[cisco-voip] testing new ACLs: VG224 issues

[Norton, Mike]

Where are you getting the idea of pinging from? ICMP != ping. There are many types of ICMP messages; Echo Request is only one of them. If I had to guess, the ICMP message being sent is probably an Unreachable that has something to do with the UDP traffic. Allowing the traffic and watching with Wireshark would be my next step.

--
Mike Norton
I.T. Support
Peace Wapiti School Division No. 76
Helpdesk: 780-831-3080
Direct: 780-831-3076


From: cisco-voip-bounces at puck.nether.net [mailto:cisco-voip-bounces at puck.nether.net] On Behalf Of Lelio Fulgenzi
Sent: December-01-11 1:46 PM
To: Cisco VoIPoE List
Subject: [cisco-voip] testing new ACLs: VG224 issues

I'm testing some new voice VLAN ACLs and have noticed a problem with a VG224 port calling an IP phone. If the IP phone puts the VG224 call on hold, no problem, but if the IP phone receives another inbound call and goes to answer it (automatically putting the VG224 call on hold) the VG224 call is dropped.

I noticed the following deny statements being logged.

list voice_endpoints_out denied icmp a.b.c.d -> i.j.k.l (3/3), 1 packet
list voice_endpoints_out denied udp w.x.y.z(19441) -> i.j.k.l(4001), 1 packet

a.b.c.d is the ip address of one of the ethernet interfaces where a ping packet would be sourced
w.x.y.z is the loopback address where voice traffic would be sourced
i.j.k.l is the IP phone

Why is the VG224 trying to ping my ip phone?
What is UDP traffic destined to 4001 all about?





---
Lelio Fulgenzi, B.A.
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1
(519) 824-4120 x56354 (519) 767-1060 FAX (ANNU)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Cooking with unix is easy. You just sed it and forget it.
                              - LFJ (with apologies to Mr. Popeil)

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20111201/123a37d5/attachment.html>