CUCM 8.6 Call Forwarding to External Number Issue

Lasha Lomjaria · ‎12-18-2013

Hello,

Call forwarding worked without problems, we could forward our phones to external numbers and everything was ok, when somebody called to my phone, I could got the call to my cell phone.

But now when I forward my phone to external number and try to call to my phone I get busy trigger.

We didn't change configuration or install any update.

I think its my ISP-s problem, to whom we have SIP Trunk.

I don't understand log file, so can you tell what is the problem?

Here is log:

057729XXXX is called party, cell phone number

original calling party number is 240XXXXX, but it is forwarded to 2484XXX

INVITE sip:2484XXX@ISP-IP:5060 SIP/2.0

Via: SIP/2.0/UDP MY-CUCM-IP:5060;branch=z9hG4bK1003a84126249

From: <sip:057729XXXX@MY-CUCM>;tag=4052091~294be736-ce3b-450f-a7f1-c801f3cc9a7e-27746002

To: <sip:2484XXX@ISP-IP>

Date: Wed, 18 Dec 2013 13:34:18 GMT

Call-ID: 16d82e80-2b11a45a-c43e7-84450d0a@MY-CUCM-IP

Supported: timer,resource-priority,replaces

Min-SE: 1800

User-Agent: Cisco-CUCM8.6

Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY

CSeq: 101 INVITE

Expires: 180

Allow-Events: presence

Supported: X-cisco-srtp-fallback

Supported: Geolocation

Cisco-Guid: 0383266432-0000065536-0000191815-2219117834

Session-Expires: 1800

P-Asserted-Identity: <sip:057729XXXX@MY-CUCM-IP>

Remote-Party-ID: <sip:057729XXXX@MY-CUCM-IP>;party=calling;screen=yes;privacy=off

Contact: <sip:057729XXXX@MY-CUCM-IP:5060>

Max-Forwards: 68

Content-Type: application/sdp

Content-Length: 215

v=0

o=CiscoSystemsCCM-SIP 4052091 1 IN IP4 MY-CUCM-IP

s=SIP Call

c=IN IP4 MY-CUCM-IP

t=0 0

m=audio 29790 RTP/AVP 8 101

a=rtpmap:8 PCMA/8000

a=ptime:20

a=rtpmap:101 telephone-event/8000

a=fmtp:101 0-15

|2,100,56,1.173711429^MY-CUCM-IP^MTP_3

17:34:18.526 |EnvProcessUdpPort - EnvProcessUdpHandler::fireSignal() varId = 2|2,100,56,1.173711429^MY-CUCM-IP^MTP_3

17:34:18.526 |EnvProcessUdpHandler::fireSignal - SEND: index = 2, handler = 0xb2d59c98|*^*^*

17:34:18.526 |EnvProcessUdpPort::fireSignal - SEND, destination = ISP-IP:5060|*^*^*

17:34:18.526 |EnvProcessUdpPort - EnvProcessUdpHandler::send(buff, 1172, ISP-IP:5060)|*^*^*

17:34:18.536 |EnvProcessUdpHandler::handle_input - handle = 334|*^*^*

17:34:18.536 |EnvProcessUdpHandler::handle_input Status: 0, Id: 2|*^*^*

17:34:18.536 |//SIP/SIPUdp/wait_UdpDataInd: Incoming SIP UDP message size 358 from ISP-IP:[5060]:

[12623361,NET]

SIP/2.0 100 Trying

Call-ID: 16d82e80-2b11a45a-c43e7-84450d0a@MY-CUCM-IP

CSeq: 101 INVITE

From: <sip:057729XXXX@MY-CUCM-IP>;tag=4052091~294be736-ce3b-450f-a7f1-c801f3cc9a7e-27746002

To: <sip:2484XXX@ISP-IP>;tag=sip+1+b3a00013+867def6a

Via: SIP/2.0/UDP MY-CUCM-IP:5060;branch=z9hG4bK1003a84126249

Server: CISCO-SBC/2.x

Content-Length: 0

|2,100,230,1.4901096^ISP-IP^*

17:34:18.536 |//SIP/Stack/Info/0x0/ccsip_spi_get_msg_type returned: 2 for event 1|2,100,230,1.4901096^ISP-IP^*

