SIP Traffic in CRS-3 Carrier Grade NAT (CGN) with PAT
Hello
Does the SIP traffic through the module CGN works? We use PAT in the module.
Thank you for your comments
Rodolfo
Hi Rodolfo,
yes, SIP can be used with no issue through CGN system without the need of any particular ALG if SBC performs media-latching.
Take a look at this preso:
http://www.cisco.com/web/CA/events/pdfs/CNSF2011-IPv6-Transition-for-SPs-Chris-Metz.pdf
Kind regards,
N.
Similar Messages
-
Carrier Grade NAT (CGN)
Verizon,
Verizon has announced some DSL customers will move to Carrier Grade NAT (CGN) which uses IPv6 instead fo the old standard IPv4 we use today (see verizon link below).
This basically means you can no longer port forward. IP cameras and many other applications require port forwarding so they can accessible from the internet outside the home. Many gamers also require this ability.
Eventually everyone will be on IPv6. My question is how will Verizon customers on IPv6 be able to port forward? Or will it just not be allowed?
I understand DSL customers can currently opt-out of CGN, but the point is at some point everyone will be moved to it.
Please See:
http://www22.verizon.com/support/residential/internet/highspeedinternet/networking/troubleshooting/p...
Thank you for your time
- Adam
Solved!
Go to Solution.ADAM619,
At the moment we're unable to answer these questions. When we have more information we will provide it here in the forums, and make it available at www.verizon.com. Thanks for your patience during this transition. ~Ian
Ian_VZ
Verizon Support
Notice: Content posted by Verizon employees is meant to be informational and does not supersede or change the Verizon Forums User Guidelines or Terms or Service, or your Customer Agreement Terms and Conditions or Plan. -
Hi Every one, I wish you can help me with this inquiry. we are adding Fibre tails to our network and need to do per user queuing and shaping for PPPoE using Radius and I have selected 7603 with IOS15.3(3.)S to do this for me . Noe since we are running out of IPs, we need to do Carrier Grade NAT (CGN) , and based on Cisco Feature navigator only ME3600 and ME3800 (Remote Switches) are able to perform it. I need to come up with a confirmed decision before purchasing the devices. I would appreciate any help.
Hi Adiyudha,
in a general manner, consider these interfaces as SVI or "tunnels" to connect your router to the service blade.
When loaded with a CGN image, the ServiceInfra interface is used for the management of the card. It's mandatory to have it configured to be able to boot properly the card.
The ServiceApp interfaces are used to send traffic (to be NATed or CGv6ed for instance) to and from your router.
It's necessary to configure an IP address on the serviceApp interface, we configure the router side of the tunnel. All other addresses in the range will be considered to be part of the service card side.
So if you define serviceApp1 10.1.1.1/30, 10.1.1.2 will be answered by the CGN card automatically.
These serviceApps must be part of different VRFs (vrf-lite generally) or at least one in the Global routing table and another in a VRF, to avoid routing loops ----> because you'll have to use static routes to send your i2o traffic into the CGN card and to attract back your o2i traffic to guarantee a symetrical path (important in the case of stateful translation).
So, let's take an example if you define a map pool of 20.1.1.0/24 where the external addresses will be allocated to your translations.
You define serviceApp1 in VRF "Inside" with 1.1.1.1/30.
You define serviceApp2 in VRF "Outside" with 1.1.1.5/30.
You need to configure a default route in the VRF Inside pointing to serviceApp1 (or 1.1.1.2), it will send the traffic to the CGN card to be NATed.
And you need to configure a static route 20.1.1.0/24 to serviceApp2 (or 1.1.1.6) to attract the traffic in the o2i direction.
As you said, the serviceApp addresses are only significant locally to the router and don't need to be advertised to the outside, so they can be RFC1918.
Hope it clarifies a bit (not easy without diagrams to describe such principles).
Cheers,
N.
i2o = input to output
o2i = output to intput -
Carrier grade nat - static port block allocation.
