Servers do not reply

[OnionSeller]

We are testing Juniper SRX 210 on our live network. We intend to replace Cisco 2811 with SRX. Also we are using Siemens IP phones. After replacing Cisco with Juniper, phones are not available to obtain IP address from DHCP. When they are configured manually, phones cannot reach SIP Proxy server. Traces show that requests are reaching server, but server doesn’t send the replays. We see DHCP UDP requests, and SIP TCP SYN request, but no response from server.

When we put Cisco back everything works normal.

Can anybody advise us how to troubleshoot this problem?

[mwdmeyer]

Are you using NAT or not? Post your config!

[OnionSeller]

I have attached my conf file. Im using NAT, but SIP proxy is in loal notwork so address is not natted.

|Phone|----ge.0.0.20 ----| SRX |------|Cisco1841|----ge.0.0.35----|SIP PROXY| 

Phones are connected to ge.0.0.20 interface, and SIP Proxy is connected to Cisco router over ge.0.0.35 interface.

Both interfaces are in trusted security zone with permit all policy.

ALG is disabled. Again, when I return Cisco 2811 insted of SRX everything works fine.

If you need any additional information, please ask me.

Thank you in advance!

Onion Seller

[mhariry]

Hi,

For troubleshooting you could try below steps one by one

1- do ping from the SRX to SIP server.

2- connect one PC and put it in VLAN 20 and give static IP from Voice subnet and try to ping SIP server.

3- try to configure DHCP locally on the SRX as following and testing ip phone again

            pool 192.168.30.0/24 {
                address-range low 192.168.30.11 high 192.168.30.254;
                router {
                    192.168.30.1;
                }
                boot-server x.x.x.x;  -----> your call manager
                sip-server {
                    address {
                        y.y.y.y;  ---------> SIP server IP

Regards,

Mohamed Elhariry

JNCIE-M/T # 1059, CCNP & CCIP

----------------------------------------------------------------------------------------------------------------------------------------

If this post was helpful, please mark this post as an "Accepted Solution".Kudos are always appreciated!

[OnionSeller]

Thank you for your fast reply Mohamed!

I have already tried that. Ping from PC to SIP server works fine, but telnet to the same server using SIP port 5060 fails. I did traffic sniffing on server link and saw that PC is trying to establish TCP session sending SYN segment, but server doesn’t reply back. It looks like its L4 problem, and Juniper is modifying TCP header on some way.

Other servers (mail, radius, ftp, snmp, dns etc.) are reachable.

Any ideas what could it be?

Kind regards!

[OnionSeller]

When Cisco is in network the SYN segment that SIP server is receiving looks like this:

35628  332.745096     192.168.30.101           192.168.112.10           TCP     48125 > sip [SYN] Seq=0 Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSV=15631 TSER=0 WS=1

After this, server sends ACK and continues with TCP session.

And when we replace Cisco with Juniper it looks like this:

10304  497.900165     192.168.30.101           192.168.112.10           TCP     48125 > sip [SYN] Seq=0 Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSV=15623 TSER=0 WS=1

Server dont reply on this SYN, and the phone keeps sending this packet.

Can anybody tell me how to solve this problem?

[OnionSeller]

Anybody?

[MarcTB]

Can you also attach the config fo the Cisco 1841 when you have put the srx in between ?

[OnionSeller]

After configuring duplex and speed on all trunk interfaces in the network, communication with SIP Proxy server  went fine. Before that, there were no speed or duplex missmatch alerts.

I have no idea how is this related with blocking just one destination port, but it works now and we all are happy. Even my boss bought me a brand new apple pie!

Thank you!