0

I have a Linux gateway with kernel 2.6.39 connected to a Cisco ASA 5500 with vpnc. I'm using iptables with masquerading and forwarding to give the LAN access to the tun0 device connected to the VPN.

My Cisco IP Phone 7941 can connect to the call manager but I only get one way audio when a call is established. tcpdump -i any on my LAN gateway shows the rtp traffic originating on my phone lan IP, then being NAT'ed to the tun0 address, and finally going over my ext interface encapsulated in esp. tcpdump on the tun0 interface only shows traffic going to the rtp destination from the tun0 src IP. From my LAN's viewpoint, outbound rtp traffic is being translated correctly.

However, the asa syslog shows my lan IP address - not my tun0 address - being dropped on the remote VPN server. Any suggestions how to proceed with troubleshooting?

2
  • So outbound rtp stream is unhindered? Where does the inbound rtp stream stop? Chances are there is a firewall there that has some sort of alg, spi or another form of intrusion detection setup. The other common issue with one way audio is a problem with port triggering or poor NAT traversal, basically make sure all your ports along the whole path are open.
    – MaQleod
    Aug 28, 2011 at 1:06
  • Outbound rtp is fine. Looks like rtp to the phone server has a src ip that isn't routable on the corp net that i'm connecting to. see log below. Seems like the ip phone isn't being nat'ed correctly, but tcpdump on my home router shows nat taking place. %ASA-4-402116: The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as xxx.x.x.x, its source as MYHOMELANIP, and its protocol as 6. The SA specifies its local proxy as 0.0.0.0/0.0.0.0/0/0 and its remote_proxy as MYVPN_PPPADDR/255.255.255.255/0/0.
    – asdfgg
    Aug 28, 2011 at 20:02

1 Answer 1

0

From http://docwiki.cisco.com/wiki/Cisco_Unified_Communications_--_One-Way_Audio:

"One common cause of one-way or no-way audio is when Network Address Translation (NAT), Port Address Translation (PAT), or firewalls exist between two endpoints. The SCCP protocol embeds IP addresses in the IP packet's payload to signal which IP address to send RTP packets to. If the device performing NAT or PAT is unaware of this fact, the embedded IP addresses are not translated. Therefore, one-way or no-way audio results."

Use http://oisec.net/download/skinny/1.48/skinny-proxy.pl on your gateway. It'll listen on port 2000 and redirect calls from your IP phone to the call manager. Use:

iptables -t nat -A PREROUTING -i $LAN_IFACE -p tcp --dport 2000 -j REDIRECT --to-ports 2000

to redirect LAN traffic to skinny-proxy. It works.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .