<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>In the case of WebEx / CMR Cloud; I believe WebEx will only support TLS for certificate verification when a CA signed certificate (TLS verify) is used, hence the base need for 5061 with a CA signed certificate even if the call is unencrypted.
</p>
<p><br>
</p>
<p>In the WebEx Meeting Center Video Conferencing Enterprise Deployment guide for WBS30 (<a class="OWAAutoLink" href="https://help.webex.com/docs/DOC-5355">https://help.webex.com/docs/DOC-5355</a>), it does appear to suggest on page 7 that self-signed certificates
can be used on the edge for signaling and media purposes with WebEx; although I have no experience with this as I have only ever participated in edge scenarios with CA signed certificates.
</p>
<p><br>
</p>
<p>I suppose as long as the WebEx Meeting Center has the self-signed certificate in the trust it would work; although getting Cisco WebEx cloud to do this for the customer; I do not know but my suspicion would be no and valid CA certs may be required, hence
TLS verify/port 5061 required.</p>
<p><br>
</p>
<p>That's my guess anyway,</p>
<p><br>
</p>
<p>-RH</p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size: 12pt; background-color: rgb(255, 255, 255);">
</div>
</div>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font color="#000000" face="Calibri, sans-serif" style="font-size:11pt"><b>From:</b> bmeade90@gmail.com <bmeade90@gmail.com> on behalf of Brian Meade <bmeade90@vt.edu><br>
<b>Sent:</b> Thursday, August 24, 2017 4:37 PM<br>
<b>To:</b> Anthony Holloway<br>
<b>Cc:</b> Jonathan Charles; Ryan Huff; cisco-voip@puck.nether.net<br>
<b>Subject:</b> Re: [cisco-voip] Outbound Video Calls to Webex fail with 481</font>
<div> </div>
</div>
<div>
<div dir="ltr">That's not the normal way that TLS call setup works which tries to connect at 5061 from the start and does the TLS handshake. WebEx might do some non-standard things though to try to force TLS.</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Aug 24, 2017 at 2:34 PM, Anthony Holloway <span dir="ltr">
<<a href="mailto:avholloway+cisco-voip@gmail.com" target="_blank">avholloway+cisco-voip@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">Wait, explain that to me. So, your original call setup was over port 5060, where you received the 481, but then mid-call something tried to switch to port 5061? Is that how escalation to encrypted SIP happens? Starts on 5060 as clear text,
then switches over to 5061 for encryption? I'm obviously showing my ignorance with this, but willing to learn in spite of it.</div>
<div class="HOEnZb">
<div class="h5"><br>
<div class="gmail_quote">
<div dir="ltr">On Thu, Aug 24, 2017 at 1:19 PM Jonathan Charles <<a href="mailto:jonvoip@gmail.com" target="_blank">jonvoip@gmail.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">Just an FYI, I did get this fixed... the firewall guy told me all rules were implemented... and nothing was being blocked.
<div><br>
</div>
<div>Turned out he did a permit for sip on the ACL, which did not include 5061...</div>
<div><br>
</div>
<div>Added 5061 and it works.</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks!</div>
</div>
<div dir="ltr">
<div><br>
</div>
<div><br>
</div>
<div>Jonathan</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Sun, Aug 20, 2017 at 7:53 PM, Jonathan Charles <span dir="ltr">
<<a href="mailto:jonvoip@gmail.com" target="_blank">jonvoip@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">Ok, let me poke around a bit... I assume every problem is because of the firewall...<span class="m_-4445547861259901150m_1496950737120279579HOEnZb"><font color="#888888">
<div><br>
</div>
<div><br>
</div>
<div>Jonathan</div>
</font></span></div>
<div class="m_-4445547861259901150m_1496950737120279579HOEnZb">
<div class="m_-4445547861259901150m_1496950737120279579h5">
<div class="gmail_extra"><br>
<div class="gmail_quote">On Sun, Aug 20, 2017 at 7:36 PM, Ryan Huff <span dir="ltr">
<<a href="mailto:ryanhuff@outlook.com" target="_blank">ryanhuff@outlook.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="auto">
<div>To expand on this; it really sounds like where your trouble happens is during a re-invite event. If that is the case, it could very well be DNS as mentioned OR less likely (but plausible), a TCP timeout mismatch on a firewall.</div>
