VoIP over VPN won't work

Hi,
I have a Cisco ASA 5540 running 8.2(5). When I dial a phone on the other of the the VPN the first time I get a blank after it rings(i.e when the voice mail get activated ot if someone picks the phone up), however works the second and consequent times i dial.
A little background.
Two sites A and B connected via IPsec Tunnel. No problems in communication except for the VoIP issue.
A Phone in on site A(172.17.168.x) and other on site B(192.168.103.x)
SiteA and SiteB is connected via an IPsec tunnel on the Cisco ASA.
First call fails.
Second call works.
Result of a packet trace is also the same. The UDP packet get drops when tried for the first time but subsequent ones pass.
Any ideas on how to fix this?
First time
ASA5520# packet-tracer input inside udp 172.17.168.95 10000 192.168.3.103 10000
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         outside
Phase: 2
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xb13db840, priority=0, domain=inspect-ip-options, deny=true
hits=2603604, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 3
Type: NAT-EXEMPT
Subtype:
Result: ALLOW
Config:
match ip inside 172.17.168.0 255.255.255.0 outside 192.168.0.0 255.255.0.0
    NAT exempt
    translate_hits = 141, untranslate_hits = 6
Additional Information:
Forward Flow based lookup yields rule:
in id=0xb13eccf0, priority=6, domain=nat-exempt, deny=false
hits=323, user_data=0xb13ecc30, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip=172.17.168.0, mask=255.255.255.0, port=0
dst ip=192.168.0.0, mask=255.255.0.0, port=0, dscp=0x0
Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
match ip inside any outside any
    dynamic translation to pool 1 (Public IP)
    translate_hits = 1005381, untranslate_hits = 37221
Additional Information:
Forward Flow based lookup yields rule:
in id=0xb1490078, priority=1, domain=nat, deny=false
hits=1805592, user_data=0xb148ffb8, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 5
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
match ip inside any outside any
    dynamic translation to pool 1 (Public IP)
    translate_hits = 1005392, untranslate_hits = 37221
Additional Information:
Forward Flow based lookup yields rule:
in id=0xb14903b0, priority=1, domain=host, deny=false
hits=2728036, user_data=0xb148ffb8, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 6
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:
Forward Flow based lookup yields rule:
out id=0xb1fbe6a0, priority=70, domain=encrypt, deny=false
hits=106, user_data=0x0, cs_id=0xb1fa5bc8, reverse, flags=0x0, protocol=0
src ip=172.17.168.0, mask=255.255.255.0, port=0
dst ip=192.168.0.0, mask=255.255.0.0, port=0, dscp=0x0
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
Second time
ASA5520# packet-tracer input inside udp 172.17.168.95 10000 192.168.3.103 10000
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         outside
Phase: 2
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xb13db840, priority=0, domain=inspect-ip-options, deny=true
hits=2603850, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 3
Type: NAT-EXEMPT
Subtype:
Result: ALLOW
Config:
match ip inside 172.17.168.0 255.255.255.0 outside 192.168.0.0 255.255.0.0
    NAT exempt
    translate_hits = 142, untranslate_hits = 6
Additional Information:
Forward Flow based lookup yields rule:
in id=0xb13eccf0, priority=6, domain=nat-exempt, deny=false
hits=324, user_data=0xb13ecc30, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip=172.17.168.0, mask=255.255.255.0, port=0
dst ip=192.168.0.0, mask=255.255.0.0, port=0, dscp=0x0
Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
match ip inside any outside any
    dynamic translation to pool 1 (Public IP)
    translate_hits = 1005470, untranslate_hits = 37222
Additional Information:
Forward Flow based lookup yields rule:
in id=0xb1490078, priority=1, domain=nat, deny=false
hits=1805881, user_data=0xb148ffb8, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 5
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
match ip inside any outside any
    dynamic translation to pool 1 (Public IP)
    translate_hits = 1005479, untranslate_hits = 37223
Additional Information:
Forward Flow based lookup yields rule:
in id=0xb14903b0, priority=1, domain=host, deny=false
hits=2728365, user_data=0xb148ffb8, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 6
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
out id=0xb23a5060, priority=70, domain=encrypt, deny=false
hits=1, user_data=0x202004, cs_id=0xb1fa5bc8, reverse, flags=0x0, protocol=0
src ip=172.17.168.0, mask=255.255.255.0, port=0
dst ip=192.168.0.0, mask=255.255.0.0, port=0, dscp=0x0
Phase: 7
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0xb237e278, priority=69, domain=ipsec-tunnel-flow, deny=false
hits=1, user_data=0x2040e4, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=192.168.0.0, mask=255.255.0.0, port=0
dst ip=172.17.168.0, mask=255.255.255.0, port=0, dscp=0x0
Phase: 8
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0xb138d7e0, priority=0, domain=inspect-ip-options, deny=true
hits=2440659, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 9
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 2676819, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_adjacency
snp_fp_encrypt
snp_fp_fragment
snp_ifc_stat
Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_ipsec_tunnel_flow
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

