

Hi Chi,

Its difficult to predict the cause of an issue without proper analysis of traces or captures. However, in this case we can most likely rule out CUCM as it would have affected 7962 as well in case something was wrong on CUCM. In such a situation if we can not reproduce the issue on demand to collect the packet captures from IP phone and CUCM then I would start looking at the ASA first for any dropped packets or errors.

HTH

Manish

[Chi Fai Leung]

Which parts is the potential issues for the VPN deskphone reconnecting VPN? session timeout? client profile settings?

[Manish Gogna]

It would most likely be a keepalive timeout due to keepalives or keepalive ack's being dropped. But again, packet captures will provide the real reason.

Manish

[Chi Fai Leung]

But the VPN 9971 would not happen the problem again already.

[Manish Gogna]

In such intermittent issues, you will need to setup captures and wait for the issue to happen.

Manish

[Chi Fai Leung]

More information ...

I discovered this is happened a location only and other location Internet make the SSL VPN, then the 9971 SSL VPN would not have the problem .... The problem include "SSL VPN reconnection" and "One way audio" .... That maybe two issues ...

Otherwises, I discovered the ASA fw keep to showed the error in the logs as "asa nat/pat pool exhausted. unable to create connection"

One important point is I replace the 9971 to the 7975. The 7975 phone would not happen the two issues as the same environment.