Cisco IP phone is not registering to server

[BraveTiger]

Hi all,

I have Palo alto in my network connected to CISCO Call manager server and Cisco DX650 IP phone. I am facing issue that DX 650 is not registering to Call manager server when I capture log I found that the traffic comming from Call manager server and IP phone into Firewall is completing TCP connection but when outgoing traffic from firewall towards Call manager server and IP Phones is sending TCP (RST/ACK) message. I also have cisco 8811 IP phone which got registered so please help me with this

[RobinClayton]

Have you got denied traffic logged?

Does the phone have static or is it trying to obtain a DHCP IP address..

Is there a Proto Difference  between the two types of phone ( Skinny vs SIP )

[BraveTiger]

Hi, thank for reply 

All IP PHONES ARE WORKING ON STATIC IP 

I HAVE INFORCE ONE WAY POLYCY FROM IP PHONES  TOWARDS CUCM SERVER AND ALLOWED ANY APPLICATION OR PROTO..

DO I NEED TO INFROCE REVERSE POLICY FROM CUCM SERVER TOWARDS IP PHONES?

[BraveTiger]

Hi, thank for reply 

All IP PHONES ARE WORKING ON STATIC IP 

I HAVE INFORCE ONE WAY POLYCY FROM IP PHONES  TOWARDS CUCM SERVER AND ALLOWED ANY APPLICATION OR PROTO..

DO I NEED TO INFROCE REVERSE POLICY FROM CUCM SERVER TOWARDS IP PHONES?

[RobinClayton]

For registration the CUCM should not necessarily need a rule as the Phone is the client.

Have your got logging turned on for your "default interzone" block??  

Do you see any traffic  from the phone?

Is the routing from the phone to the CUCM correct?

You will need a rule from the CUCM to the phone for SIP/SCCP, and perhaps the RTP traffic.

[BraveTiger]

I HAVE 8 PHONES IN SAME RANGE FROM 

X.X.X.200 TO X.X.X.207   SIX OF THEM ARE 8811 WHICH GOT REGISTERED SUCCESSFULLY AND 2 OF THEM ARE DX650 FOR WHICH I AM FACING ISSUE . FOR DX 650 TRAFFIC FROM IP PHONE TO PALO ALTO AND FROM CUCM TOWARD PALO ALTO ARE ESTABLISING TCP CONNECTION BUT TRAFFIC FROM PALO ALTO TO DX 650 AND TOWARD CUCM ARE SHOWING (RST/ACK) . 

CUCM------------->PALOALTO<-----------IP PHONE

IS ESTABLISHING TCP CONNECTION 

BUT 

CUCM<------------PALOALTO----------->IP PHONE

IS SHOWING 【RST/ACK】

[RobinClayton]

Have you tried a full allow rule in both directions? That will indicate if it's a security policy or other issue.

[BraveTiger]

I am gonna try it tommorow and will let you know what happen

[BraveTiger]

I have tried a full allow rule in both directions but HTTP packets are getting a drop in both situation from the firewall which DX 650 IP Phone use to fetch configuration  from CUCM server

Tags (0)

Add tags

[BraveTiger]

I have tried a full allow rule in both directions but HTTP packets are getting a drop in both situation from the firewall which DX 650 IP Phone use to fetch configuration  from CUCM server

[RobinClayton]

Sounds like a L3 routing issue to me then.

Rob

[BraveTiger]

but all other phones are getting registred and all are in same range

[BraveTiger]

I have define service as Application default should I try with any services

[RobinClayton · Accepted solution]

What is in your Application?

You should remove application, and set service any in order to test unfiltered connections.

Rob

[RobinClayton]

Solved??? How?

[BraveTiger]

Not solved so far