Troubleshooting SIP

BRKUCC-3662

Richard Middelberg
High Touch Engineer

#clmel
Agenda

• SIP Overview
• Case Studies

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
SIP Overview
What is SIP?
• Signalling protocol used mainly for Unified Communication session negotiation
• Defined in a number of RFC’s, the main one being RFC 3261
• ASCII-based messages
• Application layer protocol – can run on TCP or UDP.
• Endpoints are referred to as User Agents
• Works in conjunction with other protocols for call setup and media transmission
– e.g. SDP and RTP

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
What is SIP?
• Network Elements
– User Agents
– Registrar
– Session Border Controller
– Gateway
• SIP Messages
– Requests and Responses
– Headers

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
What is SIP?
• Media Negotiation
– Session Description Protocol
– Offer/Answer Model
– Early Offer vs. Delayed Offer
– Early Media
– Re-Invite

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
User Agents (UA)
• Manages SIP sessions
– Act as a UAS (User Agent Server) – receives SIP requests
– As well as UAC (User Agent Client) – sends SIP requests
• SIP phone can be hardware or software – anything that can dial, reject, answer
etc
• B2BUA (Back to back User Agent) acts as both a UAS and a UAC

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
SIP Request – RFC 3261
• INVITE: Invite another user agent to join a session
• ACK: Confirms reliable message exchanges.
• CANCEL: Terminates a pending request.
• BYE: Terminates an existing session.
• OPTIONS: Requests information about the capabilities of a caller without the
need to set up a session. Often used as keep-alive messages.
• REGISTER: Used by a UA to register to the registrar.

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Additional SIP Request Methods
• PRACK (RFC 3262) – Acknowledge a provisional response
• SUBSCRIBE (RFC 3265) – Tell a remote node to look for a certain event
• NOTIFY (RFC 6665) – Respond when a certain event occurs
• PUBLISH (RFC 3903) – Publishes an event to the Server
• INFO (RFC 6086) – Sends more info inside a session
• REFER (RFC 3515) – Receiver will send a SIP request to another UA (transfer)
• MESSAGE (RFC 3428) – Transports instant messages using SIP
• UPDATE (RFC 3311) – Changes parameters of a session set-up

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
SIP INVITE
INVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 10.20.30.20:5060;branch=z9hG4bK9cf4db6836d1861bb6841b447b8b4d04.1;rport
Call-ID: 34f5abc5bf476312342baed216f1e2a5
CSeq: 100 INVITE
Contact: <sip:[email protected]:5060>
From: <sip:[email protected]>;tag=2a202c8336b0dd1f
To: <sip:[email protected]>
Max-Forwards: 70
Route: <sip:192.168.0.2;lr>
Allow: INVITE,ACK,CANCEL,BYE,UPDATE,INFO,OPTIONS,REFER,NOTIFY
User-Agent: TANDBERG/520 (TC7.1.0.48db3d2)
Supported: replaces,100rel,timer,gruu,path,outbound,sdp-anat
Session-Expires: 1800
Content-Type: application/sdp
Content-Length: 2660

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
SIP Request Line
INVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 10.20.30.20:5060;branch=z9hG4bK9cf4db6836d1861bb6841b447b8b4d04.1;rport
Call-ID: 34f5abc5bf476312342baed216f1e2a5
URI SIP Version
CSeq: 100 INVITE
Contact:SIP
<sip:[email protected]:5060>
Request
From: <sip:[email protected]>;tag=2a202c8336b0dd1f
To: <sip:[email protected]>
Max-Forwards: 70
Route: <sip:192.168.0.2;lr>
Allow: INVITE,ACK,CANCEL,BYE,UPDATE,INFO,OPTIONS,REFER,NOTIFY
User-Agent: TANDBERG/520 (TC7.1.0.48db3d2)
Supported: replaces,100rel,timer,gruu,path,outbound,sdp-anat
Session-Expires: 1800
Content-Type: application/sdp
Content-Length: 2660

