cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5007
Views
0
Helpful
25
Replies

Problem with provisioning registration from Internet and CALLS when swicht to the mode TMS Provisioning mode Extension

Hi, I need help please, because I do not have contract and I can not open a TAC case.

  I have the following two problems:

1. When I make the switch to tms provisioning extension mode ,stop working sip calls, I get the following error from both scenarios internal and internet to my internal network:

On VCS-E when the call is Internet to internal network

2013-09-05T11:50:38-04:-30

tvcs: Event="Search Completed" Reason="Invalid permission - Insufficient privilege"   Service="H323" Src-alias-type="E164" Src-alias="7449" Dst-alias-type="H323" Dst-alias="anthony_accardi" Call-serial-number="1a069dfa-1647-11e3-86f9-0010f328943a"   Tag="1a069f44-1647-11e3-b22f-0010f328943a"   Detail="found:false, searchtype:ARQ" Level="1" UTCTime="2013-09-05 16:20:38,670"

On VCS-C when the call is Internal network to Internet:

2013-09-05T11:53:31-04:-30

tvcs: Event="Search Completed" Reason="Forbidden" Service="H323" Src-alias-type="E164" Src-alias="7429" Dst-alias-type="H323" Dst-alias="vianyfel_cordaro" Call-serial-number="812a5198-1647-11e3-ba89-0010f325da04"   Tag="812a52e2-1647-11e3-93c9-0010f325da04"   Detail="found:false, searchtype:ARQ" Level="1" UTCTime="2013-09-05 16:23:31,687"

2013-09-05T11:53:31-04:-30

tvcs: Event="Search Attempted" Service="H323" Src-alias-type="E164" Src-alias="7429" Dst-alias-type="H323" Dst-alias="vianyfel_cordaro" Call-serial-number="812a5198-1647-11e3-ba89-0010f325da04"   Tag="812a52e2-1647-11e3-93c9-0010f325da04"   Detail="searchtype:ARQ" Level="1" UTCTime="2013-09-05 16:23:31,680"

2013-09-05T11:53:23-04:-30

tvcs: Event="Search Completed" Reason="Forbidden" Service="H323" Src-alias-type="E164" Src-alias="7429" Dst-alias-type="H323" Dst-alias="vianyfel_cordaro" Call-serial-number="7c9181c4-1647-11e3-bda8-0010f325da04"   Tag="7c918304-1647-11e3-865b-0010f325da04"   Detail="found:false, searchtype:ARQ" Level="1" UTCTime="2013-09-05 16:23:23,974"

BUT WHEN THE MODE IS TMS AGENT LEGACY ALL THE CALL WORK FINE

2. When I make the switch I can provisioning tms mode i can make the equipment provisioning from internal network but not from outside, and that worries me most is the jabber that being from the internet I get the following error:

013-09-05T11:07:42-04:-30

tvcs: UTCTime="2013-09-05 15:37:42,263" Module="network.sip" Level="INFO": Src-ip="192.168.0.252" Src-port="25084" Detail="Receive Request Method=OPTIONS,   Request-URI=sip:192.168.0.250:7001;transport=tls,   Call-ID=624afa120c59ba26@192.168.0.252"

2013-09-05T11:07:42-04:-30

tvcs: UTCTime="2013-09-05 15:37:42,261" Module="network.sip" Level="DEBUG": Dst-ip="192.168.0.252" Dst-port="25084"
SIPMSG:
|SIP/2.0 401 Unauthorised
Via: SIP/2.0/TLS   192.168.0.252:5061;branch=z9hG4bK4de281330ed1277914e57a4bb98ac81416134;received=192.168.0.252;rport=25084
Call-ID: 624afa120c59ba26@192.168.0.252
CSeq: 38570 OPTIONS
From: <sip:192.168.0.252>;tag=21e96c96b3f9a439
To: <sip:192.168.0.250:7001>;tag=ba0e03ca2f6b3957
Server: TANDBERG/4120 (X7.2.1)
WWW-Authenticate: Digest realm="TraversalZone",   nonce="b40cb8278b4a11da992154324161d566d2b57bac3d83c5c518c4528c790d",   opaque="AQAAAN1NC9IHdFS3kNJ3Q6UX2JiBXhut", stale=FALSE,   algorithm=MD5, qop="auth"
Content-Length: 0

