Cisco Call Manager 7.0.1 phone registration issue

Are the phones getting NAT'd unintentionally (perhaps the entire Voice VLAN)?  That might cause the same symptoms.

my mistake ... i meant to say source based NAT, and not source based routing.

Hrmm.. Source based routing may make sense here... it's bizarre actually, if i plug something into the 3750 switch at the remote site i can ping everywhere, traceroute etc.. but if i do it directly on the 3750 switch i can't get anywhere.. doesn't hop anywhere.. i'm wondering if it may be more of a routing issue, the only thing that confuses me is that the phone communicates with the call manager, the call manager sees it trying to register, then it just disconnects... odd behavior...

Sangamc: I've disabled SIP ALG but still no luck... i've got nat setup on both trusted sides of the firewall (As most firewall's do) when you say source based Nat'ing is this a config on the juniper itself? Where do i config this or is it a cli?

yes source based NAT is a config that goes on the policy, from the webui if you go to the policy list and click on 'edit' for the policy that would carry traffic from the phone to the server. click on advanced and you will see two different NAT settings for the policy, one is source translation and the other is destination translation. you want to enable source translation in this case.

from the cli this is what my source nat policy looks like

set policy id 1 from "Trust" to "Untrust"  "Voip-tel1" "Any" "ANY" nat src permit log
set policy id 1
exit

Quick question, does source translation need to be turned on on both sides of the tunnel? (local and remote firewalls) and do i just do it on the trust to untrust policy or both?

source NAT should only be required on the juniper that has the VOIP phone sitting behind it. this setup worked in my network. source based NAT on both junipers for us caused one way audio problems. (one party could hear the other party only)

Tried source based natting on the policy last night but still made no headway with it...  i'm at a loss

time to break out wireshark (free network sniffer http://www.wireshark.org/download.html )  maybe ?

some instructions for use with a Cisco switch:

http://supportwiki.cisco.com/ViewWiki/index.php/Cable_Monitor_Feature

hmmm, i didn't preview that cisco link well enough, you basically need only this part

Switch(conf)# monitor session 1 source interface Gi0/1
Switch(conf)# monitor session 1 destination interface Fa0/17


where you specify the source port as the port the phone is using and the destination where the wireshark machine sits (that machine BTW will not be able to do anything else whilst acting as a monitor destination)

I've reviewed wireshark traces however could not find anything specific that stands out to me, i'm reluctnat to attach wireshark traces due to sensitivty of the network, is there anything i should look for?

Hello Pathix.   Since you are getting the image download and basic settings set on the phone you can be pretty sure that your routing, VPN and other network infrastructure are working properly.  You should be able to get your phones registering with three quick steps:
1) check that your CCM auto reg is working (i.e. is enabled and there are DN numbers left)
2) open both the remote SSG and NS25 firewalls and disable in ALG (Configuration -> Advanced -> ALG) the following:  SCCP, H323 and MGCP.
3) delete the "half" created auto reg entries for the remote phone, and reset them.

After the above, your phones should come up no problem.

*** Technical details:  Unfortunately firewall makers and network app makers have never been good at getting together to decide what is good and bad application traffic.  Cisco is infamous for not sharing changing to is SCCP and MGCP traffic.  In newer CCM 7 and newer phone firmware some of the data sent between the phone devices has changed, which the Netscreen ALG doesnt like.  In general, you should often disable this type Application layer checking on firewalls in a multi-site VoIP system.  It will cause nothing but headaches.

Hope this works for you.

I'm almost there!! I disabled SCCP, MGCP, RTSP, alg's on both ends of the firewlal,  reset the phone, and the phone registered with cm, i could see it saying it waws registered, then within 5 seconds it unregistered itself.. I called the phone and it rang for about 1/8th of a ring then i got a busy signal... but the phone registered which is a step further.. now i get this in the debug display page

16:07:27 Invalid SCCP message! : ID :9b: PrimaryConnection is NULL - close connection and alarm in future 16:07:27 14: Name=SEP0024C4BE4932 Load= SCCP45.8-4-3S Last=UCM-closed-TCP 16:08:23 18: Name=SEP0024C4BE4932 Load= SCCP45.8-4-3S Last=Failback 16:09:23 14: Name=SEP0024C4BE4932 Load= SCCP45.8-4-3S Last=UCM-closed-TCP 16:09:23 Invalid SCCP message! : ID :9b: PrimaryConnection is NULL - close connection and alarm in future 16:09:23 14: Name=SEP0024C4BE4932 Load= SCCP45.8-4-3S Last=UCM-closed-TCP 16:10:18 18: Name=SEP0024C4BE4932 Load= SCCP45.8-4-3S Last=Failback 16:11:18 14: Name=SEP0024C4BE4932 Load= SCCP45.8-4-3S Last=UCM-closed-TCP

Any idea what would cause an invalid sccp message?

Also, make sure "Remote Device" is selected in the CallManager phone properties and that the phones are using the latest firmware for your current 7.0.1 CallManager (and not a later firmware).   You should consider upgrading to CallManager 7.1.2a as it fixes a lot of issue, or at least the latest in the 7.0 series.

Cordeos.. making those changes firxed hte issue! Thanks a million!! you're a life saver... I just upgraded to 7.0.2 last night because we were having an issue with caller name display not wokring on pstn calls... apparently a bug fix in 7.0.2 but it did not fix anything..