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
SIP Headers
INVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 10.20.30.20:5060;branch=z9hG4bK9cf4db6836d1861bb6841b447b8b4d04.1;rport
Call-ID: 34f5abc5bf476312342baed216f1e2a5
CSeq: 100 INVITE
Contact: <sip:[email protected]:5060>
From: <sip:[email protected]>;tag=2a202c8336b0dd1f
To: <sip:[email protected]>
Max-Forwards: 70
Allow: INVITE,ACK,CANCEL,BYE,UPDATE,INFO,OPTIONS,REFER,NOTIFY
User-Agent: TANDBERG/520 (TC7.1.0.48db3d2)
Supported: replaces,100rel,timer,gruu,path,outbound,sdp-anat
Session-Expires: 1800
Content-Type: application/sdp
Content-Length: 2660

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
SIP Responses

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
SIP Response
SIP/2.0 404 Not Found Free-text Reason
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bKb5291d44b969a4
From: ”Tyrion Lannister" <sip:[email protected]>;tag=19210123ca7-45568313
Response code
To: <sip:[email protected]>;tag=253488-726
Date: Mon, 16 Jan 2012 04:00:22 GMT
Call-ID: [email protected]
CSeq: 101 INVITE
Allow-Events: telephone-event
Server: Cisco-SIPGateway/IOS-15.2.2.T
Reason: Q.850;cause=1
Content-Length: 0

Reason code

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Basic SIP Call Setup
Phone CUCM

Invite
200 OK

ACK
Session Established
BYE

200 OK

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
SIP Call Setup with a B2BUA
Phone A CUCM Phone B

Invite
Invite
200 OK
200 OK
ACK
ACK

Session Established
BYE
BYE
200 OK 200 OK

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
SIP Call Setup with CUBE
Phone A CUCM CUBE Enterprise CUBE SP

Invite
Invite Invite
200 OK
200 OK
200 OK
ACK ACK ACK
Session Established
BYE
BYE
BYE
200 OK 200 OK 200 OK

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Session Description Protocol (SDP)
• Used for media negotiation
• Session Profile
– Media type
– Format
– Associated properties
• Standard is RFC 4566

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Offer/Answer Model (RFC 3264)
• One endpoint sends an offer SDP containing all the capabilities the endpoint
wishes to negotiate
• Contains m lines for each media stream being negotiated (i.e. audio, video,
content channels, etc.)
• Receiving endpoint sends an answer SDP that contains the same or a subset of
capabilities received in the offer.
• For each m= line in the offer, there MUST be a corresponding m= line in the
answer. The answer MUST contain exactly the same number of m= lines as the
offer.

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
SDP Fields
• Session description
– v= (protocol version)
– o= (originator and session identifier)
– s= (session name)
– i= (session information)
– u= (URI of description)
– e= (email address)
– p= (phone number)
– c= (connection information -- not required if included in all media)
– b= (zero or more bandwidth information lines) One or more time descriptions

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
SDP Fields
• Time description
– t= (time the session is active)
– r=* (zero or more repeat times)

• Media description
– m= (media name and transport address)
– i=* (media title)
– c=* (connection information -- optional if included at session level)
– b=* (zero or more bandwidth information lines)
– k=* (encryption key)
– a=* (zero or more media attribute lines)

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Session Description Protocol (SDP) - Offer
v=0
o=tandberg 9 3 IN IP4 172.168.0.58
s=SIP Call
b=AS:4064
Session Description
c=IN IP4 172.168.0.58
t=0 0
m=audio 16454 RTP/AVP 104 9 18 8 0 101
b=TIAS:64000
a=rtpmap:104 G7221/16000
a=fmtp:104 bitrate=32000
a=rtpmap:9 G722/8000
a=rtpmap:18 G729/8000 Media Description
a=fmtp:18 annexb=yes
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=sendrecv
m=video 49354 RTP/AVP 97
b=TIAS:4000000
a=label:11 Media Description
a=rtpmap:97 H264/90000
a=fmtp:97 profile-level-id=428016;max-mbps=108000;max-fs=3600
a=content:main
m=application 58284 RTP/AVP 100
a=rtpmap:100 H224/0 Media Description