|

2013-09-05T11:07:42-04:-30

tvcs: UTCTime="2013-09-05 15:37:42,261" Module="network.sip" Level="INFO": Dst-ip="192.168.0.252" Dst-port="25084" Detail="Sending Response Code=401, Method=OPTIONS,   To=sip:192.168.0.250:7001, Call-ID=624afa120c59ba26@192.168.0.252"

2013-09-05T11:07:42-04:-30

tvcs: UTCTime="2013-09-05 15:37:42,261" Module="network.sip" Level="DEBUG": Src-ip="192.168.0.252" Src-port="25084"
SIPMSG:
|OPTIONS sip:192.168.0.250:7001;transport=tls SIP/2.0
Via: SIP/2.0/TLS   192.168.0.252:5061;branch=z9hG4bK4de281330ed1277914e57a4bb98ac81416134;received=192.168.0.252;rport=25084
Call-ID: 624afa120c59ba26@192.168.0.252
CSeq: 38570 OPTIONS
From: <sip:192.168.0.252>;tag=21e96c96b3f9a439
To: <sip:192.168.0.250:7001>
Max-Forwards: 0
User-Agent: TANDBERG/4120 (X7.2.1)
Supported: com.tandberg.vcs.resourceusage
Content-Type: text/xml
Content-Length: 250

<resourceusageinfo><traversalcallsavailable>250</traversalcallsavailable><nontraversalcallsavailable>750</nontraversalcallsavailable><registrationsavailable>2496</registrationsavailable><turnrelaysavailable>0</turnrelaysavailable></resourceusageinfo>|

2013-09-05T11:07:42-04:-30

tvcs: UTCTime="2013-09-05 15:37:42,261" Module="network.sip" Level="INFO": Src-ip="192.168.0.252" Src-port="25084" Detail="Receive Request Method=OPTIONS,   Request-URI=sip:192.168.0.250:7001;transport=tls,   Call-ID=624afa120c59ba26@192.168.0.252"

2013-09-05T11:07:36-04:-30

tvcs: UTCTime="2013-09-05 15:37:36,757" Module="network.tcp" Level="DEBUG": Src-ip="10.10.10.1" Src-port="10191" Dst-ip="10.10.10.10" Dst-port="5060" Detail="TCP Connection Closed"

2013-09-05T11:07:36-04:-30

tvcs: UTCTime="2013-09-05 15:37:36,641" Module="network.sip" Level="DEBUG": Dst-ip="10.10.10.1" Dst-port="10191"
SIPMSG:
|SIP/2.0 404 Not Found
Via: SIP/2.0/TCP 201.210.111.54:2379;branch=z9hG4bK5fc6a3c5021e3557216ef01c2434fb00.1;received=10.10.10.1;rport=10191;ingress-zone=DefaultZone
Call-ID: 6623b1a226372826@127.0.0.1
CSeq: 301 SUBSCRIBE
From: <sip:vianyfel_cordaro@domain.com>;tag=2991aa56d191ede3
To: <sip:provisioning@domain.com>;tag=c4114db76ace49d8
Server: TANDBERG/4120 (X7.2.1)
Warning: 399 200.11.230.253:5060 "Policy Response"
Content-Length: 0

|

2013-09-05T11:07:36-04:-30

tvcs: UTCTime="2013-09-05 15:37:36,641" Module="network.sip" Level="INFO": Dst-ip="10.10.10.1" Dst-port="10191" Detail="Sending Response Code=404, Method=SUBSCRIBE,   To=sip:provisioning@protokolgroup.com, Call-ID=6623b1a226372826@127.0.0.1"