17:34:18.536 |//SIP/Stack/Transport/0x0/context=(nil)|2,100,230,1.4901096^ISP-IP^*

17:34:18.536 |//SIP/Stack/Transport/0x0/gConnTab=0xf484290, addr=ISP-IP, port=5060, connid=2, transport=UDP|2,100,230,1.4901096^ISP-IP^*

17:34:18.536 |//SIP/Stack/Info/0x0/Return existing connection for port 5060 connId 2|2,100,230,1.4901096^ISP-IP^*

17:34:18.536 |//SIP/Stack/Info/0x0/Checking Invite Dialog|2,100,230,1.4901096^ISP-IP^*

17:34:18.536 |//SIP/Stack/Info/0xb1b50c90/INVITE response with no RSEQ - disable IS_REL1XX|2,100,230,1.4901096^ISP-IP^*

17:34:18.536 |//SIP/SIPHandler/ccbId=0/scbId=0/sip_stop_timer: type=SIP_TIMER_TRYING value=500 retries=3|2,100,230,1.4901096^ISP-IP^*

17:34:18.536 |//SIP/Stack/States/0xb1b50c90/0xb1b50c90 : State change from (STATE_SENT_INVITE, SUBSTATE_NONE) to (STATE_RECD_PROCEEDING, SUBSTATE_PROCEEDING_PROCEEDING)|2,100,230,1.4901096^ISP-IP^*

17:34:18.536 |//SIP/SIPHandler/ccbId=0/scbId=0/sip_stop_timer: type=SIP_TIMER_EXPIRES value=180000 retries=0|2,100,230,1.4901096^ISP-IP^*

17:34:18.536 |//SIP/SIPHandler/ccbId=0/scbId=0/sip_start_timer: type=SIP_TIMER_EXPIRES value=180000 retries=0|2,100,230,1.4901096^ISP-IP^*

17:34:18.561 |EnvProcessUdpHandler::handle_input - handle = 334|*^*^*

17:34:18.561 |EnvProcessUdpHandler::handle_input Status: 0, Id: 2|*^*^*

17:34:18.561 |//SIP/SIPUdp/wait_UdpDataInd: Incoming SIP UDP message size 396 from ISP-IP:[5060]:

[12623362,NET]

SIP/2.0 403 Forbidden

Call-ID: 16d82e80-2b11a45a-c43e7-84450d0a@MY-CUCM-IP

CSeq: 101 INVITE

From: <sip:057729XXXX@MY-CUCM-IP>;tag=4052091~294be736-ce3b-450f-a7f1-c801f3cc9a7e-27746002

To: <sip:2484XXX@ISP-IP>;tag=sip+1+b3a00013+867def6a

Via: SIP/2.0/UDP MY-CUCM-IP:5060;branch=z9hG4bK1003a84126249

Server: CISCO-SBC/2.x

Content-Length: 0

Contact: <sip:ISP-IP:5060>

[12623363,NET]

ACK sip:2484XXX@ISP-IP:5060 SIP/2.0

Via: SIP/2.0/UDP MY-CUCM-IP:5060;branch=z9hG4bK1003a84126249

From: <sip:057729XXXX@MY-CUCM-IP>;tag=4052091~294be736-ce3b-450f-a7f1-c801f3cc9a7e-27746002

To: <sip:2484XXX@ISP-IP>;tag=sip+1+b3a00013+867def6a

Date: Wed, 18 Dec 2013 13:34:18 GMT

Call-ID: 16d82e80-2b11a45a-c43e7-84450d0a@MY-CUCM-IP

Max-Forwards: 70

CSeq: 101 ACK

Allow-Events: presence

Content-Length: 0

INVITE sip:2484XXX@ISP's-Other-IP:5062 SIP/2.0

Via: SIP/2.0/UDP MY-CUCM-IP:5062;branch=z9hG4bK1003a95b8f3900

From: <sip:057729XXXX@MY-CUCM-IP>;tag=4052092~294be736-ce3b-450f-a7f1-c801f3cc9a7e-27746002