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Session Description Protocol (SDP) - Answer
v=0
o=CiscoSystemsCCM-SIP 2000 1 IN IP4 172.168.0.233
s=SIP Call
b=AS:4064
c=IN IP4 172.168.0.233 m=audio 16454 RTP/AVP 104 0 101
t=0 0
m=audio 16454 RTP/AVP 104 0 101 b=TIAS:64000
b=TIAS:64000
a=rtpmap:104 G7221/16000 a=rtpmap:104 G7221/16000
a=fmtp:104 bitrate=32000
a=rtpmap:0 PCMU/8000 a=fmtp:104 bitrate=32000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15 a=rtpmap:0 PCMU/8000
a=sendrecv
m=video 49354 RTP/AVP 97 a=rtpmap:101 telephone-event/8000
b=TIAS:4000000
a=label:11 a=fmtp:101 0-15
a=rtpmap:97 H264/90000
a=fmtp:97 profile-level-id=428016;max-mbps=108000;max-fs=3600
a=content:main
m=application 58284 RTP/AVP 100
a=rtpmap:100 H224/0

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Media Negotiation – Early Offer and Delayed Offer
• Initiator of the call can send SDP offer in the INVITE – this is called an Early
Offer (EO)
• Receiving endpoint can send the SDP offer in a response if the INVITE did not
contain an offer – this is called a Delayed Offer (DO)
• For Early Offer, the answer is sent in a response (usually 200 OK).
• For Delayed Offer, the answer is typically sent in the ACK.

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Early Offer
Phone CUCM

Invite with SDP - Offer

200 OK with SDP - Answer

ACK
Session Established
BYE

200 OK

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Delayed Offer
Phone CUCM

Invite
200 OK with SDP - Offer

ACK with SDP - Answer

Session Established
BYE

200 OK

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Early Media
• Delayed offer calls do not set up media until the 200 OK (call is answered)
• If media is required prior to the call being connected, SIP has provisions for
Early Media
• With Early Media on a Delayed Offer call, the offer comes from the terminating
side in a provisional response (e.g. 183 Session Progress)
• Originating side sends SDP Answer in a PRACK message (defined in RFC
3262)

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Delayed Offer
Phone CUCM

Invite
200 OK with SDP - Offer

ACK with SDP - Answer

Session Established
BYE

200 OK

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Early Media
Phone CUCM

Invite
183 Session Progress with SDP - Offer
PRACK with SDP - Answer
Media Stream Established
200 OK (PRACK)
200 OK with SDP - Offer
ACK with SDP - Answer
Session Established
BYE
200 OK
BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Media Re-negotiation – Re-INVITE
• Either UA involved in a call can re-INVITE an existing dialogue to re-negotiate
parameters for the call.
• Cannot re-INVITE until any previous INVITE messages have received a final
response.
• UPDATE method can also be used to re-negotiate prior to a final

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Media Re-negotiation – Re-INVITE
SIP Request
INVITE sip:[email protected]:49833 SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901f9c72c19221
From: "Paul Giralt" <sip:[email protected]>;tag=15462272~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45545776
To: <sip:[email protected]>;tag=0022bdd6843100702aae8e5b-4be253be
Date: Wed, 11 Jan 2012 03:08:51 GMT
Call-ID: [email protected]
Supported: timer,resource-priority,replaces
Min-SE: 1800 To: field includes a tag
User-Agent: Cisco-CUCM8.6
Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY
CSeq: 104 INVITE
Max-Forwards: 70
Expires: 180
Allow-Events: presence
Call-Info: <urn:x-cisco-remotecc:callinfo>; security= Authenticated; orientation= from; gci= 2-231448; call-instance= 2
Remote-Party-ID: "Paul Giralt" <sip:[email protected]>;party=calling;screen=yes;privacy=off
Contact: <sip:[email protected]:5061;transport=tls>
Content-Type: application/sdp
Content-Length: 489

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Media Re-negotiation
Re-INVITE – Stopping a Media Session
v=0
o=CiscoSystemsCCM-SIP 15462272 2 IN IP4 172.18.106.59
s=SIP Call
c=IN IP4 0.0.0.0 No IP address in c-line
t=0 0
m=audio 19594 RTP/AVP 9 101
a=rtpmap:9 G722/8000
a=ptime:20
a=inactive
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
m=video 19444 RTP/AVP 126
b=TIAS:1000000 Inactive attribute set
a=rtpmap:126 H264/90000
a=fmtp:126 profile-level-id=42801E;packetization-mode=1;level-asymmetry-allowed=1
a=inactive
a=mid:227796888

