Interesting....Dual wan connection Router with IP phones

[voippbx]

OK. I have a 8730 at site A and site B has 10 9670 IP Phones. We are running through firewalls that are locking in IPSEC VPN hardware tunnels. I have 2 different WAN connections to SITE A. When we manually fail from WAN1 to WAN2 the firewall sees the old policy from all the 9670 phones keep sending keep alives from destination port 49xxx to 1719 UDP at site A. It appears the phones are not expiring their keep alive thus the firewall cannot tear down that policy and re route over to WAN2.

SO my question is can you within the firmware or settings file adjust the expiration or timing to a lesser value? Why won't they stop the keep alives from destination port 49xxx to 1719 UDP without unplugging/plugging the phone back in.

To recap: Site A has S8730 and site B has 10 9670's. IPSEC VPN tunnels via firewalls at both sides. Dual wan connections at both sides. When we disconnect WAN1 all data fails over to WAN2 fine. The 10 IP phones get stuck in connecting and the firewall shows the old policy still up from keep alives from the phones being sent to Site A from port 49xxx to UDP port 1719.

Sorry for the confusion tyring to get all the information in here.

Has anyone tried this or got dual WAN connections working with IP phones at a remote location without unpluging the phone to reset them into the new policy/WAN link?

 

[dufus2506]

This sounds more like a router issue than a phone issue.

Should the router recognize that WAN 1 is bad, and re-direct all packets to WAN 2? Why aren't the routes expiring? Is there no secondary route for packets to use WAN 2?

Carpe dialem! (Seize the line!)

 

[voippbx]

dufus2506 - the firewall has policies for each wan connection wan1 and wan2. When they disconnect wan1 the data automatically starts routing over wan2. Same IP for the default gateway. The issue is the IP phones still show active sessions using UDP 48300 near end to 1719 far end CLAN. They wont expire until 25455 seconds are reached. If we manually unplug them they will immediately route across the correct policy.

 

[dufus2506]

The phones don't choose the route. They are given a router by DHCP, (or static setting) and send their traffic to that router. It's up to the router to send the packets to the correct WAN link. Voice traffic isn't treated differently than other data on the network. (With the possible exception of QoS to give those packets priority.) It should otherwise route exactly the same way.

The phone's session should find the backup connection the same way a web browsing session in progress should find the new route.

Is the router being used by the phone local to that end of the network? (It should be.)

Carpe dialem! (Seize the line!)

 

[rejackson]

If the 2 wan paths are on a router or routers outside of the firewalls then the firewalls should only have one policy and one tunnel. It doesnt care what path the data is taking. It only cares about the ip addresses at the ends of the tunnel which should be the firewalls.