Avaya phones get locked in discovery mode

Consider the following. Office 1 that hosts the IP Telephony server have no problems. Office 2 are experiencing problems with their Avaya phones getting locked in Discovery mode every now and then.

We don't manage the telephony server but the technicians who do can't find anything wrong with it.

The two offices have Zyxel Zywall firewalls and there's a ipsec tunnel between the offices where the telephony traffic is routed.

The problem comes and goes with different phones where a phone can suddenly start or stop working.

We have seen packages being dropped in the firewall logs but we can't find anything wrong with the firewalls in question. We have even switched the office 2 firewall for a new one.

A collegue of mine tried some Telnet tests from office 2 to the telephony server and could only get through every now and then. It seems the Telnet call to the server goes through the tunnel but the reply from the server to the computer he used gets lost and generates a package dropped entry in the firewall log.

All other data that is routed through the tunnel seems to work without error.

We're really stumped here. Any help on what to try to do to solve this would be very appreciated.

If any clarification of the problem is needed let me know. This is an urgent issue!

Kind regards
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

NetExpert Network Solutions Pte LtdTechnical SpecialistCommented:
while the Avaya phones get locked in discovery mode, do you able to ping to the telephone server?

have you checked the tunnel keepalive timers in both firewalls?

Every few hours/mins, tunnel will renegotiate between peers ? i believe on that time, you might be getting the packet drops.

between, what firewall you are using in office 2 site?
joebilekAuthor Commented:

The Telephone server is reachable at that Point. The issue won't affect all phones at once at office 2. It will basically jump from a couple of phones to Another so at all times there will be working phones at the same time as phones stuck.

We've made sure the tunnels are alive. We see no indication it's ever been down.

We seem to get the packet drops at most times but I'm not sure how often the renegotiation you mention happen.

Office 1 is a Zyxel Zywall USG 50 and Office 2 is a Zyxel Zywall USG 60.
NetExpert Network Solutions Pte LtdTechnical SpecialistCommented:
Got it..

Since you saw packet drops on the firewall, there are two options which may cause this issue.

1. high utilization on the office 2 wan link and voice packets may not get priority to go out, hence the packets are in queue and phones will disconnect from telephone server(voip packets are more sensitive)

2. Same as office 1 wan link high utilization.

have you checked the link utilization on both site links? if the firewall has QoS option, you can prioritize voip packets
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

joebilekAuthor Commented:
If you by link utilization mean bandwith usage there should be plenty of room for the voip packets. we are nowere close to maxing out our bandwidth at either site. VOIP is also the only thing that's having problems. Other traffic through the tunnel seems to work and their internet based applications run smoothly. Perhaps voip is more sensitive though...

I'll check if there are a QoS setting.

Do you have any other ideas on what might be causing this.

We experienced the same thing 1 month ago but the problem perished on its own after 2 Days. Then all of a sudden it stopped working again this monday. There are even fewer people working at the sites at this time because of vacations so there should be an even lesser strain on the bandwidth.
joebilekAuthor Commented:
Can't find any QoS settings on the Zywall but I'm no expert on their configuration I'm afraid. Any further recommendations would be much appreciated.
NetExpert Network Solutions Pte LtdTechnical SpecialistCommented:
Thinking of other options.. I too not expert in the Zywall firewall

If you have options to capture the packet in switch level,  you can try to capture the packets from switch, while the phones are in discovered mode

Packet captures will give an idea about the reason of dropping packets.

If you dont have option to capture the packets in switch level, you can install avaya soft phone and capture the packets on the system

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
joebilekAuthor Commented:
Hi! For someone who has no previous experience with Avaya soft phone could you please instruct me how I would do this?

Kind regards
NetExpert Network Solutions Pte LtdTechnical SpecialistCommented:
This url may help you to collect logs from the avaya ip phone

joebilekAuthor Commented:
Thank you. I don't have access to the endpoint which I guess is the telephony server so I will check with the Company resposible for it if they can help me out with this.
NetExpert Network Solutions Pte LtdTechnical SpecialistCommented:
There are two options you can check the logs

1. Telephone server
2. IP Phone logs on the IP Phone itself. Every phone will have option to store few logs; I assume avaya also has the option
joebilekAuthor Commented:
It seems these guides aren't appliable to the phones and telephony server the customer possesses. Is there anything else I can do to try to figure out what's happening with the voip traffic on the network without having access to the telephony server?
Benjamin Van DitmarsSr Network EngineerCommented:
i have seen this before. normaly the avaya phone does a tftp to youre phone server to get its configuration. put an helper address on the vlan and point it to the phone server.

you can check this with a packet analyser like whireshark. start a capture and power on the phone.
see wat is going on. i think the helper will solve youre problem.
joebilekAuthor Commented:
We did go the wireshark route and found some strange activity in the Zyxel FW on the other side of the tunnel. A call to Zyxel support made us patch the firmware extensively which seems to have solved the issue.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.