IP phones over site2site VPN - one way audio ?

[afrogley]

IPO 406v2 4.2.4

IPO Lan2 - router - vpn - router - IP phone

I (on a digital set) can hear the IP phone user - they cannot hear me. IP Phones are 56xx on 2.010 and are shown in ip phone status as registered.
Lan2 is also used for external SIP calls - these are working fine.
Lan1 has some IP phones too - they are working fine.


Tests -
ping from IP phone network to IPO lan2 - no drops, time=30-40ms
ping from IPO sys status to IP Phone - no drops, time=30-40ms

For once - I haven't changed any settings and this was working fine yesterday and the day before (day before is when I replaced the routers with some CISCO 887s) ...

Where do I go from here? Except home whilst turning my phones off!
TIA

 

[afrogley]

Just had a look at the System resources - when I make the call to an IP Phone from my digital one - the VCM in use count goes up by 1.

 

[tlpeter]

Routing is your problem.


BAZINGA!

I'm not insane, my mother had me tested!

 

[afrogley]

That's what I've been working on - but can't figure it out ...

if I do a tracert from the private side of the VPN to the private side of the other VPN I don't get a response from the other Cisco Router - also I cannot ping the private address of router1 from router2 console ...
But I couldn't do that yesterday either ...

 

[amriddle01]

A post in the Cisco forum may be advisable then

ACSS (SME)
APSS (SME)

http://www.ipoffice.tel

"I'm just off to Hartlepool to buy some exploding trousers

 

[afrogley]

I've posted in Cisco's own support community ... just waiting for a response .. but rapidly loosing the will to live ...

Last time I posted on tek-tips cisco forum and here I got a response in this section first - and the response was more appropriate!

 

[hairlessupportmonkey]

so are the two networks on different subnets?

So e.g

LAN1 = 192.168.1.1 --> Cisco = 192.168.1.254 -->VPN<-- Cisco = 192.168.2.254 --> IP Phones 192.168.2.x

then a route on your IPO = 192.168.2.0 / mask 255.255.255.0 / GW 192.168.1.254 / LAN 1

ACSS - SME

 

[hairlessupportmonkey]

Also on the 887 check your NAT rules, and make sure you have the correct network being NATed.

If all else fails, factory the Cisco's and use the IP SEC site to Site vpn wizard.

Works all the time for me.

ACSS - SME

 

[afrogley]

Thanks

the IPO (lan2) is on 10.10.10.10 (10.10.10.0 255.255.255.0) and the IP phones are on 192.168.50.x.
The IPO has the route set 192.168.50.0 255.255.255.0 10.10.10.1

I've got a line on the router config:
no nat service sip udb port 5060

whether this is enough or right - i dunno!

 

[hairlessupportmonkey]

is it SIP calls that are one way speech?

if so, you need to run STUN on your LAN2 network topology, and on your SIP line use LAN2 rather than an IP route.

you will need to see if your SIP provider offers a STUN server or not, but doesn't sound like it otherwise they would be using proper SBCs

ACSS - SME

 

[afrogley]

it's any calls with the remote office - our SIP calls over lan2 are fine - and that's from IP Phones connected to LAN1 as well as the digital phones.

From the remote network I can ping 10.10.10.10 - response times 30-40ms
However, if I tracert 10.10.10.10 I get
1 <1ms <1ms <1ms 192.168.50.254 (this is the default internet gateway for PC's)
2 <1ms <1ms <1ms 192.168.50.252 (this is the site2site vpn gateway)
3 * * * Request timed out.
4 * * * Request timed out

and so on ..

Contrary - if I tracert 10.10.10.1 then I get
1 <1ms <1ms <1ms 192.168.50.254
2 <1ms <1ms <1ms 192.168.50.252
3 33ms 36ms 32ms 10.10.10.1

Trace Complete

....
!!
So - I can ping the Avaya Lan2 but cant trace the route!! Does this seem to be a route or NAT problem (or both ?)

 

[amriddle01]

You tried path ping ?

ACSS (SME)
APSS (SME)

http://www.ipoffice.tel

"I'm just off to Hartlepool to buy some exploding trousers

 

[afrogley]

not till just now - similar results as tracert ...

pathping from 192.168.50.10 to 10.10.10.1 is ok - nothing lost.
pathping from 192.168.50.10 to 10.10.10.10 is not ok - everything lost - it gets to 192.168.50.252 - then ziltch ...

right - who was it who suggested Cisco routers would be a good replacement for Netgear rubbish?! ....

 

[afrogley]

Crisis over -

a simple route command was all that was needed (except I didn't know how it should've been written) ...

It is:
ip route <remoteip> <remotemask> <remotepublicip>

Thank you VERY much for not calling me a complete prat ... you can do this now .... IF you can explain why it's worked fine for the previous two days without this blummin route statement!!

now - perhaps I can get on with some work!