7941G-GE's and 7961G-GE's. I'm not sure what the failover is, but it's most likely the default in CUCM 7.1.3<div><br></div><div><br></div><div>For those following along at home, I found the following error messages in my ASA's logs (both ends of the VPN termination):</div>
<div><br></div><div><br></div><div><div>Teardown TCP connection 541098 for elan:x.x.x.202/2000 to VOIP:x.x.x.x/38034 duration 0:33:51 bytes 9220 Flow closed by inspection</div><div>%ASA-6-106015: Deny TCP (no connection) from x.x.x.202/2000 to x.x.x.160/38034 flags PSH ACK on interface elan</div>
<div>%ASA-6-106015: Deny TCP (no connection) from x.x.x202/2000 to x.x.x.160/38034 flags PSH ACK on interface elan</div><div>%ASA-6-106015: Deny TCP (no connection) from x.x.x.202/2000 to x.x.x.160/38034 flags PSH ACK on interface elan</div>
<div>%ASA-6-106015: Deny TCP (no connection) from x.x.x.202/2000 to x.x.x.160/38034 flags PSH ACK on interface elan</div><div><br></div><div>I've removed </div><div>inspection skinny </div><div>from both ends of my ASA</div>
<div><br></div><div>And after a few minutes of insane confusion (calls lost, call on hold that cannot be picked up), things seem to be better. I'm not logging any error messages on any phone's I've been tracing.</div>
<div><br></div><div>I can't for the life of my figure out why this only showed up last thursday, after 13 months of production use. (again, no changes in the network since Last October, when the system was upgraded from 4.2.3 to 7.1.3)</div>
</div><div><br><br><div class="gmail_quote">On Mon, Feb 8, 2010 at 1:31 PM, Wes Sisk <span dir="ltr"><<a href="mailto:wsisk@cisco.com">wsisk@cisco.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div bgcolor="#ffffff" text="#000000">
VOIP is very sensitive. What model phones are these and what type of
failover do you have configured for the phones?<br>
<a href="http://puck.nether.net/pipermail/cisco-voip/2009-May/001155.html" target="_blank">http://puck.nether.net/pipermail/cisco-voip/2009-May/001155.html</a><br>
<br>
The failover type determines TCP stack behavior on the phones. The
underlying cause is dropped or delayed packets in your network. Other
applications are just more forgiving.<br>
<br>
You can try "slow failover" to be more lenient on signaling. However,
if you are running RTP over those links the RTP will still be
negatively impacted.<br><font color="#888888">
<br>
/Wes</font><div><div></div><div class="h5"><br>
<br>
On Monday, February 08, 2010 1:13:09 PM, Mike King
<a href="mailto:me@mpking.com" target="_blank"><me@mpking.com></a> wrote:<br>
</div></div><blockquote type="cite"><div><div></div><div class="h5">I forgot to add:
<div><br>
</div>
<div>VPN uptime counter is at 6days and change.</div>
<div><br>
</div>
<div>Have several line of business applications that are running thru
Citrix that are not being affected.</div>
<div>Nobody is noticing any drops in connectivity (I know that VoIP
is very sensitive)<br>
<br>
<div class="gmail_quote">On Mon, Feb 8, 2010 at 1:04 PM, Matthew
Ballard <span dir="ltr"><<a href="mailto:mballard@otis.edu" target="_blank">mballard@otis.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left:1px solid rgb(204, 204, 204);margin:0pt 0pt 0pt 0.8ex;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:11pt;color:rgb(31, 73, 125)">I would first check
the VPN for issues. You should be able to
check uptime on the VPN connection, if that is staying low, and
therefore
interrupting communication with UCM, that would cause those problems.