2013-09-05T11:07:36-04:-30

tvcs: UTCTime="2013-09-05 15:37:36,638" Module="network.sip" Level="DEBUG": Src-ip="10.10.10.1" Src-port="10191"
SIPMSG:
|SUBSCRIBE sip:vianyfel_cordaro@domain.com SIP/2.0
Via: SIP/2.0/TCP   201.210.111.54:2379;branch=z9hG4bK5fc6a3c5021e3557216ef01c2434fb00.1;received=10.10.10.1;rport=10191
Call-ID: 6623b1a226372826@127.0.0.1
CSeq: 301 SUBSCRIBE
Contact: <sip:vianyfel_cordaro@201.210.111.54:2379;transport=tcp>
From: <sip:vianyfel_cordaro@domain.com>;tag=2991aa56d191ede3
To: <sip:provisioning@domain.com>
Max-Forwards: 70
Route: <sip:192.168.41.205:5060;lr;transport=tcp>
User-Agent: TANDBERG/774 (MCX 4.6.3.17194) - Windows
Expires: 300
Event:   ua-profile;model=movi;vendor=tandberg.com;profile-type=user;version=4.6.3.17194;clientid="S-1-5-21-1078081533-484061587-725345543";connectivity=1
Accept: application/pidf+xml
Content-Length: 0

The configuration I have is:

authentication.jpg

Configuration on VCS Expressway:

Mode TMS Agent Legacy

Seach rule:

local zone- no domain

Any

Any

No

Alias pattern match

Regex

(.+)@domain.com.*

Replace

Continue

LocalZone

local zone- full url

Any

Any

No

Alias pattern   match

Regex

(.+)@domain.com.*

Leave

Continue

LocalZone

Traversal zone search rule

Any

Any

No

Any alias




Continue

TraversalZone


DNS zone search   rule

Any

AllZones

No

Alias pattern match

Regex

(?!.*@%localdomains%.*$).*

Leave

Continue

DNSZone

Transform


Transform   destinations alis to URL

([^@]*)

Regex

Replace

\1@protokolgroup.com

Presence PUA---on

Presence server--off

VCS CONTROL:

Mode TMS Provisioning Extension

Search rule

local zone- no domain

Any

Any

No

Alias pattern   match

Regex

(.+)@domain.com.*

Replace

Continue

LocalZone

local zone- full url

Any

Any

No

Alias pattern match

Regex

(.+)@domain.com.*

Leave

Continue

LocalZone

Traversal zone search rule

Any

Any

No

Any alias




Continue

TraversalZone

External IP address search rule

Any

Any

No

Any IP address




Continue

TraversalZone

Transform


Transform   destinations alis to URL

([^@]*)

Regex

Replace

\1@protokolgroup.com

Pua--on

presence server--on

I dont hace call policy

Please help me to see what I'm missing or where is the error?

Thankss

25 Replies 25

Well, maybe you have got some changing in the network and not only the migration from TMS Agent legacy to TMSPE. Are you sure that it was the only chaging in your environment?

Anyway, following Cisco documentation, your current deployment is not correct, mainly the inspection/ALG feature enabled in your router/firewall. That is the cause for VCSe reject the SUBSCRIBE message from Jabber.

Take a look at this thread, check the responses by Zac with five green stars:

https://supportforums.cisco.com/thread/2238051?tstart=0

The guy has a VCSe with the same error message, "404 not found". He has a NAT problem too, the IP address in the "route" field inside the SUBSCRIBE message was not recognized by VCSE, so VCSe rejected the message. Just like your issue, but in your case, the firewall is putting the wrong IP address inside the SIP message. In his case, VCSe was not configured with the NAT IP address, but in your case, the inspection/ALG is the problem.

And take a look at the guide that I posted above, the guide states clearly to turn off any inspection/ALG feature in the Firewall/NAT device.

Regards

Paulo Souza

Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".

Paulo Souza Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".

Hello,

I do the NAT settings as suggested by the documentation:

Effectively solved the problem jabber connection from the external network. So thank you very much for the help!