<div id="m_-4445547861259901150m_1496950737120279579m_6804235212589423170m_8441752709796754753AppleMailSignature">
<br>
</div>
<div id="m_-4445547861259901150m_1496950737120279579m_6804235212589423170m_8441752709796754753AppleMailSignature">
The codec logs and CCM trace will tell the tale for sure though.<br>
<br>
Thanks,</div>
<div id="m_-4445547861259901150m_1496950737120279579m_6804235212589423170m_8441752709796754753AppleMailSignature">
<br>
</div>
<div id="m_-4445547861259901150m_1496950737120279579m_6804235212589423170m_8441752709796754753AppleMailSignature">
Ryan</div>
<div>
<div class="m_-4445547861259901150m_1496950737120279579m_6804235212589423170h5">
<div><br>
On Aug 20, 2017, at 6:36 PM, Ryan Huff <<a href="mailto:ryanhuff@outlook.com" target="_blank">ryanhuff@outlook.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div>This might have to do with DNS. I would review all your internal/external SRV/A records for EXP/CUCM and your DNS zone in EXP.</div>
<div id="m_-4445547861259901150m_1496950737120279579m_6804235212589423170m_8441752709796754753AppleMailSignature">
<br>
</div>
<div id="m_-4445547861259901150m_1496950737120279579m_6804235212589423170m_8441752709796754753AppleMailSignature">
It sounds like the call is traversing expressway, but call manager may be having trouble finding the call leg via DNS, to connect the codec to.<br>
<br>
Pulling CCM traces and debug logs on the codec for a failed call will tell you for sure.</div>
<div id="m_-4445547861259901150m_1496950737120279579m_6804235212589423170m_8441752709796754753AppleMailSignature">
<br>
Thanks,</div>
<div id="m_-4445547861259901150m_1496950737120279579m_6804235212589423170m_8441752709796754753AppleMailSignature">
<br>
</div>
<div id="m_-4445547861259901150m_1496950737120279579m_6804235212589423170m_8441752709796754753AppleMailSignature">
Ryan</div>
<div><br>
On Aug 20, 2017, at 6:30 PM, Jonathan Charles <<a href="mailto:jonvoip@gmail.com" target="_blank">jonvoip@gmail.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div dir="ltr">Just a single VCSC and VCSE.... single CUCM 11.5... this is just a proof of concept...
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Jonathan</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Sun, Aug 20, 2017 at 5:27 PM, Ryan Huff <span dir="ltr">
<<a href="mailto:ryanhuff@outlook.com" target="_blank">ryanhuff@outlook.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
Do you have EXP clusters or is this a single C/E pair?<br>
<br>
Sent from my iPhone<br>
<div>
<div class="m_-4445547861259901150m_1496950737120279579m_6804235212589423170m_8441752709796754753h5">
<br>
> On Aug 20, 2017, at 6:26 PM, Jonathan Charles <<a href="mailto:jonvoip@gmail.com" target="_blank">jonvoip@gmail.com</a>> wrote:<br>
><br>
> We have an SX80 connected to CUCM 11.5 and VCSC 8.10 to a VCSE 8.10...<br>
><br>
> Outbound calls route to Webex, you see them enter the meeting and then after 4 seconds, they drop, the VCS E shows<br>
><br>
> 481 Call/Transaction Does Not Exist<br>
><br>
> Does anyone have any ideas?<br>
><br>
><br>
><br>
><br>
> Jonathan<br>
><br>
><br>
</div>
</div>
> ______________________________<wbr>_________________<br>
> cisco-voip mailing list<br>
> <a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
> <a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank" rel="noreferrer">
https://puck.nether.net/<wbr>mailman/listinfo/cisco-voip</a><br>
</blockquote>
</div>
<br>
</div>
</div>
</blockquote>
</div>
</blockquote>
<blockquote type="cite">
<div><span>______________________________<wbr>_________________</span><br>
<span>cisco-voip mailing list</span><br>
<span><a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a></span><br>
<span><a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/<wbr>mailman/listinfo/cisco-voip</a></span><br>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
______________________________<wbr>_________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank" rel="noreferrer">https://puck.nether.net/<wbr>mailman/listinfo/cisco-voip</a><br>
</blockquote>
</div>
</div>
</div>
<br>
______________________________<wbr>_________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank" rel="noreferrer">https://puck.nether.net/<wbr>mailman/listinfo/cisco-voip</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</body>
</html>