To: <sip:2484XXX@ISP's-Other-IP>

Date: Wed, 18 Dec 2013 13:34:18 GMT

Call-ID: 16d82e80-2b11a45a-c43e8-84450d0a@MY-CUCM-IP

Supported: timer,resource-priority,replaces

Min-SE: 1800

User-Agent: Cisco-CUCM8.6

Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY

CSeq: 101 INVITE

Expires: 180

Allow-Events: presence

Supported: X-cisco-srtp-fallback

Supported: Geolocation

Cisco-Guid: 0383266432-0000065536-0000191816-2219117834

Session-Expires: 1800

P-Asserted-Identity: <sip:057729XXXX@MY-CUCM-IP>

Remote-Party-ID: <sip:057729XXXX@MY-CUCM-IP>;party=calling;screen=yes;privacy=off

Contact: <sip:057729XXXX@MY-CUCM-IP:5062>

Max-Forwards: 68

Content-Type: application/sdp

Content-Length: 215

v=0

o=CiscoSystemsCCM-SIP 4052092 1 IN IP4 MY-CUCM-IP

s=SIP Call

c=IN IP4 MY-CUCM-IP

t=0 0

m=audio 29792 RTP/AVP 8 101

a=rtpmap:8 PCMA/8000

a=ptime:20

a=rtpmap:101 telephone-event/8000

a=fmtp:101 0-15

|2,100,56,1.173711431^MY-CUCM-IP^MTP_3

17:34:18.567 |EnvProcessUdpPort - EnvProcessUdpHandler::fireSignal() varId = 0|2,100,56,1.173711431^MY-CUCM-IP^MTP_3

17:34:18.567 |EnvProcessUdpHandler::fireSignal - SEND: index = 0, handler = 0xa6b4d7c0|*^*^*

17:34:18.567 |EnvProcessUdpPort::fireSignal - SEND, destination = ISP's-Other-IP:5062|*^*^*

17:34:18.567 |EnvProcessUdpPort - EnvProcessUdpHandler::send(buff, 1177, ISP's-Other-IP:5062)|*^*^*

17:34:18.569 |EnvProcessUdpHandler::handle_input - handle = 335|*^*^*

17:34:18.569 |EnvProcessUdpHandler::handle_input Status: 0, Id: 0|*^*^*

17:34:18.569 |//SIP/SIPUdp/wait_UdpDataInd: Incoming SIP UDP message size 394 from ISP's-Other-IP:[5062]:

[12623365,NET]

SIP/2.0 100 trying -- your call is important to us

Via: SIP/2.0/UDP MY-CUCM-IP:5062;branch=z9hG4bK1003a95b8f3900;rport=5062

From: <sip:057729XXXX@MY-CUCM-IP>;tag=4052092~294be736-ce3b-450f-a7f1-c801f3cc9a7e-27746002

To: <sip:2484XXX@ISP's-Other-IP>

Call-ID: 16d82e80-2b11a45a-c43e8-84450d0a@MY-CUCM-IP

CSeq: 101 INVITE

Server: kamailio (3.3.1 (x86_64/linux))

Content-Length: 0

17:34:18.587 |//SIP/SIPUdp/wait_UdpDataInd: Incoming SIP UDP message size 375 from ISP's-Other-IP:[5062]:

[12623366,NET]

SIP/2.0 403 Forbidden

Via: SIP/2.0/UDP MY-CUCM-IP:5062;branch=z9hG4bK1003a95b8f3900;rport=5062

Call-ID: 16d82e80-2b11a45a-c43e8-84450d0a@MY-CUCM-IP

From: <sip:057729XXXX@MY-CUCM-IP>;tag=4052092~294be736-ce3b-450f-a7f1-c801f3cc9a7e-27746002

To: <sip:2484XXX@ISP's-Other-IP>;tag=dc6a4ae7

CSeq: 101 INVITE

Reason: Q.850;cause=0;text="unknown"

Content-Length: 0

|2,100,230,1.4901099^ISP's-Other-IP^*

[12623367,NET]

ACK sip:2484XXX@ISP's-Other-IP:5062 SIP/2.0

Via: SIP/2.0/UDP MY-CUCM-IP:5062;branch=z9hG4bK1003a95b8f3900

From: <sip:057729XXXX@MY-CUCM-IP>;tag=4052092~294be736-ce3b-450f-a7f1-c801f3cc9a7e-27746002

To: <sip:2484XXX@ISP's-Other-IP>;tag=dc6a4ae7

Date: Wed, 18 Dec 2013 13:34:18 GMT

Call-ID: 16d82e80-2b11a45a-c43e8-84450d0a@MY-CUCM-IP

Max-Forwards: 70

CSeq: 101 ACK

Allow-Events: presence

Content-Length: 0

Hermanus Janse van Vuuren · ‎12-18-2013

SIP/2.0 403 Forbidden error

If your router is sending a SIP/2.0 403 Forbidden error to the SIP server you are registered to, there is a good chance your router is blocking the incoming call due to the toll-faud prevention feature that was added to IOS version 15.1(2)T.