No I haven't, but I'll call them today. That doesnt explain the VPN stopped working though, and at this point I'd rather have L2TP/IPSec working to my box at home, rather than an unencrypted session running over port 445. Appreciate the suggestion though...

Similar Messages

VOIP over VPN need clarification

Hi,
Recently I have implemented Site-to-Site VPN between ASA and sonic wall firewall.
Problem: I can able to make call from ASA side(inside) Ip phone to sonic wall (inside) side Ip phone and vice versa and it’s ringing, But not able to hear voice. So I created VOIP over VPN configuration and applied appropriate service policy towards outside interface. But still I was not able to hear voice.
Tried below mentioned t’shot steps:
From ASA side we had two subnets (10.20.1.x/24 – Data and 10.20.2.x/24 – Voice ) and one subnet (192.168.x.x/24 ) from sonic wall side as interesting traffic ( lan to lan). When I configured site-to-site configuration on both ends my phase-1 and phase-2 came UP and can able to communicate between each other. (In interesting traffic I created two objects and bind those objects as one object-group for source i.e. ASA side lan subnet and one object for remote-Lan as destination)
My call manager is rest behind ASA and Ip phones needs to communicate from sonic wall side to inside ASA.
I can able to make call from ASA side(inside) Ip phone to sonic wall (inside) side Ip phone and vice versa and it’s ringing, But not able to hear voice. So I created VOIP over VPN configuration and applied appropriate service policy towards outside interface. But still I was not able to hear voice.
So, I done supernetting the data subnet and voice subnet into single network i.e. 10.20.x.x/16 at ASA side and applied the configuration changes (changed ACL, nonat rule, Voice QOS ACL accordingly), and I’m able to hear voice both end and I can communicate properly from ASA inside Ip phone to Sonic wall inside Ip phone and vice versa.
My question: I’m not understanding the logic how this supernetting resolved dead voice issue.
Pls clarify my question I’m bit confused on this.

It's not recommended. Although VPNs guarantee a secure pipe end-to-end, they don't guarantee latency and variations in latency (Jitter).

VOIP over VPN dropp RTP protocol

We are installing a new 2911 ISR in our office and connecting with a Linksys (CISCO) RV016 VPN router. These are two small doctors offices that need to have computer, and Voip traffic over a VPN.
Currently we connect an older RV082 and the RV016 together and have NO issues with VOIP traffic. If we establish a connection with the 2911 router then we are having an issue with no voice or RTP traffic coming through. Phones will connect, and dial out, but no voice can be heard.
The First office is on a Verizon Fios Network with a MTU of 1492. The Network and servers are as follows:
Remote Office                                                                            Main Office
Linksys Spa 942 phones
               |
Netgear 10/100 POE Switch
               |                                                                        =================
Linksys (cisco) RV016 VPN                                            |          2911                 |
               |                                                                       |    POE Module Sw     |
Comcast Cable Modem                                                  -------------------------------
               |                                                                                       |          |
             VPN                                                                                VPN       |
               +=======================================+     Asterisk
                                                                                                              (Call Man)
Basically we have the Internet coming in from Gig0/0 and routing traffic to multiple outside IP addresses so we are using 3 subs in our configuration.
192.168.1.X          192.168.2.X          192.168.3.X               192.168.0.X (Remote Group)
When we connect the old routers (RV016 and RV082) VPN VOIP and Data traffic go fine.   We are using a Term Server on one end, Web Server, and the Asterisk PBX for our VOIP Call Manager.
So far we connect up the 2911 and the RV016 and have no issues with data traffic. But the VOIP is dead on the remote end. No sound. We did a Wireshark on traffic, and we are getting some 407 errors from the Astersick Host, and a unknown RTP version 1 error message. THe only thing that we had to do on the RV082 router was port forward UDP 506 and 10001 - 20000 for the traffic, and setup a access rule, but nothing else.
We are getting traffic on the 2911, but nothing else. We have excluded the 192.158.0.X traffic from the NAT so not to get into that issue, and have even tried forwarding ports but nothing seems to help. Is there a good way to route this traffic? Our bandwidth is pretty fast so I am not sure if QoS is needed, but if so it is not one of my strong areas. What is the best way to route this traffic through the VPN without loosing the RTP part of the call.

