Solved

Cisco IP Phones Reset Randomly!!

Posted on 2013-01-08
21
4,967 Views
Last Modified: 2013-02-01
Hello,

One of my clients is having a problem that is proving very difficult to track down. They have an inhouse VoIP solution using Cisco UC540 and SPA525G2 phones. The switch is a Cisco Cmall Business SF 300 48 port for PoE. The problem is that phones randomly reset dropping any active calls. They do not seem to reboot however from a power issue considering the phone reboot history is not showing the events and their uptime shows months since the last reboot. The power consumption on the switch is well below concerning and shows no errors. What does happen is that the phone re-registers. Here is a snippet of the log from the UC540 right after one such event:

13339: Jan  8 18:54:40.286: %IPPHONE-6-REG_ALARM: Name=SEP708105B39B90  Load=7.5.1a Last=Hard+Unknown
013340: Jan  8 18:54:40.598: %IPPHONE-6-UNREGISTER_ABNORMAL: ephone-4:SEP708105B39B90 IP:10.1.1.15 Socket:20 DeviceType:Phone has unregistered abnormally.
013341: Jan  8 18:54:40.598: %IPPHONE-6-REGISTER: ephone-4:SEP708105B39B90 IP:10.1.1.15 Socket:13 DeviceType:Phone has registered.
013344: Jan  8 18:55:52.418: %IPPHONE-6-REG_ALARM: Name=SEP708105B39D50  Load=7.5.1a Last=Hard+Unknown
013345: Jan  8 18:55:52.626: %IPPHONE-6-UNREGISTER_ABNORMAL: ephone-18:SEP708105B39D50 IP:10.1.1.20 Socket:10 DeviceType:Phone has unregistered abnormally.


I am really getting heat to address the issue but I don't have much more to go on than this log. The frustrating thing is that it happens randomly and it normally is just one phone at a time. I have found one similar post about disabling proxy arp on our firewall (ASA 5505) which I am tempted to do but I am not sure if this will affect our NAT or ACLs on the firewall.

https://supportforums.cisco.com/thread/2031857

Anyone have any possible solutions or leads?
0
Comment
Question by:DDI4U
  • 10
  • 5
  • 4
  • +2
21 Comments
 
LVL 20

Expert Comment

by:rauenpc
ID: 38757643
Cisco TAC. Troubleshooting is very difficult when using cisco small business products because of their GUI focus. I cringe every time I have to work on the smb product line...
0
 
LVL 20

Accepted Solution

by:
agonza07 earned 500 total points
ID: 38757815
Is the UC540 on the same LAN or are the phones remote?

I would try to upgrade the firmware on both the switch and phones to see if the issue still continues.
0
 
LVL 20

Expert Comment

by:agonza07
ID: 38757824
Check this out too.

https://supportforums.cisco.com/thread/2085983

Although mostly talks about teleworkers, maybe those firmware versions will help you out. Looks like they updated the UC560 code to and that seemed to resolve the issue. not sure if it'll apply to you but worth looking into.
0
 

Author Comment

by:DDI4U
ID: 38759366
Thanks for the responses. The phones are on the same LAN with only two offsite. I moved a few of the phones that have been reported to reset directly to the UC bypassing the switch to see if they still reboot. I will check the link provided and consider firmware updates.
0
 
LVL 76

Expert Comment

by:arnold
ID: 38761918
Another thought might be a fluctuation in power I.e. there is a bad/leaky feed/patch cable leading to a drop in power.
Wiggle the patch cable and see if the phone resets.
If you have the option, connect the phones to a different port on the switch.
Switching phones to see whether the issue follows the phone or remains with the run.
0
 

Author Comment

by:DDI4U
ID: 38763120
I really don'tjj think it's a power issue as mentioned considering the phones do not report ever rebooting but rather just re-registering. To debug however I moved a few of the phones that I know have had the issue directly to the UC to rule out the switch as a culprit. I am currently monitoring them and have not received word of a reset yet.
0
 
LVL 76

Expert Comment

by:arnold
ID: 38763725
Presumably all your phones have a similar firmware. If you could clone the configuration of the phone with this issue and see if the replacement encounters a similar issue.
0
 

