VoIP system - cm fallback service operating - small site

Posted on 2011-05-03
Last Modified: 2012-05-11
We're currently experiencing a strange issue at one of our sites (site 2 in this example) that consists of only 2 employees.  Here is a brief summary of our environment.

Main site - hosts a single CUCM server and unity server.  We have two additional sites that use the VoIP system with cisco routers tied to POTS lines as a fallback service in case they drop connectivity.

Site 1 (large site): is connected via a dedicated circuit.  T1 - no issues.

Site 2 (small site): is connected via a VPN tunnel over the cloud (I know, I know).

As of two weeks ago, Site 2 began having issues with intermittent dropped calls.  Several times a day, an employee will pick up the phone (to answer a call) and the hears a slight click and notices the call was lost.  His phone (7940) then displays "cm fallback service operating" or something similar for about 30 seconds and comes back online.  Each phone at this site does this.

Troubleshooting done thus far:
1) Monitored bandwidth to ensure that was not a problem.  They aren't even close to maxing their bandwidth.  I noticed 300kbps up spikes but this isn't anywhere near the 3mbps up max we purchased.
2) Our SNMP software and the ISP show connectivity has been very stable between sites.  I've also run a continuous ping for a couple days and only a few packets have dropped.
3) Our Cisco engineer (outsource hire) doesn't see anything strange on the router/ASA.  
4) Power cycled the modem, router, ASA (firewall), and switch.
5) Before I was informed both employees were having issues, I tried swapping phones, new cables, etc.

No changes have been made except the POTS provider did have an outage in the area around the time these problems began.  At the time, 5 of our 6 pots lines were out of service.  They are telling us the lines are functioning properly at this point.  Outgoing calls never seem to drop, only incoming thus far.  We've ensured all lines are working by simply calling each line directly.

Any ideas on what we should try next?
Question by:MegafabTech

    Author Comment

    We have setup logging on our routers to point to our local Kiwi Syslog server.  I am noticing that when the employees receive that message on their phones, I see the following message on the sites router:

    "date\time\ip\%IPHONE-6-REGISTER_NEW: ephone:<mac address> IP: <ip address> Socket: <socket> DeviceType: Phone has registered normally."

    Approximately 20-30 seconds later

    ""date\time\ip\%IPHONE-6-REGISTER_NEW: ephone:<mac address> IP: <ip address> Socket: <socket> DeviceType: Phone has unregistered normally."

    I believe this is when the router takes over as the fallback service then unregisters once the phone can connect to the call manager again.
    LVL 79

    Expert Comment

    Looks like there is a timing issue between the Call Manager and the SRST feature on the local router.
    In the device pool for the remote site, there is a field for "Connection Monitor Duration"
    The default is 120 seconds, but in your case you might want to increase this timeout.
    If the phone is unregistering, then registering, that means the phone looses connection to the CallManager.
    So, you have an ASA at the main site and "what" at the remote site? 1861?
    Assuming they are connected via site-site VPN, do you have keeplives enabled?

    Accepted Solution

    We do have an ASA at both sites.  However, they weren't causing the issues.  We simply restarted our call manager and all of the problems were fixed.  Before-hand, all of our cisco soft phones were having issues dropping calls and re-registering over and over.  Very strange issues.  We're planning on updating our system as patches have indicated they fix memory leaks and so on.  Thanks for the recommendations!

    Author Closing Comment

    I forgot to mention, this occurred on CCM 6.1.2.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
    Every year the snow affects people and businesses. According to the Federation of Small Businesses (FSB), in 2009, UK businesses lost an estimated £1.2bn ( because of bad weather. This article was c…
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now