Problems with calls after VCS 8.22 upgrade

[Nick Halbert-Lillyman]

I've recently upgraded one of my VCS devices to 8.2.2, but I'm having some problems.

Setup is as follows:

VCS-C-1: X8.2.2
VCS-E: 7.2
VCS-C-2: 7.2

EX90s: 7.2

EX90 > VCS-C-1 (8.2.2) > Neighbour Zone > VCS-E (7.2) > Traversal Zone > VCS-C-2 (7.2) 

Call is SIP the whole way.

Calls fail in either direction (connects but not audio or video).  Was working fine before upgrading VCS-C-1 from 7.2 to 8.2.2.

If I change the neighbour zone from VCS-C-1 to the VCS-E to use a "Custom" profile with "Duo Video Filter" set to "On", it works fine, although that way I can't use presentation properly.  Likewise if I introduce interworking into any part of the call path (force one leg to H323) it works, but again, interworking has its own set of other issues.  Lastly, if I register either endpoint to the VCS-E, everything works, it just won't work when going through all three call hops.

The VCS-E is controlled by me so can be upgraded if required, however VCS-C-2 is in another organisation so upgrading that one is likely to be much more difficult.

I know there were changes to how Duo Video works in X8 - I notice it's moved from a global SIP command to per-zone, I imagine this has something to do with it.

Any ideas?

[George Thomas]

VCS x8.x has a bunch of new ports for media, did you make sure those were opened on your firewall after the upgrade?

[Nick Halbert-Lillyman]

There's no firewall between VCS-C-1 and VCS-E.  There's one between VCS-E and VCS-C-2, but they are both still on 7.2 (although we did check for anything getting denied, just in case).

Either way, 8.2 maintains your port range if upgrading from 7.X.

[danny.yf_li · Accepted solution]

please try to set "Sip media encryption"  on traversal zone setting page to "best effort" and have a try

[Nick Halbert-Lillyman]

That fixed it - thanks very much!

For the record, I'd tried TLS and TCP, as well as "Auto" and "Force unencrypted" but hadn't tried "Best Effort".

[Nick Halbert-Lillyman]

Update on this:

Upgraded the VCS-E, no change (again, I can't upgrade VCS-C number 2).

I've tested with E20s and SIP from a TS server - both work fine, it's only TC endpoints that seem to have the problem.

I've experimented with different call paths (we've got quite a few VCSs, a mix of X7 and X8) - in each case, it seems it matters what version the unit is registered to.  As long as the EX90 is registered to a X7 VCS, it works fine, you can have as many X8s with neighbour and/or traversal zones as you want.  As soon as it registers to an X8 VCS, the problem occurs.

Lastly, I see that the non-working call is establishing as AES-128, whereas before the upgrade encryption was turned off.