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Media Re-negotiation
Re-INVITE – Delayed Offer to Re-establish Media Stream
INVITE sip:[email protected]:49833;transport=tls SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fac34c0fb1b
From: "Paul Giralt" <sip:[email protected]>;tag=15462272~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45545776
To: <sip:[email protected]>;tag=0022bdd6843100702aae8e5b-4be253be
Date: Wed, 11 Jan 2012 03:08:52 GMT
Call-ID: [email protected]
Supported: timer,resource-priority,replaces
Min-SE: 1800
User-Agent: Cisco-CUCM8.6
Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY
CSeq: 106 INVITE
Max-Forwards: 70
Expires: 180
Allow-Events: presence
Call-Info: <urn:x-cisco-remotecc:callinfo>; security= NotAuthenticated; orientation= from; gci= 2-231448; call-instance= 2
Remote-Party-ID: "Paul Giralt" <sip:[email protected]>;party=calling;screen=yes;privacy=off
No content in the Invite – Delayed offer
Contact: <sip:[email protected]:5061;transport=tls>
Content-Length: 0

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Media Re-negotiation
Re-INVITE – Offer in 200 OK
SIP/2.0 200 OK
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fac34c0fb1b
From: "Paul Giralt" <sip:[email protected]>;tag=15462272~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45545776
To: <sip:[email protected]>;tag=0022bdd6843100702aae8e5b-4be253be
Call-ID: [email protected]
Date: Wed, 11 Jan 2012 03:08:52 GMT
CSeq: 106 INVITE
Server: Cisco-CPCIUS/9.2.1
Contact: <sip:[email protected]:49833;transport=tls>
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE,INFO
Remote-Party-ID: "Paul Giralt" <sip:[email protected]>;party=called;id-type=subscriber;privacy=off;screen=yes
Supported: replaces,join,sdp-anat,norefersub,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,
Allow-Events: kpml,dialog
Recv-Info: conference
Recv-Info: x-cisco-conference
Content-Length: 788
Content-Type: application/sdp SDP Content in the 200 OK
Content-Disposition: session;handling=optional

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Media Re-negotiation
Re-INVITE – Offer in 200 OK
v=0
o=Cisco-SIPUA 26259 2 IN IP4 10.116.101.41
s=SIP Call
t=0 0
m=audio 32518 RTP/AVP 0 8 18 102 9 116 124 101
c=IN IP4 10.116.101.41
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=rtpmap:102 L16/16000
a=rtpmap:9 G722/8000 M-line has a sendrecv attribute
a=rtpmap:116 iLBC/8000
a=rtpmap:124 ISAC/16000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=sendrecv
m=video 17614 RTP/AVP 126 97
c=IN IP4 10.116.101.41
b=TIAS:2500000
a=rtpmap:126 H264/90000
a=fmtp:126 profile-level-id=42801F;packetization-mode=1;level-asymmetry-allowed=1
a=rtpmap:97 H264/90000
a=fmtp:97 profile-level-id=42801F;packetization-mode=0;level-asymmetry-allowed=1
a=sendrecv

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Media Re-negotiation
Re-INVITE – Answer in ACK
ACK sip:[email protected]:49833;transport=tls SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fb064465a06
From: "Paul Giralt" <sip:[email protected]>;tag=15462272~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45545776
To: <sip:[email protected]>;tag=0022bdd6843100702aae8e5b-4be253be
Date: Wed, 11 Jan 2012 03:08:52 GMT
Call-ID: [email protected]
Max-Forwards: 70
CSeq: 106 ACK
Allow-Events: presence
Content-Type: application/sdp
Content-Length: 446