I put this line in and still not getting audio on the other end. I will be doing captures tonight from working and non working phones. I need to get this resolved. I have spent 3 weeks on this issue and I have run out of time. Should I use the DEBUG VOIP SIP command for the capture on the router? I believe this would be the best resolution to the service to see what is going on. The phones work with a RV016 and RV082 router in place. All data traffic works fine in sending and recieving calls.
I have read about all of the articles on Cisco and voip traffic. We are going to be shutting off the natting on the router to see if I can just get the voip traffic to flow. Once we get it flowing then I can work on building up the house on a stable foundation.
At this time, we are routing multiple IP addresses throught the 2911 and have IP NAT OUTSIDE on the G0/0 port and IP NAT INSIDE on the G1/0 Interface, which is a POE Switch Module in the 2911.
I know that the cisco router wants to act as a call manager, or terminate the SIP traffic on the 2911, but we have a working Asterisk box that handles all SIP traffic. If there is a way to just forward the traffic there properly, without the 2911 trying to intercept the traffic, that would be wonderful. I am looking at the possibility of creating dial-peer groups for all of the phones, but really is this needed? What is so frustrating about the whole situation is that I put in a 5 year old sub $200 router and everything works.
Dale

Opening Files Over VPN - Slow, Not Working

My home computer is connected to the office network via a VPN. The goal is to be able to work directly on files that are hosted on the office's development server. I've mapped a network drive, and I have no problem accessing these files with explorer. However, when I try to open them with Dreamweaver (or CF Builder) the program(s) hang.
Is there any way to fix this?

You are not alone, I have the same problem and a quick search on the web reveals others are having the same problem (yet no answers). It does seem to be an issue with DW; my other programs work fine in VPN.

I have done absalutely nothing to my 4g apple ipod touch, and it over heats, won't hold a charge, and the front camera will not work. I bought this brand new in december, and i've barely used it. I've tried restarting it and everything, what should i do?

I have done absalutely nothing to my 4g apple ipod touch, and it over heats, won't hold a charge, and the front camera will not work. I bought this brand new in december, and i've barely used it. I've tried restarting it and everything, I honestly think this is out raging because i spend over $200 on this. To have for music and instagram. I use it about an hour a day, but i've only been using it for about 3 months although i've had it since December. Any suggestions that may help me?

Try:
- A reset. Nothing is lost
Reset iPod touch: Hold down the On/Off button and the Home button at the same time for at
least ten seconds, until the Apple logo appears.
- Restore from backup
- Restore to factory settings/new iPod
If still problem make an appointment at the Genius Bar of an Apple store.

My phone 5s did the new update and will not come back on. I already tried hard reboot still won't work. Been over a hour now. Please someone help I need my phone.

My phone 5s 16gb gold did the new update and will not come back on. I already tried hard reboot still won't work. Been over a hour now. Please someone help I need my phone. This phone is not even 6 months old been in case no scratches. This is driving me crazy.

Connect your phone to a computer and restore your software using iTunes.

So, I have created my home sharing from my base computer to my laptop. On my lap top I see the tab for home sharing but it will not let me connect to my computer to share my music over. I have done everything iTunes has told me to but it still won't work.