Hello,
Is it possible to configure nat (cgn) on ASR 1k to permit the same private address always get the same port block allocation from the same public address? With that You dont need nat logging.
regardsADAM619,
At the moment we're unable to answer these questions. When we have more information we will provide it here in the forums, and make it available at www.verizon.com. Thanks for your patience during this transition. ~Ian
Ian_VZ
Verizon Support
Notice: Content posted by Verizon employees is meant to be informational and does not supersede or change the Verizon Forums User Guidelines or Terms or Service, or your Customer Agreement Terms and Conditions or Plan. -
Carrier Grade Network Address Translation (CG-NAT)
Hello,
I live in the UK. One of the largest ISPs, BT, has begun trialling carrier grade network address translation (CG-NAT). In a nutshell, this introduces double NAT - first your broadband router, then the ISP's "router". This is before the ISP has introduced IPv6.
I fear it is only a matter of time before my ISP also introduces CG-NAT. Will/does Skype work in a CG-NAT scenario? If not, what are my options?
Kind regards,
AnwarI am new to Oracle VM. The dom0 and domU are set up by someone else. So I don't know the details. In the domU, I can't even ping the 10.244.69.35 address of the dom0.
# ping 10.244.69.35
PING 10.244.69.35 (10.244.69.35) 56(84) bytes of data.
From 192.168.200.50 icmp_seq=2 Destination Host Unreachable
From 192.168.200.50 icmp_seq=3 Destination Host Unreachable
From 192.168.200.50 icmp_seq=4 Destination Host Unreachable
The Cisco switch on the 10.*.*.* network is owned by IT and I can't change anything on it. This is why I try to set up NAT on the dom0. I would appreciate any help so that I can access the 10.*.*.* network from the domU. -
Hello,
I have a problem with a small IP telephony system (sip) and i'm using a cisco 881 router as router/firewall.
The problem is that sometimes you can not call in. It happens only occasionally and when it does our ip phone provider says that there is no response from our ip phone/switch back to them on the internet.
We have an ip-phone/switch-device on our local network. We we receive calls they are first routed to our ip phone provider which then sends it to us.
It can work 20 times and then it is a call that can not get to us.
How should I start debugging? Is there any logging for SIP traffic so I can send logs to a syslog server?
Thanks for any suggestions.So if was troubleshooting this the first question I would ask would be is this a new set up or something that was working fine and is now having problems.
If new set up post the configs and strip out passwords.
If was working and you now have problems start running debugs to see if you can isolate issue.
SIP Debug Commands that Support Output Filtering
debug ccsip all
debug ccsip calls
debug ccsip events
debug ccsip messages
debug ccsip preauth
debug ccsip states -
ASA5500 blocking SPA504G SIP traffic?
(Apologies if this is a reposting)
I've a client using an ASA5500 firewall - which I don't manage or have admin access to - at a new remote office. They'd like to use the same Cisco SPA504G handsets used in their other office to connect to a Hosted PBX (on public IP).
It appears as if the ASA5500 is still - despite inspection being turned off - dropping or somehow redirecting SIP traffic from the SPA504G handsets. Annoyingly, a PC on the same (internal) VLAN running X-Lite (softphone, using the same SIP settings as the handsets) is working fine. But the Cisco handsets just aren't connecting. The same configs on handsets in the other office (Netgear firewall) have worked fine for 6+ months.
We've tried changing handset source and PBX server ports (e.g. 5063, 5099) using both UDP and TCP - works fine from remote office, no connections from the ASA5500-powered office. We've also turned syslogging on for the handsets and verified they are sending the correct REGISTER etc SIP messages. But they aren't arriving at the PBX, or seemingly external to the firewall at all.
It appears as if the firewall is detecting the Cisco-originating SIP traffic specifically, and dropping it somewhere. And ignoring SIP traffic from the PC softphone. Is this possible?
If anyone can suggest any posts, diagnostic tools, documentation or other hints that I can point the remote sites' system administrators at, I'd be very grateful.
Thanks in advance,
MarkHello,
You sure the traffic is not being innittiated on the other side and the SIP inspection is kicking in????
Doble check that via a show policy-map
Remember to rate all of my posts -
Hello fellow engineers!
I have a puzzling situation implementing an Internet routing pilot project and I need someone with a fresh look at the matter because I cannot make-out what the problem is…
Scenario description:
2901 router with two (one used) DSL intf’s on board and its two GE ports connected to a switch via Port-Channel sub-int’f (router-on-a-stick is implemented). The router has two other WAN (Internet) connections via a Satelite link and a MetroEthernet link. These two are terminated on the switch on intf’s at the appropriate VLAN’s. At attached topology scheme I depict them all collocated on the router for “simplicity” (logical topology) since the router has intf’s at the corresponding networks. The aDSL and Metro links have an 8-IP public set, each.