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Media Re-negotiation
Re-INVITE – Answer in ACK – Decline Video Support
v=0
o=CiscoSystemsCCM-SIP 15462272 3 IN IP4 172.18.106.59
s=SIP Call
t=0 0
m=audio 4000 RTP/AVP 0 m=audio 4000 RTP/AVP 0 Audio m-line on Port 4000
c=IN IP4 172.18.106.58
a=rtpmap:0 PCMU/8000
c=IN IP4 172.18.106.58
a=ptime:20 a=rtpmap:0 PCMU/8000
a=sendonly a=ptime:20
m=video 0 RTP/AVP 126 a=sendonly Attribute = sendonly
c=IN IP4 10.116.101.50 m=video 0 RTP/AVP 126
b=TIAS:1000000 Video m-line on Port 0
a=rtpmap:126 H264/90000
a=fmtp:126 profile-level-id=42801E;packetization-mode=1;level-asymmetry-allowed=1
a=mid:227796888

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot Expressway
 Troubleshoot Expressway
Problem Description
• Calls from an endpoint inside the enterprise to a mobile Jabber client on
IOS/Android fails when pushing answer.

Signalling path
Phone A CUCM Expressway-C Expressway-E Phone B - Jabber

ENTERPRISE Public Internet

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Expressway MRA Overview

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot Expressway
Expressway-Edge to Firewall
CUCM Expressway-C Expressway-E

Via : … Via : … Via : …

Via : … Via : …
INVITE sip:[email protected] SIP/2.0
Via : … Via : …
Via : …
Via: SIP/2.0/TLS 10.0.0.7:5061;egress-zone=name;branch=brachid;proxy-call-id=c-id;rport Via : …
Via : …
Via: SIP/2.0/TLS 10.1.0.180:5061;egress-zone=name;branch=branchid;proxy-call-id=c-id;received=10.1.0.180;rport=25013;ingress-
zone=CollaborationEdge

Via: SIP/2.0/TLS 10.1.0.180:5073;branch=branchid;x-cisco-local-service=nettle;received=10.1.0.180;rport=33268;ingress-zone=DefaultZone

Via: SIP/2.0/TLS 10.1.0.180:5061;egress-zone=DefaultZone;branch=branchid;proxy-call-id=c-id;received=10.1.0.180;rport=25216

Via: SIP/2.0/TCP 10.1.0.106:5060;branch=z9hG4bK117141557c6be;received=10.1.0.106;ingress-zone=CEtcp1099103106

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
VCS Trace Configuration
• VCS Control / VCS Expressway / Expressway-C / Expressway-E can log SIP
messages to a diagnostic log file.
• To enable, navigate to Maintenance>
Diagnostics> Diagnostic logging

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
VCS Trace Configuration

Click here to collect a

Wireshark trace

Click here to start logging

and reproduce the problem

Click OK

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
VCS Trace Configuration

Click here to stop logging

after the problem has been
reproduced
BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
VCS Trace Configuration

Click here to download the

logs or Wireshark traces

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
TranslatorX Tool
• Download from http://translatorx.cisco.com/
• Developed and maintained by Paul Giralt
• Supports Q.931, H.225, SCCP (Skinny), MGCP, or SIP messages.

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
TranslatorX tool

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Translatorx
Call List Window

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Expressway Case Study
Ladder Diagram
• Call setup
CUCM Expressway-C Expressway-E

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Expressway Case Study
Ladder Diagram
• 15 seconds to send an ACK CUCM Expressway-C Expressway-E

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Expressway Case Study
Solution
• From the MRA deployment guide we found that:
– MRA feature wasn’t supported by the version of CUCM
– Upgrade to a CUCM version to 9.1(2)SU1

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot One Way Audio
Troubleshoot One Way Audio
Problem Description
• Calls from some endpoints experience one way audio
• Call flow:

Phone A CUCM CUBE SP Network Phone B

ENTERPRISE Service Provider

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Encapsulated Remote SPAN (ERSPAN)
Overview
• ERSPAN supports source
ports, source VLANs, and
destination on different
switches
• It Uses a GRE tunnel to
carry traffic
• ERSPAN consists of an
ERSPAN source session,
routable ERSPAN GRE-
encapsulated traffic, and an
ERSPAN destination
session
BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Wireshark

• Open Source network packet capture and analysis tool

• Available at http://www.wireshark.org
• Available for Windows, Mac OS X, and UNIX/Linux
• Provides VoIP Call and SIP analysis

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Wireshark
VoIP call analysis

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot One Way Audio CUCM CUBE SP Network
VoIP Ladder diagram
• Follow Call Setup
• Confirm interactions are correct
• Does the call setup look normal?