But continuing with the problem of trying to calls with alias firstname_lastname, the logs on the vcs-e indicate  the following message:

2013-09-10T11:33:14-04:-30tvcs: Event="Search Completed" Reason="Invalid permission - Insufficient privilege" Service="H323" Src-alias-type="E164" Src-alias="7449" Dst-alias-type="H323" Dst-alias="anthony_accardi" Call-serial-number="7fc1a8d0-1a32-11e3-98a1-0010f328943a" Tag="7fc1aa24-1a32-11e3-bfb7-0010f328943a" Detail="found:false, searchtype:ARQ" Level="1" UTCTime="2013-09-10 16:03:14,565"
2013-09-10T11:33:14-04:-30tvcs: Event="Search Attempted" Service="H323" Src-alias-type="E164" Src-alias="7449" Dst-alias-type="H323" Dst-alias="anthony_accardi" Call-serial-number="7fc1a8d0-1a32-11e3-98a1-0010f328943a" Tag="7fc1aa24-1a32-11e3-bfb7-0010f328943a" Detail="searchtype:ARQ" Level="1" UTCTime="2013-09-10 16:03:14,534"

What could it be?

Hi,

Great to hear that you have fixed the NAT settings.    =)

Well, can you post the search history details for this call attempt (Status >> Search History)?

Regards

Paulo Souza

Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".

Paulo Souza Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".

On the calls history i see nothing but on log>>event log:

2013-09-10T16:30:55-04:-30tvcs: Event="Search Completed" Reason="Invalid permission - Insufficient privilege" Service="H323" Src-alias-type="E164" Src-alias="7449" Dst-alias-type="H323" Dst-alias="anthony_accardi" Call-serial-number="15d7b354-1a5c-11e3-b73a-0010f328943a" Tag="15d7b4a8-1a5c-11e3-8331-0010f328943a" Detail="found:false, searchtype:ARQ" Level="1" UTCTime="2013-09-10 21:00:55,761"
2013-09-10T16:30:55-04:-30tvcs: Event="Search Attempted" Service="H323" Src-alias-type="E164" Src-alias="7449" Dst-alias-type="H323" Dst-alias="anthony_accardi" Call-serial-number="15d7b354-1a5c-11e3-b73a-0010f328943a" Tag="15d7b4a8-1a5c-11e3-8331-0010f328943a" Detail="searchtype:ARQ" Level="1" UTCTime="2013-09-10 21:00:55,702"

Log>>network log

2013-09-10T16:32:54-04:-30tvcs: UTCTime="2013-09-10 21:02:54,351" Module="network.h323" Level="DEBUG": Dst-ip="10.10.10.1" Dst-port="62003"
Sending RAS PDU:
value RasMessage ::= admissionReject :
{
   requestSeqNum 46482,
   rejectReason invalidPermission : NULL,
   genericData
   {
   
    {
       id nonStandard : '65CD7B8ADC6711DBBED400123F634B1D'H,
       parameters
       {
        
         {
          id nonStandard : '65CD7B8BDC6711DBBED400123F634B1D'H,
          content number32 : 14
         }
       }
    }
   }
}
2013-09-10T16:32:54-04:-30tvcs: UTCTime="2013-09-10 21:02:54,351" Module="network.h323" Level="INFO": Dst-ip="10.10.10.1" Dst-port="62003"
Detail="Sending RAS ARJ SeqNum=46482 Reason='invalid permission' AdditionalCauseCode='insufficient privilege' "
2013-09-10T16:32:54-04:-30tvcs: UTCTime="2013-09-10 21:02:54,349" Module="network.sip" Level="DEBUG": Src-ip="192.168.0.252" Src-port="25026"
SIPMSG:
|SIP/2.0 403 Forbidden
Via: SIP/2.0/TLS 192.168.0.250:7001;egress-zone=TraversalZone;branch=z9hG4bKb74138b1c7558fb00c1c4d6d93745d8e884.9bd60383ce63180d0267417314b41c71;proxy-call-id=5c86c434-1a5c-11e3-8bac-0010f328943a;received=192.168.0.250;rport=7001;ingress-zone=TraversalZone
Via: SIP/2.0/TCP 127.0.0.1;branch=z9hG4bKc835a9c72018fb7532f2fff18c32aed2883
Call-ID: 8d63cdca61a738e6@127.0.0.1
CSeq: 26498 OPTIONS
From: ;tag=63a88518dbcf102d
To: ;tag=4d05e8fc19fd1e71
Server: TANDBERG/4120 (X7.2.1)
Warning: 399 192.168.0.252:5061 "Policy Response"
Content-Length: 0

Hi,

In fact, I am talking about search history. Go to Status >> Search History. Find your call attempt and click in "View details". Then post the result here.