Most servers/hosts utilize VLAN 10 (int port-channel 1.10) but they need to forward their internet traffic to corresponding Internet links so PBR is used. VLAN/subnet (all /24) pairs are:
VLAN 11 -> 10.0.1.x
VLAN 12 -> 10.0.2.x
VLAN 13 -> 10.0.3.x
VLAN 71 -> 192.168.17.x
VLAN 204 -> 172.16.204.x
and – last but not least ! – VLAN 10 -> 10.0.0.x
All servers use static 1-1 NAT while all other hosts/PC’s use the Metro link (PAT).
Situation: All PBR rules and static NAT’s of VLAN 10 behave as expected. So does the PAT for hosts of all other VLAN’s (11, 12, 13, …). The rest of the hosts of VLAN 10, i.e. PC’s with IP’s 10.0.0.x (in red), cannot get to the Internet !
What is puzzling is that traffic is matched (by ACL) and NAT does occur but all I see (via “sh ip nat tra”) are the translations of the DNS requests ! Nothing else ! To top that, tracerouting a public IP does lead to the target but when hitting that same public IP (not by name) on the browser can’t load the page !
Could pls someone spot what I’m missing !!
To help you I also attach the router config and some command outputs…
All help is appreciated.
Thanx
CostasThat last PBR statement
(route-map 10.0.0.X_hosts_PBR permit 70
description *** rest of 10.0.0.x net --> Oxygen ***
match ip address rest_of_10.0.0.x
set ip next-hop 212.251.64.153)
was not there in the first place - I got it there assuming it would help but it didn't. Actually - as mentioned - it does not get any hits !
(route-map 10.0.0.X_hosts_PBR, permit, sequence 255
Match clauses:
ip address (access-lists): rest_of_10.0.0.x
Set clauses:
ip next-hop 212.251.64.153
Policy routing matches: 0 packets, 0 bytes) -
RMI-NAT Problem with random ports
Hi,
I had a RMI server in a machine with the private IP 10.XX.XX.XX and a firewall with the public IP 196.XX.XX.XX
I am using the property: java.rmi.server.hostname to 196.XX.XX.XX and a small test application. The server is behind the firewall/NAT machine with a limited set of open ports (including the non standard 8001 port that I am using instead 1099)
1. The server start perfectly
2. The client can connect to the server and execute the method Naming.list() successfully
3. At the moment that the client attempt to perform the bind, the client hang up for almost 7 minutes and finally throws and exception due time-outs.
According a "strace" and "netstat" commands under Linux and also the flag: java.rmi.server.logCalls we obtain the next data:
1. The server open the port 8001 (PERFECT)
2. But also open a random port and the client -at the bind moment- use that port (in the range 34000-35000). And of course our firewall block all the ports except 8001.
So, is that the expect behaviour? If that is true then RMI is not functional under NAT/Firewall.
Am I missing something?
Thanks!!
GerardoHello,
Let me see if I got it right:
1. You're starting the registry (programatically) in port 8001.
2. You're creating a server implementation object.
3. Next you bind/rebind your server to this registry.
4. Your client hangs at Naming.lookup().
If this is the problem then that random port you mentioned is the server's attributed port (a ServerSocket that is hanging on accept) at the time of creation. You can avoid this by instead of using the super() call in you serverimpl constructor using the UnicastRemoteObject constructor that specifies a port (check the interface). That way you can configure your firewall to allow traffic through that port too.
However, what puzzles me is the fact that it hangs on step 4 instead of in a subsequent remote call. step 4 should be using port 8001. Can you confirm that it's hanging in Naming.lookup ?
(two other sources of data you may find usefull are the Firewall logs and a tcpdump analisys of the traffic between the firewall and the server machine)
Nuno -
I'm going to another country for a year and I would like to unlock my phone to take another sim other than my carrier. My contract with my present carrier is finished yet they still wouldnt unlock the iphone 4 for me. How can I be able to unlock it?t
Only the carrier to whom the device is locked can unlock it.
If you do not meet their requirements or they do not offer unlocking there is no official way to unlock the device.