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot One Way Audio
RTP packets
• After call establishment
• RTP flows in both directions

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot One Way Audio
SDP
• Find destination IP in SDP
• Compare with working call

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot One Way Audio

Working Call

One Way Audio Call

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Solution
• Remote side was sending an incorrect IP
• Incorrect IP only for calls with c-line in the media description
• Contact the service provider to resolve.

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot a UC Application
Troubleshoot a UC Application
Problem Description
Calls fail after hold/resume for calls from video endpoints
Signaling path
Phone A CUCM CUBE 3rd Party SBC Phone B

ENTERPRISE Service Provider

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Unified CM Trace Configuration
• SIP messaging in CUCM is written to the CCM/SDI trace file when appropriate
trace levels are set (SDL trace in 9.0+)
• Configured from Cisco Unified Serviceability > Trace > Configuration or by
using AnalysisManager
• Unified CM 9.0 combines SDI and SDL traces into the SDL traces
• Unified CM 9.0 and later default to detailed tracing – no need to configure
traces.

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Unified CM Trace Configuration

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Unified CM Trace Configuration

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Unified CM Trace Configuration

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot a UC application
MOH 1/2
Phone A Phone B MOH Server

Invite
200 OK
ACK
Session Established - Phone A puts Phone B on hold
Invite
200 OK
ACK
Media lines set to inactive a=inactive
Invite
200 OK
ACK
Audio line for MOH established
BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot a UC application
MOH 2/2
Phone A Phone B MOH Server

Invite
200 OK
ACK
MOH Audio = inactive
Invite
200 OK
ACK
Voice Audio channel established

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot a UC application
TranslatorX
• Create Filter

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot a UC Application
Call Setup - Invite CUCM CUBE SP Network
INVITE sip:[email protected]:5060 SIP/2.0
v=0
o=CiscoSystemsCCM-SIP 150270 1 IN IP4 172.168.0.181
s=SIP Call
c=IN IP4 192.168.0.237
b=TIAS:1984000
b=AS:1984
t=0 0
m=audio 16576 RTP/AVP 18 101
a=rtpmap:18 G729/8000
a=ptime:20
a=fmtp:18 annexb=no
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
m=video 16578 RTP/AVP 126 97
b=TIAS:1976000
a=rtpmap:126 H264/90000
a=imageattr:126 send [x=640,y=480] [x=640,y=360] [x=352,y=288] [x=176,y=144] recv [x=640,y=480]
a=rtpmap:97 H264/90000
a=content:main
a=mid:2

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot a UC Application
Re-Invite to put call on Hold CUCM CUBE SP Network
v=0
o=CiscoSystemsCCM-SIP 150270 2 IN IP4 172.168.0.181
s=SIP Call
c=IN IP4 0.0.0.0 C-line IP Address set to 0.0.0.0
b=TIAS:1984000
b=AS:1984
t=0 0
m=audio 16576 RTP/AVP 18 101
a=rtpmap:18 G729/8000
a=ptime:20 Inactive audio m-line
a=fmtp:18 annexb=no
a=inactive
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
m=video 16578 RTP/AVP 126 97
b=TIAS:1976000
a=rtpmap:126 H264/90000
a=rtpmap:97 H264/90000Inactive Video m-line
a=content:main
a=inactive

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot a UC Application
MOH CUCM CUBE SP Network
v=0
o=CiscoSystemsCCM-SIP 150270 3 IN IP4 172.168.0.181
s=SIP Call
t=0 0
m=audio 24846 RTP/AVP 8
c=IN IP4 172.168.0.180
a=X-cisco-media:umoh
a=rtpmap:8 PCMA/8000
a=ptime:20
m=video 0 RTP/AVP 126 97
c=IN IP4 192.168.0.237
b=TIAS:1976000
m=audio 24846 RTP/AVP 8
a=rtpmap:126 H264/90000c=IN IP4 172.168.0.180
a=X-cisco-media:umoh
a=fmtp:126 profile-level-id=428014;packetization-mode=1;max-mbps=36000;max-fs=1200;max-rcmd-nalu-size=1300;level-asymmetry-allowed=1
a=rtpmap:97 H264/90000
a=rtpmap:8 PCMA/8000
a=fmtp:97 profile-level-id=428014;packetization-mode=0;max-mbps=36000;max-fs=1200;level-asymmetry-allowed=1
a=content:main a=ptime:20
a=inactive
a=mid:2

