Juniper SSG and IP Office SCN Config?

[nt7332]

Does anyone have a sample config of two SSG Junipers running a VPN and the IP Offices Running SCN. I just want to make sure i have everything setup correctly.

It seems as if everything is setup correctly, but IP Office "A" says the SCN is UP and the other IP Office "B" side says the SCN is "not connected". IP Office B is transmitting packets and the NOT receiving any packets? IP Office A is sending and Receiving packets? Any thoughts?????

Glboal Voice Integration
N.T
AVAYA ACE.

 

[tlpeter]

what systems and what software version do they have ?

ACS - Implement IP Office
ACA - Implement IP Telephony -- ACA - Design IP Telephony
ACA - Voice Services Management
______________
Women and cats can do as they please and men and dogs should relax and get used to the idea!

 

[Bas1234]

What IPO's do you have?
Routes OK?
SCN Licences valid?
Firewall might block 1719/1720 and 5xxxxx range?

___________________________________________
It works! Now if only I could remember what I did...
___________________________________________

 

[nt7332]

IP500's 4.2.17 Juniper SSG 40 at site A and SSG 5 at site B

Glboal Voice Integration
N.T
AVAYA ACE.

 

[tlpeter]

Do you have networking licenses on both sites ?

ACS - Implement IP Office
ACA - Implement IP Telephony -- ACA - Design IP Telephony
ACA - Voice Services Management
______________
Women and cats can do as they please and men and dogs should relax and get used to the idea!

 

[nt7332]

Routes are ok can ping between sites.
Firewall is set to allow "Any"
SCN licenses are showing "Valid"

Glboal Voice Integration
N.T
AVAYA ACE.

 

[tlpeter]

Double check the iplines and iproutes
There must be something wrong

ACS - Implement IP Office
ACA - Implement IP Telephony -- ACA - Design IP Telephony
ACA - Voice Services Management
______________
Women and cats can do as they please and men and dogs should relax and get used to the idea!

 

[Bas1234]

If you do a tracteroute?

___________________________________________
It works! Now if only I could remember what I did...
___________________________________________

 

[nt7332]

I have checked them over 3 times and re-built them 2 times? i know there is something wrong, im just not sure if im seeing what im doing wrong, that's why i would like to see a working sample config so i can compare the two. i think im going crazy! I probably have a typo somewhere and its driving me NUTZ!

Glboal Voice Integration
N.T
AVAYA ACE.

 

[Bas1234]

You could have a look here;

http://marketingtools.avaya.com/kno...gedProjects/manuals/appnotes/ipo-jun-ssg5.pdf

It's not a VPN/VPN setup but VPN/RemotePhones but it's worth a check on how the VPN is setup.

___________________________________________
It works! Now if only I could remember what I did...
___________________________________________

 

[tlpeter]

Ipline on site A

192.168.10.1 is site B configured on site A
iproute
0.0.0.0 0.0.0.0 ipadres of the gateway on site A

Ipline on site B

192.168.20.1 is site A configured in site B
iproute
0.0.0.0 0.0.0.0 ipadres of the gateway on site B

Voice networking must be ticked on site A and site B

Can you check this settings ?

ACS - Implement IP Office
ACA - Implement IP Telephony -- ACA - Design IP Telephony
ACA - Voice Services Management
______________
Women and cats can do as they please and men and dogs should relax and get used to the idea!

 

[kwing112000]

you may need to turn the H323 inspect off in the junipers.

Kevin Wing
ACS- Implement IP Office
ACA- Implement IP Office
Carousel Industries

 

[nt7332]

RosesAlbFW1-> trace-route 192.168.6.5 from eth0/1
Type escape sequence to escape

Send ICMP echos to 192.168.6.5, timeout is 2 seconds, maximum hops are 32, tra
ce from ethernet0/1
1 90ms 110ms 96ms 192.168.6.5
Trace complete
RosesAlbFW1->
--------------------------------------------------------------------------------------------------------
SanfordFlFW2-> trace-route 192.168.4.5 from eth0/6
Type escape sequence to escape

Send ICMP echos to 192.168.4.5, timeout is 2 seconds, maximum hops are 32, tra
ce from ethernet0/6
1 91ms 92ms 91ms 192.168.4.5
Trace complete
SanfordFlFW2-> trace-route 192.168.4.4 from eth0/6
Type escape sequence to escape

Send ICMP echos to 192.168.4.4, timeout is 2 seconds, maximum hops are 32, tra
ce from ethernet0/6
1 91ms 114ms 90ms 192.168.4.4
Trace complete
SanfordFlFW2->


Glboal Voice Integration
N.T
AVAYA ACE.

 

[nt7332]

Ipline on site A

192.168.10.1 is site B configured on site A
iproute
0.0.0.0 0.0.0.0 ipadres of the gateway on site A (just checked this out and its good)

Ipline on site B

192.168.20.1 is site A configured in site B
iproute
0.0.0.0 0.0.0.0 ipadres of the gateway on site B (just checked this out and its good)

Voice networking must be ticked on site A and site B (just checked this out and its good)

Can you check this settings ?

Glboal Voice Integration
N.T
AVAYA ACE.

 

[nt7332]

where do i find the H323 inspect option?

Glboal Voice Integration
N.T
AVAYA ACE.

 

[tlpeter]

Then you have a network problem if your networking licenses are valid !

By the way your ping time are a bit high !
200ms is the max for voice calls

ACS - Implement IP Office
ACA - Implement IP Telephony -- ACA - Design IP Telephony
ACA - Voice Services Management
______________
Women and cats can do as they please and men and dogs should relax and get used to the idea!

 

[nt7332]

I know it has to be a network problem. i know its high but still under 200ms. im still at a loss....

Glboal Voice Integration
N.T
AVAYA ACE.

 

[Bas1234]

You could check here on page 24;

http://www.avaya.com/master-usa/en-us/resource/assets/applicationnotes/ns5gt-ipt.pdf

___________________________________________
It works! Now if only I could remember what I did...
___________________________________________

 

[tanderson3733]

For Juniper SSG, you want to go to "Security -> ALG" and uncheck H323.

There's also a way to build a VPN tunnel that doesn't require policies - I can't remember the steps off the top of my head but look on Juniper's website documentation under ScreenOS - I think section 5 is VPNs. You'll want to find the "Route-based VPN" section.

 

[etherbadger]

I just had this same problem with 2 ssg20s connected via a point to point t1.

since it took me most of the day to figure it out, I figured I'd share since the avaya and juniper documentation is sparse.

the bgroup0 interface needs to be in route mode. nat mode will not allow the ip office scn traffic.

I turned off the h323 and sip ALGs.

if everything else looks right, check your mode on the trust/lan interface and set it to route.

the untrust/wan interfaces usually default to route mode.