So, I have created my home sharing from my base computer to my laptop. On my lap top I see the tab for home sharing but it will not let me connect to my computer to share my music over. I have done everything iTunes has told me to but it still won't work. Any help would make my day...

I got some more info that may help.
I put a cd on my laptop, and was able to share it to my computer... So the problem is only from my computer to my laptop. I tried the firewall thing and it did not help. I read the rest of the trouble shooting page, and nothing else applies. iTunes is an execption and already was. I can not think of anything else being my problem. Do you think I should re-install iTunes or would that be a waste of time? At this point I am about to just call Apple for some help because I am getting to stressed over this.
Thanks

V31.5 no longer works with IMAP over VPN - v31.4 is OK

I have been using TB for several years with IMAP accounts accessed over VPN. This was working fine until I upgraded to v31.5. After this upgrade, TB would leave rotating circle symbol indefinitely (more than 15 minutes, no timeout message or error message). This was only happening with my IMAP account subscriptions over VPN - POP accounts were still working perfectly. With the VPN IMAP accounts the message preview did not update (no new messages, old messages no longer on the IMAP server still showing on preview pane). Had my IT guy spend over an hour checking everything at the VPN / IMAP host end and he was unable to find any problems - he advised the system showed what looked like a normal connection between my PC and the mail server.
I then tried deleting the IMAP account subscriptions from TB, shut down & restarted, then tried re-creating IMAP subscriptions - still no go. We tried a different e-mail client and it worked fine with the same IMAP accounts over the same VPN connection. Ended up uninstalling TB (v31.5) and installing v31.4 - all working fine again on v31.4.
I might add it has taken an amazing effort to find a way to report this problem - I've had to create an account just to send comment - a bit overboard for a non-programmer.
Even when I uninstalled v31.5 I was offered an option to report feedback - but it brought up a dead link in my browser.
Aside from this problem I am a very happy TB user and extend my sincerest gratitude to those who have made this fantastic product available to users around the world. Thank You.

Maybe it is this bug: http://bugs.kde.org/show_bug.cgi?id=154969
The decisive effect is 'Improved window management' - if this effect is enabled kwin works normally.
Last edited by May-C (2008-02-13 01:16:48)

Mail won't work when VPN is connected

I use VPN to blog for a newspaper, from home. I don't access the company's internal mail system--I just use VPN to get through security and use wordpress on the in-house servers.
But when I connect with VPN, mail stops working (for gmail, verizon.net, hotmail). I otherwise have full access to the internet; I can get gmail through the web, for example. But since I use Mail extensively, I'd like to be able to have it and VPN active at the same time.
My current workaround is just to use VPN for posting, then I get out. But this is a big hassle. Is there a mail setting that I can change that will let it work while (Cisco) VPN is active?
(I'm a freelancer using my own iMac, so I get no tech support from work.)

http://docs.info.apple.com/article.html?path=Mac/10.6/en/11941.html
Any chance that you have "Send all traffic over VPN connection" enabled ?
I use the OSX internal VPN to connect to my Office PC and can use Mail while VPN-connected.
Stefan

When I hover over the Bookmark Icon for a few seconds it won't work but when I go straight to the icon and click on it, it will work. Running windows 7

When I hover over the Bookmark Icon for a few seconds it won’t work but when I go straight to the icon and click on it, it will work. Running Windows 7.

Try:
- iOS: Not responding or does not turn on
- Also try DFU mode after try recovery mode
How to put iPod touch / iPhone into DFU mode « Karthik's scribblings
- If not successful and you can't fully turn the iOS device fully off, let the battery fully drain. After charging for an least an hour try the above again.
- Try another cable
- Try on another computer
- If still not successful that usually indicates a hardware problem and an appointment at the Genius Bar of an Apple store is in order.
Apple Retail Store - Genius Bar

Keep getting dumb message about computer authorization for my IPAD, it worked well past 8 months until recently, won't work even if authorize it after deacativating it again, over

keep getting dumb message about computer authorization for my IPAD, it worked well past 8 months until recently, won't work even if authorize it after deacativating it again, over & over, keep same message to

Hi Boris Bagel,
Thank you for using Apple Support Communities.
If you are being repeatedly prompted by iTunes to authorize your computer with your Apple ID, then please follow the troubleshooting in the article below.
iTunes repeatedly prompts to authorize computer to play iTunes Store purchases
Take care,
Alex H.