Who is your carrier? -
Can apple tell me the carrier my iphone is with?
can apple tell me the carrier my iphone is with?
can apple tell me the carrier my phone network is lock to?Malignance wrote:
Settings > General > About > Carrier
This should show you what network it's on
this will only show the active network that the iPhone is connected to at that point in time
If the iPhone is locked to a network that does not correspond to the sim the iPhone will not work
end of -
Incoming sip calls are not working but outgoing is working with cme
I have CME setup with voip.ms on my 2800 router, my outgoing calls are working but my incoming calls are not. Below is my config, please let me know if it is something with my config:
voice translation-rule 3
rule 1 /^9142281\(...\)$/ /\1/
voice translation-profile INCOMING_CALL_1
translate called 3
dial-peer voice 1 voip
translation-profile incoming INCOMING_CALL_1
session protocol sipv2
session target sip-server
incoming called-number .%
voice-class codec 1
dtmf-relay rtp-nte
no vadI made the change, but I am getting no output from debug voip ccapi inout. What does concern me from debug ccsip messages is:
Aug 31 12:42:04.195: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 400 Bad Request - 'Invalid Host'
Via: SIP/2.0/UDP 107.6.67.238:5060;branch=z9hG4bK000d3c36;rport
From: "+19144410197" <sip:[email protected]>;tag=as7439b9c1
To: <sip:[email protected]:1061>;tag=829C8-2532
Date: Sun, 31 Aug 2014 12:42:04 GMT
Call-ID: [email protected]:5060
CSeq: 102 INVITE
Allow-Events: telephone-event
Reason: Q.850;cause=100
Server: Cisco-SIPGateway/IOS-12.x
Content-Length: 0
I also am getting this:
voicertr2#debug ccsip error
SIP Call error tracing is enabled
voicertr2#
Aug 31 12:45:07.359: //-1/xxxxxxxxxxxx/SIP/Error/sipSPI_validate_own_ip_addr: ReqLine IP addr does not match with host IP addr
Aug 31 12:45:07.359: //-1/78AE76E98009/SIP/Error/sact_idle_new_message_invite: Invalid URL in incoming INVITE -
Is there a way not to have to use the disk to start or exit Adobe Premiere Elements 13. I do not want to have to carry a disk around with me all the time.
tljtommy
There is a known No Disc error using Premiere Elements 13.
The fix is to delete the OldFilm.AEX file which is found in Window 8.1 64 bit
Local Disk C
Program Files
Adobe
Adobe Premiere Elements 13
Plug-ins
Common
NewBlue
and in the NewBlue Folder is the OldFilm.AEX file that you delete.
Adobe first posted this information in one of the threads here, and it has worked for essentially all who have
gotten the No Disc error in Premiere Elements 13.
Please let us know if this works for you also.
Thank you.
ATR -
My mail account from icloud will work if I only disconnect my wifi in my iphone and only use internet plan from my carrier. Anybody else with this problem??
I've been having the same problem since iCloud appeared and complicated an otherwise trouble-free system. Doubling frustrating is that iCloud duplicates my .Mac account so I get two of everything in my Inbox. I turned off iCloud and now mail at least goes out but I can't delete the duplicate account.
-
I have a carrier unlocked iPhone 4 with iOS 6.1. The carrier is Straight Talk. I want to restore it, if I do so, will it delete my APN profile?
Yep, but just add it back when you're done restoring.
Maybe you are looking for
-
Side-scrolling photo gallery on iweb????
I have created a site on IWeb, and have several pictures on the site (www.sharonrai.com) and I would like to make a side-scroll on the side with all my pictures from each section on it, so you can view all the pictures in a glance on the side, and if
-
How to validate that only one check box is checked in detail block
Hi All, I am using oracle Forms 10G on windows. I need help on how to validate that only one check box is checked in detail block. I have multiple records in the detail block and I have check boxes for each record in the detail block. I have a button
-
I have tried using smart brush to apply blue sky and it doesn't work.
I have watched video several times and it seems simple enough. I can highlight the area but it does not go blue. I am using Elements 11. Any suggestions??!
-
CPA Cache Monitoring is not working in PCK
Hi all, i had done a scenario Mail to File in PCK .When i checked the flow of messages in Message Monitoring . Receiver Party and Receiver Services are missing. When i try to refresh CPA cache using URL: http://<host>:<port>/CPACache/refresh?mode=del
-
How do i load adobe photoshop elements 10 on my laptop if it has no cd drive
I purchased Adobe Photoshop Elements 10 a few years ago and have been using it on a regular laptop. I just replaced that laptop with a tablet and I want to load the software on this new device. However it does not have a cd drive. I used a portabl