Author Comment

by:DDI4U
ID: 38768268
This just happened at another client who has a similar setup (UC540, SF 300 switch, SPA525G2 phones) however in this case ALL of the phones rebooted. I checked the switch and it shows it has been online for 55 days, the UC shows it has been up for 30 days, and none of the phones show an event in the reboot history. So to me this means they didn't lose power but rather lost ethernet or some other reason for re-registering. This is a HUGE problem!
0
 
LVL 76

Expert Comment

by:arnold
ID: 38768343
With the all event, check whether DHCP expiration is what led to this.
Historically do you record what IPs each phone has versus what IP each phone has after the "reset"?
i.e. the DHCP server had issues in confirming the existing IPs or assigning new ones.  A loss of IP or assignement of a new one, might be what caused the reset.

Updating the Software/firmware to the most current might be a cure in the latest situation. The former, something else might be going on.

Do you have an option to use SNMP to monitor the UC and the Switch?
Do you have an option to setup an SNMPTRAPD receiver and then configure UC and the switch to trap events?
0
 

Author Comment

by:DDI4U
ID: 38768971
Both sites had DHCP leases set to 1 day so I have changed it to infinite for both. No I have not recorded the IPs but thats not a bad idea.

SNMP is an option on both the UC and the switch. I know the UC can do traps but I do not have any experience working with SNMP so not sure what to do to set it up and/or monitor it.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 76

Expert Comment

by:arnold
ID: 38769094
Cacti.net can poll and record certain performance data. Snmptrapd are for specific events. On the switch, you would want an event when a port status link changes.
Is the UC also used to provide PC data networking functionality or the data/voice networks are completely separated?

First thing to chek which I believe was suggested deals with the updates available. The setup is not recent and this began recently?
0
 

Author Comment

by:DDI4U
ID: 38769154
The UC is used as the gateway as each phone is supplying data from its pc port. The phones and data are on separate vlans however. Both sites are relatively new installs but the reboots haven't occurred until the past couple weeks an no updates have been done to prompt it. I will update firmware if thats the route to go next but the firmware used on everything was updated during the install which was two months ago for the second client and 4 months ago for the first.
0
 
LVL 76

Expert Comment

by:arnold
ID: 38769271
The issue might be triggered by the PC data rather than phone related.
0
 

Author Comment

by:DDI4U
ID: 38789290
I am not sure what you mean Arnold.

To give you an update, the initial client I reported this issue for has not had any of the reset problems since I moved some of the phones to the UC and off the switch along with some other changes including DHCP lifetime, disabling Green Ethernet on the switch, etc. However the second client had all of their phones reboot twice just yesterday even after these changes have been made.
0
 
LVL 20

Expert Comment

by:agonza07
ID: 38789407
Try updating all your firmware.

Also, make sure your not pegging the processor with some debug commands. had that happen to me today... :(
0
 

Author Comment

by:DDI4U
ID: 38789477
@agonza07

The processor on the UC I assume?
0
 
LVL 20

Expert Comment

by:agonza07
ID: 38789561
correct. you can do a show process and it'll show you cpu utilization.
0
 

Author Comment

by:DDI4U
ID: 38789590
Yeah, i don't think that is the case as it happens when I am not onsite and have no debugs going on at the time. Thanks for the input though... i will be updating firmware on the switch tonight and will be taking some of the phones off the switch going directly to the UC540 to see if they still reboot.
0
 

Expert Comment

by:ricperez56
ID: 38821969
Arghhh.

We had this problem. It turns out that we had more phones than licenses in our UC. Believe it or not, once we bought more licenses, our troubles ended. Check out licences VS the number of phones you are trying to use. I know it sounds strange.
0
 

Author Comment

by:DDI4U
ID: 38828838
Thanks but we have plenty of licenses as only 20 phones are connected. So far we have not had the resets since the switch firmware upgrade but I have been out of town for a week so I will be checking on things tomorrow.
0
 

Author Closing Comment

by:DDI4U
ID: 38845020
Ultimately it appears that the firmware update on the switch did the trick. Thanks!
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Suggested Solutions

If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
As companies replace their old PBX phone systems with Unified IP Communications, many are finding out that legacy applications such as fax do not work well with VoIP. Fortunately, Cloud Faxing provides a cost-effective alternative that works over an…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now