RRQ --- keep-alive rejected (ICV authentication failure) IP Phone registration 3

[daken]

Hi All

Have some phones (1608) on a remote site connecting back to a virtualised server edition on 10.1.0

Randomly individual phone are losing registration and failing to reregister without ether:-
Powering cycling the phone.
Re-entering the users login code, extensions do not have passwords programmed.

The phones have a Timeout values of 240s and an average reregister after 55 seconds.


[pre]
11:40:44 56103901mS RasRx: v=IFace=LAN1, Src=2.2.2.2:49304, Dst=1.1.1.1:1719 peb=0
RasMessage = registrationRequest
11:40:44 56103901mS H323Evt: Recv: RegistrationRequest 2.2.2.2; Extn(5012), time since last RRQ-KA 55039, Endpoints registered: 48; Endpoints in registration: 0
11:40:44 56103901mS RasTx: v=Src=1.1.1.1:1719, Dst=2.2.2.2:49304 peb=0
RasMessage = registrationConfirm


11:41:39 56158941mS RasRx: v=IFace=LAN1, Src=2.2.2.2:49304, Dst=1.1.1.1:1719 peb=0
RasMessage = registrationRequest
11:41:39 56158941mS H323Evt: Recv: RegistrationRequest 2.2.2.2; Extn(5012), time since last RRQ-KA 55040, Endpoints registered: 48; Endpoints in registration: 0
11:41:39 56158941mS RasTx: v=Src=1.1.1.1:1719, Dst=2.2.2.2:49304 peb=0
RasMessage = registrationConfirm


11:42:34 56213980mS RasRx: v=IFace=LAN1, Src=2.2.2.2:49304, Dst=1.1.1.1:1719 peb=0
RasMessage = registrationRequest
11:42:34 56213980mS H323Evt: Recv: RegistrationRequest 2.2.2.2; Extn(5012), time since last RRQ-KA 55039, Endpoints registered: 48; Endpoints in registration: 0
11:42:34 56213980mS RasTx: v=Src=1.1.1.1:1719, Dst=2.2.2.2:49304 peb=0
RasMessage = registrationConfirm


11:44:15 56314020mS RasRx: v=IFace=LAN1, Src=2.2.2.2:49304, Dst=1.1.1.1:1719 peb=0
RasMessage = registrationRequest
11:44:15 56314020mS H323Evt: Recv: RegistrationRequest 2.2.2.2; Extn(5012), time since last RRQ-KA 100040, Endpoints registered: 48; Endpoints in registration: 0
11:44:15 56314020mS H323Evt: RRQ [highlight #FCE94F]--- keep-alive rejected (ICV authentication failure)[/highlight]
11:44:15 56314020mS RasTx: v=Src=1.1.1.1:1719, Dst=2.2.2.2:49304 peb=0
RasMessage = registrationReject

11:46:34 56453980mS H323Evt: [highlight #FCE94F]Keep-alive time-out on 5012[/highlight] (keep_alive_count 0)
11:46:34 56453980mS H323Evt: GK: Unregister endpoint XXXXXXXX_59dbc8907f1ec430 for extension 5012 reason 2 urq_reason 3
11:46:34 56453980mS CMExtnEvt: XXXXXXXX:5012 ExtnFault now 1
11:46:34 56453981mS CMExtnTx: v=5012, p1=11262
CMReleaseComp
[/pre]


Anyone have any guesses?
anyone know what "ICV authentication failure" is?

thanks
da-ken

 

[Okkie26]

Daken,

I'm very interested cause we do have the same issue at a 10.0.0.4 release.

Also on a remote site where both 1608 and 1608L esxtensions randomly losing registration.

Can you tell me which firmware your extensions are running (mine are on 1.350B).

Also, are you running the IPO under VM Ware or application server?

 

[daken]

Phone firmware 1.390A

Single, Server edition virtulised on Hyper-V

da ken

 

[Okkie26]

Do you have any Cisco routers in the network?

 

[Okkie26]

Any news Daken?

 

[daken]

Apologies
Was on holiday.

WAN at this site is an adsl2+ running over a managed(BT MPLS) cisco router (customer provided service)
shared service with data, we have requested qos be implemented.
System status is reporting packet loss(if we can trust system status)

Missing 1 keep alive should not kick the phone off the system.

We have in the past had remote phone on ships in the north sea running over satellite links, fair enough they would disconnect but they would reregister when the link was back up.

Our in house network runs over DMPVPN on cisco kit. However this is back to an IP500v2 on 10.1 over FTTC and a 10Mbit Internet circuits. Have no issues.

 

[critchey]

System status is reporting packet loss(if we can trust system status)

The general consensus on here is do not trust system status when it comes to packet loss or jitter reported.

The truth is just an excuse for lack of imagination.

 

[mattKnight]

As Okkie asked... do you have any do cisco routers or firewalls in the path? If so do they have h.323 inspection on or off?

Take Care

Matt
I have always wished that my computer would be as easy to use as my telephone.
My wish has come true. I no longer know how to use my telephone.

 

[Okkie26]

How was it called?

The the fuckup protocol..

 

[critchey]

Guys he did answer about the Cisco router...

WAN at this site is an adsl2+ running over a managed(BT MPLS) cisco router (customer provided service)

The truth is just an excuse for lack of imagination.

 

[Okkie26]

Then switch off the fixup protocol in that Cisco router.

Also, make wireshark traces on both IP Office and uplink to the POE switch.

 

[daken]

SOLVED
16xx phones do not support Encryption.
If system is set to prefer encryption this will cause issues with the 16xx phones.

Turn off encryption on the 16xx extensions.

 

[teletechman]

Thanks for posting the solution.
Mike