[cisco-voip] Connectivity problem with remote site

[Ryan Ratliff]

I'd set up a sniffer behind one of the phones (turn on span to pc port) and let it run until the phone resets.  If you can get the same capture going at the CUCM server it will go a long way.

Reset-Restart is simply somebody clicking the Restart button in CCMAdmin.

UCM-closed-TCP does mean the TCP session got terminated, but it doesn't have to have been a firewall doing it.  Getting the capture at the phone and CUCM will give you a better idea of what's going on, as it is network related.

-Ryan

On Feb 8, 2010, at 12:43 PM, Mike King wrote:

Starting last week, I've had one of my site go a little bit looney.  Dropping calls, Phones saying UCM down, Pushing the extension, getting dialtone, dialing, and having a live call already on the line.

It looks like a connectivity issue, but I can't figure out what's going on.   The site has been up for about 13 months with no issues..  Nothing has changed in the network.

I'm pinging a bunch of the phones.  They haven't dropped any packets, and all my pings are 2ms or less.

here's what's on the phone Display log:
8:24:07a 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP
 8:24:11a 23: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=Reset-Restart 
 10:23:00a 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP 
 10:23:05a 23: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=Reset-Restart 
 10:57:17a 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP 
 10:57:21a 23: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=Reset-Restart 
 11:11:00a 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP 
 11:11:05a 23: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=Reset-Restart 
 11:19:24a 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP 
 11:19:28a 23: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=Reset-Restart 
 11:21:41a 23: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=Reset-Restart 
 11:46:48a 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP 
 11:46:56a 23: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=Reset-Restart 
 11:56:38a 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP 
 11:57:01a 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP 
 11:57:01a 18: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=Failback 
 12:22:20p 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP 
 12:22:25p 23: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=Reset-Restart
 12:27:55p 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP
 12:28:37p 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP 
 12:28:38p 18: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=Failback 
 12:29:02p 14: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=UCM-closed-TCP 
 12:29:06p 23: Name=SEP00235E18F284 Load= SCCP41.8-5-3S Last=Reset-Restart 


I've been pinging the phones since 12:00, so I've had at least 3 "events" while I've been pinging it.

UCM-closed-TCP indicates that a firewall closed the connection.
I have a L2L vpn between sites:
CUCM -> 6509 -> ASA5550 ===IPSEC===> ASA5505 -> Switch -> Phone

Where can I look for more information to diagnose what's going on?

Mike


_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip