SRX Services Gateway
Highlighted
SRX Services Gateway

SRX 110 - SIP call cannot resume from on-hold

‎07-17-2016 08:45 PM

Hi, we are having this annoying issue since we rebuilt our SRX110 from scratch. We lost the original config and it seems that there was something configured on there that made this work.

Each time we receive a SIP call, if we put the caller on hold for more than one minute, when we un-hold the call, the caller can hear us but we cannot hear the caller. What we normally have to do, is put the caller back on hold and then un-hold to be able to have a two-way conversation again. This is really impacting on our business and we would be grateful if we could rectify this ASAP with your assistance.

 

We have tried to disable sip alg but that has not helped.

 

Here is the device:

 

Model: srx110h2-va
JUNOS Software Release [12.1X46-D40.2]

18 REPLIES 18
Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-17-2016 09:23 PM

Hi,

 

Are you using TCP or UDP for the underlying SIP communication ?

 

I beleieve you would be using UDP.

 

One possibility is that this could be a timeout issue as the UDP times out in 60 seconds.

 

I would suggest modifying the idle-timeout for this particular udp session to 120 seconds and check if the same behaviour is seen again, but now at 120 seconds.

 

This would give us an idea if timeout is the issue and we can proceed accordingly.

 

For changing the timeout, you can try creating a custom application with "inactivity-timeout 120" and then call it in the respective security policy.

 

Regards,

Sahil Sharma

---------------------------------------------------

Please mark my solution as accepted if it helped, Kudos are appreciated as well.

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-17-2016 09:34 PM

Hi Sahil,

 

Thanks for your comment. Unfortuntely we tried that too but it did not help.

 

Once we apply these things we do a commit and also reboot the phones just to make sure. Anything else we should be doing? Will a commit full be better?

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-17-2016 10:05 PM

Hi,

 

I do not think that a commit full would resove the issue, however you can still try if you want to.

 

I think the next step would be to perform a simultaneous packet capture on the SRX and the end hosts along with a security flow traceoptions to see what is happening and if the SRX is contributing to this issue.

 

Please go through the following link for traceoptions :-

http://kb.juniper.net/InfoCenter/index?page=content&id=KB21757&actp=search

 

Regards,

Sahil Sharma

---------------------------------------------------

Please mark my solution as accepted if it helped, Kudos are appreciated as well.

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-17-2016 10:11 PM

Hello,

 

 

Adding to what Sahil has suggested I would suggest you to configure "set security alg sip retain-hold resources"  and see if this changes the situation.

 

To understand more on this command please refer the below document:-

https://www.juniper.net/documentation/en_US/junos12.1x46/topics/concept/alg-security-sip-hold-resour...

 

Thanks,
Pulkit Bhandari
Please mark my response as Solution Accepted if it Helps, Kudos are Appreciated too. Smiley Happy

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-17-2016 11:22 PM

Hi, i have captured the log from the source IP of my phone and dest port 5060. Let me know if that makes sense. See attached.

Attachments

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-18-2016 12:36 AM

Hi,

 

I do not see any drops on the SRX for this flow.

 

Did you try what Pulkit suggested earlier ?

 

"set security alg sip retain-hold resources" 

 

Regards,

Sahil Sharma

---------------------------------------------------

Please mark my solution as accepted if it helped, Kudos are appreciated as well.

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-18-2016 12:41 AM

Hi,

 

To add on, please capture the reverse flow as well in the traceoptions and we would be able to see if it is getting dropped.

 

Regards,

Sahil Sharma

---------------------------------------------------

Please mark my solution as accepted if it helped, Kudos are appreciated as well.

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-18-2016 12:56 AM

Hi, somehow teh reverse flow is empty. See attached. This is what my capture is like:

 

set security flow traceoptions file sipDebug1017
set security flow traceoptions flag basic-datapath
set security flow traceoptions packet-filter pf1 protocol udp
set security flow traceoptions packet-filter pf1 source-prefix 172.16.69.94/32
set security flow traceoptions packet-filter pf1 destination-port 5060

set security flow traceoptions packet-filter pf2 protocol udp
set security flow traceoptions packet-filter pf2 destination-prefix 172.16.69.94/32
set security flow traceoptions packet-filter pf2 destination-port 5060

Attachments

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-18-2016 01:22 AM

Hey guys, i have done the following:

 

delete security alg sip disable

set security alg sip retain-hold-resource

 

This has solved the issue. Thanks for this. However, i am afraid that this will bring back the issues we had with alg sip enabled? Will that be OK?

