Cisco TCP Time Outs ASA / PIX VPN - IP Handsets

[HairySupportMonkey]

Howdy,

There is a theory around that Cisco TCP time outs can cause IP handsets to de-register from a IPO.

Can anyone concur with this notion?

 

[HairySupportMonkey]

/Bump

 

[amriddle01]

You pregnant?

ACS - IP Office Implement

"I'm just off to Hartlepool to buy some exploding trousers

 

[HairySupportMonkey]

no desperate

we have done many IP / remote installs.

we used the new ASA5505 on two sites and having shitty issues with calls dropping , phones deregsitering etc.

 

[amriddle01]

A few have posted issues with VPN phone issues and reregistering but I can't recall them ever saying if they solved the problem, it's usually fixups,we have a few customers in all Cisco data envoiroments and IP phones without issue, but you could be right.

ACS - IP Office Implement

"I'm just off to Hartlepool to buy some exploding trousers

 

[HairySupportMonkey]

indeed - we have customers on 870 series cisco routers and firewalls with NO issues.

fixups dont apply in v7 or above asa i understand, but I have removed h323 from my service policy group.

using v8 software (ASA)

 

[amriddle01]

http://www.avaya.co.uk/emea/en-us/resource/assets/applicationnotes/ASA-h323-Stn.pdf

have you read that?

ACS - IP Office Implement

"I'm just off to Hartlepool to buy some exploding trousers

 

[amriddle01]

Also look into the group policies and security policies possible default policies, for listen/monitor H323,225 and uncheck that. Then test

ACS - IP Office Implement

"I'm just off to Hartlepool to buy some exploding trousers

 

[HairySupportMonkey]

Ill give it a try - thanks

 

[HairySupportMonkey]

fwiw -the inspection policies have h323 unchecked.

 

[amriddle01]

Make sure you have the Inspect PPTP line enabled:

policy-map global_policy
class inspection_default
inspect pptp

ACS - IP Office Implement

"I'm just off to Hartlepool to buy some exploding trousers

 

[amriddle01]

On the ASA there should be no entries under:

Configuration > Firewall > Objects > Inspect Maps > H.323
Configuration > Firewall > Objects > Class Maps > H.323

that's all I can think of.

ACS - IP Office Implement

"I'm just off to Hartlepool to buy some exploding trousers

 

[amriddle01]

Did this work then?

ACS - IP Office Implement

"I'm just off to Hartlepool to buy some exploding trousers

 

[HairySupportMonkey]

well, i dont think its working. just checked a customers site and the phones are still falling off.

also, this isnt a PPTP vpn tunnel, its IPSEC