Furtheremore, provide further informaion, such as, are you trying to call from internal jabber registered VCSC to an external Jabber registered to VCSE? Is there Call Policy enabled on any VCS?

Regards

Paulo Souza

Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".

Paulo Souza Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".

Hi,

The details for search>>history:

  • Search (30)
    • State: Completed
    • Found: False
    • Reason: Invalid permission - Insufficient privilege
    • Type: H323 (ARQ)
    • CallSerial Number: 5c86c434-1a5c-11e3-8bac-0010f328943a
    • Tag: 5c86c588-1a5c-11e3-b1f4-0010f328943a
    • Source (1)
      • Authenticated: False
      • Aliases (1)
        • Alias (1)
          • Type: E164
          • Origin: Endpoint
          • Value: 7449
      • Zone (1)
        • Name: DefaultSubZone
        • Type: Local
      • Path (1)
        • Hop (1)
          • Address: 10.10.10.1
    • Destination (1)
      • Alias (1)
        • Type: H323Id
        • Origin: Unknown
        • Value: anthony_accardi
    • StartTime: 2013-09-10 16:32:54
    • Duration: 0.06
    • SubSearch (1)
      • Type: Transforms
      • Action: Transformed
      • SubSearch (1)
        • Type: Admin Policy
        • Action: Proxy
        • SubSearch (1)
          • Type: FindMe
          • Action: Proxy
          • SubSearch (1)
            • Type: Search Rules
            • SearchRule (1)
              • Name: local zone- no domain
              • Zone (1)
                • Name: LocalZone
                • Type: Local
                • Protocol: H323
                • Found: False
                • Reason: Not Found
                • StartTime: 2013-09-10 16:32:54
                • Duration: 0
                • Gatekeeper (1)
                  • Address: 10.10.10.10:0
                  • Alias (1)
                    • Type: H323Id
                    • Origin: Unknown
                    • Value: anthony_accardi
              • Zone (2)
                • Name: LocalZone
                • Type: Local
                • Protocol: SIP
                • Found: False
                • Reason: Not Found
                • StartTime: 2013-09-10 16:32:54
                • Duration: 0.01
                • Gatekeeper (1)
                  • Address: 10.10.10.10:0
                  • Alias (1)
                    • Type: H323Id
                    • Origin: Unknown
                    • Value: anthony_accardi
            • SearchRule (2)
              • Name: local zone- full url
              • Zone (1)
                • Name: LocalZone
                • Type: Local
                • Protocol: H323
                • Found: False
                • Reason: Not Found
                • StartTime: 2013-09-10 16:32:54
                • Duration: 0
              • Zone (2)
                • Name: LocalZone
                • Type: Local
                • Protocol: SIP
                • Found: False
                • Reason: Not Found
                • StartTime: 2013-09-10 16:32:54
                • Duration: 0
            • SearchRule (3)
              • Name: Traversal zone search rule
              • Zone (1)
                • Name: TraversalZone
                • Type: TraversalServer
                • Protocol: H323
                • Found: False
                • Reason: Invalid permission - Insufficient privilege
                • StartTime: 2013-09-10 16:32:54
                • Duration: 0.01
              • Zone (2)
                • Name: TraversalZone
                • Type: TraversalServer
                • Protocol: SIP
                • Found: False
                • Reason: Forbidden
                • StartTime: 2013-09-10 16:32:54
                • Duration: 0.01
            • SearchRule (4)
              • Name: Traversal zone search rule 2
              • Zone (1)
                • Name: TraversalZone
                • Type: TraversalServer
                • Protocol: H323
                • Found: False
                • Reason: Invalid permission - Insufficient privilege
                • StartTime: 2013-09-10 16:32:54
                • Duration: 0.01
                • Gatekeeper (1)
                  • Address: 192.168.0.252:1719
                  • Alias (1)
                    • Type: H323Id
                    • Origin: Unknown
                    • Value: anthony_accardi
              • Zone (2)
                • Name: TraversalZone
                • Type: TraversalServer
                • Protocol: SIP
                • Found: False
                • Reason: Forbidden
                • StartTime: 2013-09-10 16:32:54
                • Duration: 0.02
                • Gatekeeper (1)
                  • Address: 192.168.0.252:25026
                  • Alias (1)
                    • Type: H323Id
                    • Origin: Unknown
                    • Value: anthony_accardi