 

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-18-2016 01:41 AM

Ive already had to restore the "set security alg sip disable" command as after a while i could not call my extention 😞

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-18-2016 01:59 AM

Hello,

 

 

If i have understood correctly you have got the SIP ALG disabled and opened all the ports for communication manually through security policies. Please correct me if i am wrong.

 

If the above is the scenario then the command "set security alg sip retain-hold-resources" might not be of use and it will solve the problem if you have SIP ALG enabled.

 

Now when you enable SIP ALG then you are not able to call your extension itself which points us to a problem with the SIP ALG. Do you have any information what the problem is as you had the ALG disabled in advance to resolve the issue.

 

Thanks,

Pulkit Bhandari

 

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-18-2016 02:05 AM

Hello,

 

 

Adding to my above comment, There is also a bug with ALG feature which causes ALG not to function as expected and probably it could be the reason that when you enable SIP ALG then you are not able to call your extension. 

 

The bug that i am referring to is as below:-

https://prsearch.juniper.net/InfoCenter/index?page=prcontent&id=PR1120757 

 

Thanks,

Pulkit Bhandari

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-18-2016 04:58 PM

Hi, let me break it down for you.

 

When i have sip alg set to disabled, all my extensions work and the ONLY problem is that on hold issue.

 

when i enter the "set security alg sip retain-hold-resources" command with sip alg still disabled, the on hold issue remains.

 

when i delete the sip alg disable command, but leave the "set security alg sip retain-hold-resources" command, then reboot the phone, the on-hold issue is solved....but after a while when i try to call that extention, it does not ring.

 

Also, can you elaborate on what you mean by "opened all the ports for communication manually through security policies" please?

 

 

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-18-2016 11:05 PM

Hi,

 

When i have sip alg set to disabled, all my extensions work and the ONLY problem is that on hold issue.

 -- Understood

 

when i enter the "set security alg sip retain-hold-resources" command with sip alg still disabled, the on hold issue remains.

-- This command would have no effect if the SIP alg is disabled.

 

when i delete the sip alg disable command, but leave the "set security alg sip retain-hold-resources" command, then reboot the phone, the on-hold issue is solved....but after a while when i try to call that extention, it does not ring.

 -- It means that this command resolves the hold issue for you when the ALG is enabled.

--But it introduces new issue for you where the extension does not ring.

--This essentially means that the SIP ALG might not be working properly and you might be hitting the bug mentioned earlier by Pulkit.

 

Also, can you elaborate on what you mean by "opened all the ports for communication manually through security policies" please?

-- SIP ALG opens pinholes after inspecting SIP packets to allow the return communication. If your setup works without ALG, it means that you would have opened all the ports between the source/destination server manuall using security policies.

 

Suggestion would be to upgrade the SRX to a resolved version for that PR.

 

Regards,

Sahil Sharma

---------------------------------------------------

Please mark my solution as accepted if it helped, Kudos are appreciated as well.

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-19-2016 12:43 AM

sahilsha, Thanks for your reply. I cannot view the bug link. It comes out as null.

 

I will try and perform an upgrade when i have downtime and see if it works.

 

However, i am on the JTAC recommended version for this device and the device was working OK before losing config. Could MTU play a role too?

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-19-2016 02:01 AM

Hi,

 

The version you are running is affected by this PR.

Moreover, the recommended versions have been updated recently, please go through the following link :-

http://kb.juniper.net/InfoCenter/index?page=content&id=KB21476&smlogin=true

 

This doesn not seem to be an issue with the MTU.

 

The PR has been resolved in the following and their subsequent releases :-

12.1X46-D45 12.3X48-D26 12.3X48-D30 15.1X49-D40

 

Regards,

Sahil Sharma

---------------------------------------------------

Please mark my solution as accepted if it helped, Kudos are appreciated as well.

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-20-2016 11:15 PM

Hi guys, i finally got a maintenance window to upgrade the OS and i got it to 12.3X48-D30.7

 

Then the only alg command i put on there was: set security alg sip retain-hold-resource

 

That fixed the on-hold issue but then the rest of the alg issues came back which forced me to disable alg sip 😞

 

Some of the issues are the hunt group does not work and busy/free lamp not working to name a few. Those are Polycom phones btw.

 

Thanks.

 

 

Highlighted
SRX Services Gateway

Re: SRX 110 - SIP call cannot resume from on-hold

‎07-21-2016 12:40 AM

Hello,

 

 

This would need more investigation and hence i would suggest you to open a case with JTAC.

 

Thanks

Pulkit Bhandari

Feedback