Could be
an issue with the provider connecting the sites.</span></p>
<p class="MsoNormal"><span style="font-size:11pt;color:rgb(31, 73, 125)"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt;color:rgb(31, 73, 125)">Matthew Ballard</span></p>
<p class="MsoNormal"><span style="font-size:11pt;color:rgb(31, 73, 125)">Network Manager</span></p>
<p class="MsoNormal"><span style="font-size:11pt;color:rgb(31, 73, 125)">Otis College of Art
and Design</span></p>
<p class="MsoNormal"><span style="font-size:11pt;color:rgb(31, 73, 125)"><a href="mailto:mballard@otis.edu" target="_blank">mballard@otis.edu</a></span></p>
<p class="MsoNormal"><span style="font-size:11pt;color:rgb(31, 73, 125)"> </span></p>
<div style="border-style:solid none none;border-color:rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color;border-width:1pt medium medium;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10pt">From:</span></b><span style="font-size:10pt">
<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>
[mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>]
<b>On
Behalf Of </b>Mike King<br>
<b>Sent:</b> Monday, February 08, 2010 9:43 AM<br>
<b>To:</b> Cisco VoIPoE List<br>
<b>Subject:</b> [cisco-voip] Connectivity problem with remote site</span></p>
</div>
<div>
<div>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Starting last week, I've had one of my site go
a little bit
looney. Dropping calls, Phones saying UCM down, Pushing the extension,
getting dialtone, dialing, and having a live call already on the line.</p>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">It looks like a connectivity issue, but I
can't figure out
what's going on. The site has been up for about 13 months with no
issues.. Nothing has changed in the network.</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">I'm pinging a bunch of the phones. They
haven't
dropped any packets, and all my pings are 2ms or less.</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">here's what's on the phone Display log:</p>
</div>
<div>
<div>
<p class="MsoNormal">8:24:07a 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP</p>
</div>
<div>
<p class="MsoNormal"> 8:24:11a 23: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=Reset-Restart </p>
</div>
<div>
<p class="MsoNormal"> 10:23:00a 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP </p>
</div>
<div>
<p class="MsoNormal"> 10:23:05a 23: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=Reset-Restart </p>
</div>
<div>
<p class="MsoNormal"> 10:57:17a 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP </p>
</div>
<div>
<p class="MsoNormal"> 10:57:21a 23: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=Reset-Restart </p>
</div>
<div>
<p class="MsoNormal"> 11:11:00a 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP </p>
</div>
<div>
<p class="MsoNormal"> 11:11:05a 23: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=Reset-Restart </p>
</div>
<div>
<p class="MsoNormal"> 11:19:24a 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP </p>
</div>
<div>
<p class="MsoNormal"> 11:19:28a 23: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=Reset-Restart </p>
</div>
<div>
<p class="MsoNormal"> 11:21:41a 23: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=Reset-Restart </p>
</div>
<div>
<p class="MsoNormal"> 11:46:48a 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP </p>
</div>
<div>
<p class="MsoNormal"> 11:46:56a 23: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=Reset-Restart </p>
</div>
<div>
<p class="MsoNormal"> 11:56:38a 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP </p>
</div>
<div>
<p class="MsoNormal"> 11:57:01a 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP </p>
</div>
<div>
<p class="MsoNormal"> 11:57:01a 18: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=Failback </p>
</div>
<div>
<p class="MsoNormal"> 12:22:20p 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP </p>
</div>
<div>
<p class="MsoNormal"> 12:22:25p 23: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=Reset-Restart</p>
</div>
<div>
<div>
<p class="MsoNormal"> 12:27:55p 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP</p>
</div>
<div>
<p class="MsoNormal"> 12:28:37p 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP </p>
</div>
<div>
<p class="MsoNormal"> 12:28:38p 18: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=Failback </p>
</div>
<div>
<p class="MsoNormal"> 12:29:02p 14: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=UCM-closed-TCP </p>
</div>
<div>
<p class="MsoNormal"> 12:29:06p 23: Name=SEP00235E18F284 Load=
SCCP41.8-5-3S
Last=Reset-Restart </p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">I've been pinging the phones since 12:00, so
I've had at
least 3 "events" while I've been pinging it.</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">UCM-closed-TCP indicates that a firewall
closed the
connection.</p>
</div>
<div>
<p class="MsoNormal">I have a L2L vpn between sites:</p>
</div>
<div>
<p class="MsoNormal">CUCM -> 6509 -> ASA5550 ===IPSEC===>
ASA5505 ->
Switch -> Phone</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">Where can I look for more information to
diagnose what's
going on?</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">Mike</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div></div><pre><hr size="4" width="90%"><div class="im">
_______________________________________________
cisco-voip mailing list
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a>
</div></pre>
</blockquote>
<br>
</div>
</blockquote></div><br></div>