Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Problem after VCS upgrade from X5.1.1 to X7.1

I currently have a set up like this:

VCS control -> Neighbour zone to VCS expressway -> Traversal zone to VCS control.

I've upgraded the first VCS control (on the left) from version 5.1.1 to version 7.1.  The other two are still at 5.1.1 (not much I can do about this for now).

Since the upgrade, H323 calls between the two VCS controls fail, giving me a "Security Denial" message in the search history.  SIP still works fine.

Anyone have any ideas?  It was all working fine prior to the upgrade.


Problem after VCS upgrade from X5.1.1 to X7.1

I should add - the VCS expressway is interworking the SIP call back to H323 when it sends to the second VCS control.  This happens in both the working and non-working scenarios - the problem seems to lie between the first VCS control and the expressway.

New Member

Problem after VCS upgrade from X5.1.1 to X7.1


Do you have seen in the Rel NOte that official not supported update prior 5.1 to 7.1

Upgrading from older releases

It is not possible to upgrade from releases prior to X5.1 to X7.n. You must first upgrade to X5.2

and then to X7.n. See the X5.2 release note, document reference D50582, for details.

I have also seen that

Upgrades from release X5.2 or earlier to X7.n

Cisco VCS upgrades where authentication is not enabled

If device authentication is not enabled when the Cisco VCS is upgraded from X5.2 or earlier to X7.n,

the upgrade process will configure all zones and subzones (except the Default Zone) on the Cisco

VCS with authentication set to ‘Treat as authenticated’.

I would recommend update all VCS to 7.1 in the same time, from ver 5.1 to 7.1 was made so many bug fixes and new featrues.

Best regards


Problem after VCS upgrade from X5.1.1 to X7.1

In relation to the upgrade question, I performed the staged upgrade and didn't go straight from 5.1.1.

I ended up getting it working by turning authentication off on the X5.1.1 expressway.  The reason I haven't upgraded that one is that it has a traversal zone to another company who are still running an old version and they aren't ready to upgrade yet so I wasn't sure of the repruccusions of having a 7.1 to 5.1 traversal relationship.

Thanks for your help everyone.

Problem after VCS upgrade from X5.1.1 to X7.1

Hi Nick,

First check the NTP on the originating and terminating gatekeeper and endpoints. is it synched with NTP or not.

ITU recommendation H.235 for security and encryption for H-Series (H.323 and other H.245-based) multimedia terminals.

This security covers authenticating and authorizing of H.323 calls between the administrative domains of Internet Telephone Service Providers (ITSPs) using tokens. An token is generated in the originating gatekeeper when an LRQ is initiated.

If the software of the Terminating endpoint/gateway is changed to a version where the token is not supported. In such a case, the Terminating gateway/endpoint is not able to extract the token from the setup message. This causes the terminating gatekeeper to reject the call with a disconnect reason of security denial.

So my question to you is what endpoint you tested with? what is the version you are running on to it. Also its a good idea to upgrade the other vcs to same software version.



CreatePlease login to create content