How to Identify if TOLLFRAUD_APP is Blocking Your Call

If the TOLLFRAUD_APP is rejecting the call, it generates a Q.850 disconnect cause value of 21, which represents ‘Call Rejected’. The debug voip ccapi inout command can be run to identify the cause value.

Additionally, voice iec syslog can be enabled to further verify if the call failure is a result of the toll-fraud prevention. This configuration, which is often handy to troubleshoot the origin of failure from a gateway perspective, will print out that the call is being rejected due to toll call fraud. The CCAPI and Voice IEC output is demonstrated in this debug output:

%VOICE_IEC-3-GW: Application Framework Core: Internal Error (Toll fraud call rejected): 
IEC=1.1.228.3.31.0 on callID 3 GUID=F146D6B0539C11DF800CA596C4C2D7EF 
000183: *Apr 30 14:38:57.251: //3/F146D6B0800C/CCAPI/ccCallSetContext: 
   Context=0x49EC9978 
000184: *Apr 30 14:38:57.251: //3/F146D6B0800C/CCAPI/cc_process_call_setup_ind: 
   >>>>CCAPI handed cid 3 with tag 1002 to app "_ManagedAppProcess_TOLLFRAUD_APP" 
000185: *Apr 30 14:38:57.251: //3/F146D6B0800C/CCAPI/ccCallDisconnect: 
   Cause Value=21, Tag=0x0, Call Entry(Previous Disconnect Cause=0, Disconnect Cause=0)

The Q.850 disconnect value that is returned for blocked calls can also be changed from the default of 21 with this command:

voice service voip
 ip address trusted call-block cause

How to Return to Pre-15.1(2)T Behavior

Source IP Address Trust List

There are three ways to return to the previous behavior of voice gateways before this trusted address toll-fraud prevention feature was implemented. All of these configurations require that you are already running 15.1(2)T in order for you to make the configuration change.

Explicitly enable those source IP addresses from which you would like to add to the trusted list for legitimate VoIP calls. Up to 100 entries can be defined. This below configuration accepts calls from those host 203.0.113.100/32, as well as from the network 192.0.2.0/24. Call setups from all other hosts are rejected. This is the recommended method from a voice security perspective.
```
voice service voip
 ip address trusted list
  ipv4 203.0.113.100 255.255.255.255
  ipv4 192.0.2.0 255.255.255.0
```
Configure the router to accept incoming call setups from all source IP addresses.
```
voice service voip
 ip address trusted list
  ipv4 0.0.0.0 0.0.0.0
```
Disable the toll-fraud prevention application completely.
```
voice service voip
 no ip address trusted authenticate
```

Two-Stage Dialing

If two-stage dialing is required, the following can be configured to return behavior to match previous releases.

For inbound ISDN calls:

voice service pots
 no direct-inward-dial isdn

For inbound FXO calls:

voice-port 
 secondary dialtone

Best Regards

Lasha Lomjaria · ‎12-18-2013

Thanks for reply

We use only CUCM, we have no VoIP gateway. We have sip trunk to provider.

So ISP's router is blocking incoming calls right?

William Bell · ‎12-18-2013

Are you sure that your ISP will allow you to send a calling party number that is not provisioned in your DID range? I have seend the forbidden message when a call is sent to ITSP and the calling party number is not on the allow/white list.

HTH

-Bill
(b) http://ucguerrilla.com
(t) @ucguerrilla

Please remember to rate helpful responses and identify helpful or correct answers.

HTH -Bill (b) http://ucguerrilla.com (t) @ucguerrilla

Please remember to rate helpful responses and identify

Hermanus Janse van Vuuren · ‎12-18-2013

It is the ISP way of preventing toll-fraud as well. Check with your ISP.

Best Regards