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot a UC Application
Resume – Late offer – 200OK CUCM CUBE SP Network
v=0
o=BroadWorks 26760612 5 IN IP4 203.52.0.164
s=-
c=IN IP4 203.52.0.164
t=0 0
a=media-release:hngl5rp9pujvivh05pvumib1joofrovgml23n3mavrbaeu76622cr8r9gh0uqijv
a=media-release-con-addr:d6v1k1hvmgvh1081o9j0
m=audio 18310 RTP/AVP 8 18 0 101
a=ptime:20
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=rtpmap:0 PCMU/8000
m=audio 18310 RTP/AVP 8 18 0 101
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=fmtp:18 annexb=no
a=silenceSupp:off
m=video 0 RTP/AVP 0

m=video 0 RTP/AVP 0

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot a UC Application
ACK
v=0
o=CiscoSystemsCCM-SIP 150270 5 IN IP4 172.168.0.181
s=SIP Call
c=IN IP4 192.168.0.237
b=TIAS:8000
b=AS:8
t=0 0
m=audio 16576 RTP/AVP 18 101
a=rtpmap:18 G729/8000
a=ptime:20
a=fmtp:18 annexb=no m=audio 18310 RTP/AVP 18 101
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
m=video 0 RTP/SAVP 126 97
b=TIAS:1976000
a=rtpmap:126 H264/90000
a=rtpmap:97 H264/90000 m=video 0 RTP/SAVP 126 97
a=content:main
a=inactive
a=mid:2

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot a UC Application
Solution
• SIP Normalisation script that
– Check if audio channel exist using AVP
– If that his true, check if video channel exists with a 0 port using SAVP
– If true, replace SAVP with AVP
trace.format("application zero present")
local app_line = sdp:getLine("m=", "SAVP")
if app_line
then
trace.format(" application zero SAVP")
app_line = app_line:gsub("application 0 RTP/SAVP", "application 0 RTP/AVP")
sdp = sdp:modifyLine("m=", "application 0 RTP/SAVP", app_line)
msg:setSdp(sdp)
end

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Steps to implement SIP Normalisation script on
CUCM
Solution
• Create new script
• Apply the script to the applicable trunk
• Reset the trunk

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot Content Sharing
Troubleshoot Content Sharing
Problem Description
• Jabber Desktop sharing fails
• Call flow:

Jabber A CUCM Jabber B

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot Content Sharing
SDP - Invite
v=0
o=Cisco-SIPUA 9180 0 IN IP4 172.16.0.154
s=SIP Call
c=IN IP4 172.16.0.154
b=AS:4000
t=0 0
m=audio 17924 RTP/AVP 0 8 18 105 101
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:105 G7221/16000
a=fmtp:105 bitrate=24000 m=application 5070 UDP/BFCP *
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=sendrecv
a=floorctrl:c-s
m=video 31886 RTP/AVP 97
b=TIAS:4000000
a=confid:1
a=rtpmap:97 H264/90000 a=floorid:2 mstrm:12
a=fmtp:97 profile-level-id=42E01E;packetization-mode=0;level-asymmetry-allowed=1;max-fs=1621
a=content:main
a=label:11 a=userid:1
a=sendrecv
m=application 5070 UDP/BFCP *
a=floorctrl:c-s
a=setup:actpass
a=confid:1
a=floorid:2 mstrm:12
a=connection:new
a=userid:1
a=setup:actpass
a=sendrecv
a=connection:new
a=sendrecv