when I make the call from a registered jabber Internet to any internal endpoint alias dialing works.

  But if from the internet EX90 registered, we perform alias call fails, or the registered EX90 marking the internal network by alias does not work.

I don´t have any call policy

Hi,

This searc history output was taken from VCSE, right? The call is being rejected by the other VCS. So, can you post the search history of the another VCS as well??

As I understand, you have an EX90 registered to VCSE and you cannot use it to call internal endpoints. And you also have an internal EX90 registered to VCSC that cannot dial external endpoint registered to VCSE. Is my understanding correct?? Sorry, I really didn't understand your scenario very well.

Regards

Paulo Souza

Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".

Paulo Souza Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".

the output of the VCS Control is:

  • Search (65)
    • State: Completed
    • Found: False
    • Reason: Forbidden
    • Info: Policy Response
    • Type: SIP (OPTIONS)
    • CallSerial Number: 5c90b6ba-1a5c-11e3-b5c7-0010f325da04
    • Tag: 5c86c588-1a5c-11e3-b1f4-0010f328943a
    • Source (1)
      • Authenticated: False
      • Aliases (1)
        • Alias (1)
          • Type: Url
          • Origin: Unknown
          • Value: iwf@192.168.0.250
      • Zone (1)
        • Name: TraversalZone
        • Type: TraversalClient
      • Path (1)
        • Hop (1)
          • Address: 192.168.0.250:7001
        • Hop (2)
          • Address: 127.0.0.1
    • Destination (1)
      • Alias (1)
        • Type: Url
        • Origin: Unknown
        • Value: sip:anthony_accardi
    • StartTime: 2013-09-10 16:32:54
    • Duration: 0.01
    • SubSearch (1)
      • Type: Transforms
      • Action: Transformed
      • SubSearch (1)
        • Type: Admin Policy
        • Action: Proxy
        • SubSearch (1)
          • Type: FindMe
          • Action: Reject

The scenario is such that you indicate :

-1 Ex90 register on VCS-E

-1 EX90 register on VCS-C

-1 Jabber on VCS-E

-1 Jabber on VCS-C

All are configured to register for H323 and sip:

h323: E164 >> 74XX

           or 74XX@mydomain.com

SIP: firstname_lastname@mydomain.com

when I try to make a call by dialing firstname_lastname not work either from the EX90 registered with VCS-E to the registered EX90 VCS-C or vice versa, but if I call dialing 74XX  it works.

Hi,

Now I understand!   =)

Ok, take a look at the output that you posted from VCS Control:

  • SubSearch (1)
  •    Type: FindMe
  •         Action: Reject

Are you using FindMe? If yes, your Find configuration is wrong. If not, please, turn off FindMe feature on TMS and on VCS Control.

Another important point is, what did you configured in TMS in the provisioning directory? What is the device address of your endpoints? Can you share a print of that configuration? Probably, you have configured a device address that doesn't match your search rules, that's why you cannot make the calls.

Regards

Paulo Souza

Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".

Paulo Souza Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".

I turn off findme, and it works!

Thanks for your help!

Great to hear that your issue has been resolved! Thanks for your feedback. You are welcome!

Regards

Paulo Souza

Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".

Paulo Souza Was my response helpful? Please rate useful replies and remember to mark any solved questions as "answered".
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: