[cisco-voip] 7970 phones not failing over in CCM 4.1.2

[Wes Sisk]

Hi Mike,

As you are using authentication & encryption, do you see the phone 
establish a TLS connection to the backup CM?  You will get more info 
from the phone with a console cable:

http://www.cisco.com/en/US/customer/products/hw/phones/ps379/products_administration_guide_chapter09186a00801ebe69.html

user: default
pass: user

use 'strace 3' to enable debugging and capture away.

I strongly suspect this is unique to authengication & encryption.

/Wes

Mike Newell wrote:

>I have a CCM 4.1.2 system with a publisher on one subnet, two subscribers
>on another subnet, and mostly 7970 phones plus one 7936 conference phone
>on a third subnet.  All are local through a single router at present.
>
>When I look at the configuration for each phone I see all three CCM
>servers' IP addresses listed in the order Subscriber 1 (with a lock next
>to it), Subscriber 2, then Publisher.  During system testing I unplugged
>Subscriber 1 to test failover.  The 7936 failed over as expected to
>Subscriber 2.  None of the other phones failed over.
>
>To see what is going on I did a sniffer trace on a 7970's switch port.
>The phone tries valiantly to connect to Subscriber 1 - both via TCP to the
>CCM registration port and via TFTP.  Of course it fails.  It then tries an
>SRST connection to its default gateway which also fails because we're not
>running SRST on the core router.  It then starts the cycle again - always
>trying to connect to Subscriber 1.
>
>So I went into the menus and erased the config.  I then power cycled - not
>just ##*##'d - the phone.  It did the DHCP dance then again tried to
>contact Subscriber 1.  Cisco Option 150 did indeed return the set
>{Subscriber 1, Subscriber 2}.  Doesn't seem to phase the phone...
>
>This is the latest 7970 load - 6.0.2SR1.  The system is set for
>authentication plus encryption.  I run another similar system with
>7940/7960 phones that does not exhibit this problem (it's a production
>system so I can't just plug in a 7970 and fail its subscriber to see what
>happens).
>
>No failover is a Bad Thing(tm).
>
>I contacted the TAC last week and they are "looking into it".  So far
>their only comment has been to check the LMHOSTS/HOSTS files on the
>publisher and subscribers; these are correct and I'm using IP addresses
>throughout anyway.  Othern' that they've come up with zero.
>
>Anybody out there run into a similar problem or have any ideas?  The
>system is scheduled for deployment in two weeks and this is pretty much
>the only problem I've seen in testing - and it's a BIG one!!
>
>Thanks!!
>
>Mike
>_______________________________________________
>cisco-voip mailing list
>cisco-voip at puck.nether.net
>https://puck.nether.net/mailman/listinfo/cisco-voip
>  
>