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot Content Sharing
SDP – Invite
v=0
o=Cisco-SIPUA 9180 0 IN IP4 172.16.0.155
s=SIP Call
c=IN IP4 172.16.0.155
b=AS:4000
t=0 0
m=audio 17924 RTP/AVP 0 8 18 105 101
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:105 G7221/16000
a=fmtp:105 bitrate=24000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=sendrecv
m=video 31886 RTP/AVP 97
b=TIAS:4000000
a=rtpmap:97 H264/90000
a=fmtp:97 profile-level-id=42E01E;packetization-mode=0;level-asymmetry-allowed=1;max-fs=1621
a=content:main
a=label:11
a=sendrecv
m=application 0 UDP/BFCP *
a=floorctrl:c-s
a=confid:1
m=application 0 UDP/BFCP *
a=floorid:2 mstrm:12
a=userid:1
a=setup:actpass
a=connection:new
a=sendrecv

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot Content Sharing
CUCM Log
12:37:19.664 |//SIP/SIPCdpc(3,74,1103501)/ci=0/ccbId=0/scbId=0/handleSDPOfferInd:ipAddrMode IpAddrMode_v4
|3,100,68,804909.1^*^*
12:37:19.664 |//SIP/SIPCdpc(3,74,1103501)/ci=62953946/ccbId=12275384/scbId=0/sendSIPMediaToUpdateCc:
Secure status=1, mSrtpPresent=03,100,68,804909.1^*^*
12:37:19.664 |//SIP/SIPCdpc(3,74,1103501)/ci=62953946/ccbId=12275384/scbId=0/getDefCcRegister: Secure status=1,
12:37:19.664 |SIPSdp::session level AS found. bandwidth.enabledMask=1 bandwidth.as=4000|*^*^*
12:37:19.664 |//SIP/SIPCdpc(3,74,1103501)/ci=62953946/ccbId=12275384/scbId=0/handleSDPOfferInd: Sending offer to
12:37:19.664 |DET-SIPInterface-(804908)::BFCP is disabled:Filter out Presentation Video and BFCP|3,100,68,804908.1^*^*
12:37:19.664 |DET-SDPMsg-getBWFromSession: 1 0,4000,0|*^*^*
BFCP is disabled: Filter out Presentation
12:37:19.664 |DET-SDPMsg-getBWFromSession: session level as found|*^*^*
Video and BFCP
12:37:19.664 |DET-SDPMsg-()::setTIASforDO, sessionBWbps=64000, receivedSessionBWbps=4000000, calculatedAudio
12:37:19.664 |DET-SDPMsg-()::setTIASforVideo, sessionBW=2000000, calMainvideobps=1936000, calSecvideobps=0|*^*^*
12:37:19.664 |DET-SDPMsg-()::setSessionBandwidthModifiers(bw=2000000, action=0) - session(bitmask=0x1,tias=0,as=*
12:37:19.664 |DET-SIPInterface-(804908)::waitSDPResponse_SDPOfferInd, updated SDPMode(1st mline)=aud 0, vid
12:37:19.664 |DET-SIPInterface-(804908)::BFCP is disabled:Filter out Presentation Video and BFCP|3,100,68,804908.1^*^*
12:37:19.664 |SIG-MediaManager-(562647)::wait_AuConnectReply|3,100,68,804909.1^*^*
12:37:19.664 |SIG-MediaManager-(562647)::wait_AuConnectReply, received 1 resps, sent AuConnecReply for party
12:37:19.664 |DET-SIPInterface-(804909)::BFCP is disabled:Filter out Presentation Video and BFCP|3,100,68,804909.1^*^*
12:37:19.664 |DET-SDPMsg-getBWFromSession: 1 0,4000,0|*^*^*

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Troubleshoot Content Sharing
Solution
• Enable BFCP on CUCM
• Device -> Device Settings -> SIP Profile

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Q&A
Complete Your Online Session Evaluation
Give us your feedback and receive a
Cisco Live 2015 T-Shirt!
Complete your Overall Event Survey and 5 Session
Evaluations.

• Directly from your mobile device on the Cisco Live

Mobile App
• By visiting the Cisco Live Mobile Site
http://showcase.genie-connect.com/clmelbourne2015
• Visit any Cisco Live Internet Station located
throughout the venue Learn online with Cisco Live!
Visit us online after the conference for full
T-Shirts can be collected in the World of Solutions access to session videos and
on Friday 20 March 12:00pm - 2:00pm presentations. www.CiscoLiveAPAC.com

BRKUCC-3662 © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public
Thank you.