I installed FF 4 and now the excellent Maxa Cookie Manager software won't work. Can I install and older version of FF over FF4? I could just uninstall 4.0 and re-install 3.* but I don't want to loose all my bookmarks.

Maxa Cookie Manager software no longer records cookies since I installed FF4. So what will happen if I install FF 3.* over FF4?

Glad to hear your prolbems have been sorted.
Have had similar problems since performing a sofware update last week.
Itunes has crashed.
Can't be reinstalled.
The software update won't work, neither will disk utility.
Removing the .dmg files hasnt helped.
Any suggestions?

Outlook 365 retrieves same mail over & over -- stops and restarts -- won't sync to iPhone -- won't work with blue tooth in car

Outlook 365 retrieves same mail over & over -- stops and restarts -- won't sync to iPhone -- won't work with blue tooth in car 'm using Win 8

Hi,
How did you set up your email on your Ipnone? Please refer to the article below and try the method to set up your email:
http://office.microsoft.com/en-in/office365-suite-help/set-up-email-on-apple-iphone-ipad-and-ipod-touch-HA102818554.aspx
Do you use Outlook desktop app? If you are talking about a question related to Office 365 web app, it's better to post your question to the Office 365 forum. You will
get the most qualified pool of respondents there:
http://community.office365.com/en-us/forums/default.aspx
If you means that the problem is with your Outlook desktop app, please try to log on your OWA and check if the problem persists there.
Please let me know the result.
Best Regards,
Steve Fan
TechNet Community Support

I plugged IPOD in to sync ( first time in over a year) it auto started with the "Do Not Disconnect", but did not sync. Now the IPOD is stuck in that mode, won't shut off, won't sync, won't work. is there a way to reboot it?

I plugged IPOD in to sync ( first time in over a year) it auto started with the "Do Not Disconnect", but did not sync. Now the IPOD is stuck in that mode, won't shut off, won't sync, won't work. is there a way to reboot it?

It has already been 6 days from your post, my apology for responding so late, but it is my habit to help only the leftovers, which the other contributors missed.
Toggle the hold switch make sure there is no red showing.
To reboot an iPod. (Or RESET in Apple iPod jargon)
Press Menu and Center button for about 10 secs till the Apple logo comes ON , this would not erase any data from your iPod.
I would advice you to leave the iPod charging for about 4 hours, if it has been discharged for 1 year or more, and also Apple recommends that you charge the iPod at least once a month, to prevent a discharged battery leakage, which may corrrode the circuitry in the iPod.
Hopefully you don't get the dreaded RED X on the iPod screen.
Good Luck!

Outbound VPN thru wrt54g won't work

Hi all,
I just recently 'upgraded' from an old WRK54G to a WRT54G V8. Ever since, I can't connect to work via VPN. I have a T1 line and if I set a static IP into my computer and plug directly in without the router, it connect to the VPN server at work just fine. This is a PPTP VPN using the built-in XP SP2 client. I can connect to the server from other sites without a problem, so it's definitely a problem with the new router. Everything else works fine with the router: general internet access, port forwarding, etc.
I've searched the net for a couple weeks, but I can't find a solution. I have the latest V8 firmware (just flashed to 8.00.5. The other strange thing is that I got INBOUND VPN to work. Any ideas? Is there some problem with the V8 firmware?
Thanks,
Ryan

The router that I am having a problem with is on the client end. I have another linksys router on the server end but that is working fine as I can connect from home which doesn't have a linksys router.
I have tried the things you have mentioned aswell as even setting up the computer that is trying to VPN as a DMZ host and I still cannont connect. The server error log show that the GRE messages aren't making it through.
I agree that we are both doing everything right. I am going to try an older version of the same router tomorrow and see if that works. I might have to move away from linksys as they are not acknowledging the problem.

VoIP over VPN won't work

Similar Messages

Maybe you are looking for