Bridging question

I’m trying to track down an odd issue, and wanted to see if anyone had some ideas.

I’m bridging a network using EOIP for a client that requires their local office server in my datacenter, but on the same network as their office. OK no big deal, however they are running VOIP and for some reason the wireless VOIP phones can transmit sound, but can’t receive anything.

Connection starts in the customer’s datacenter cabinet, which is a VLAN on a switchport.

In the first router I have created a tunnel and bridge interface, I bridged the vlan and tunnel together. This router also does NAT for the following setup, it’s a simple NAT setup with a single public IP mapped to the interface.

Several routers away in another location a 493 is running as an access router for that building and the customer’s office has a switch port directly on the 493.

On that router I have created the tunnel and a bridge then bridged the tunnel and ethernet port together. Works fine…

The problem comes from them using wireless VOIP phones, I created a virtual AP on the same 493 just for their office so they can roam around their part of the building with the phones. That virtual AP has been added to the bridge, and is reachable on the network. For some reason the phones can send voice, but you can never hear anything on them.

The VOIP guy who set up the phone system isn’t that bright and is more concerned with laying the blame on someone else rather than helping me help him troubleshoot the problem. The wired VOIP phones in the office work fine, there just seems to be something weird going on with the wireless phones. They are registered on the network, can ping them from the datacenter side router, they log into the server when they connect to the network…maybe you guys see something I don’t.

FYI: All the phones are using SIP

===========================
Datacenter side:

[admin@c2] /interface bridge> print
Flags: X - disabled, R - running 
 0  R name="Tunnel 100 to Vlan 100 Bridge" mtu=1500 arp=enabled mac-address=02:E1:BD:B2:3F:BF protocol-mode=none priority=0x8000 auto-mac=yes 
      admin-mac=00:00:00:00:00:00 max-message-age=20s forward-delay=15s transmit-hold-count=6 ageing-time=5m 

[admin@c2] /interface bridge port> print
Flags: X - disabled, I - inactive, D - dynamic 
 #    INTERFACE                                                     BRIDGE                                                    PRIORITY PATH-COST  HORIZON   
 0    EoIP Tunnel 100                                               Tunnel 100 to Vlan 100 Bridge                             0x80     10         none      
 1    vlan100                                                       Tunnel 100 to Vlan 100 Bridge                             0x80     10         none

[admin@c2] /interface eoip> print
Flags: X - disabled, R - running 
 0  R ;;; Tunnel to 2814
      name="EoIP Tunnel 100" mtu=1500 mac-address=02:E1:BD:B2:3F:BF arp=enabled remote-address=x.x.22.22 tunnel-id=100 

[admin@c2] /ip address> print
Flags: X - disabled, I - invalid, D - dynamic 
 #   ADDRESS            NETWORK         BROADCAST       INTERFACE                                                                                                                                                                                          
 8   192.168.5.3/24     192.168.5.0     192.168.5.255   EoIP Tunnel 100                                                                                    
                                                                                         
11   192.168.5.1/24     192.168.5.0     192.168.5.255   Tunnel 100 to Vlan 100                                                                                 
13   x.x.22.66/32   x.x.22.66   x.x.22.66   Tunnel 100 to Vlan 100

===========================
Client side:

[admin@dist-1] /interface bridge> print
Flags: X - disabled, R - running 
 0  R name="Bridge 100" mtu=1500 arp=enabled mac-address=00:0C:42:33:1E:C4 protocol-mode=none priority=0x8000 auto-mac=yes admin-mac=00:00:00:00:00:00 
      max-message-age=20s forward-delay=15s transmit-hold-count=6 ageing-time=5m 

[admin@dist-1] /interface bridge port> print
Flags: X - disabled, I - inactive, D - dynamic 
 #    INTERFACE                                                     BRIDGE                                                    PRIORITY PATH-COST  HORIZON   
 0    Tunnel 100                                                    Bridge 100                                                0x80     10         none     
 1    ether2                                                        Bridge 100                                                0x80     10         none      
 3    CVAP1                                                         Bridge 100                                                0x80     10         none 

[admin@dist-1] /interface eoip> print
Flags: X - disabled, R - running 
 0  R name="Tunnel 100" mtu=1500 mac-address=02:0C:E5:51:D8:56 arp=enabled remote-address=x.x.4.14 tunnel-id=100

[admin@dist-1] /interface wireless> print
Flags: X - disabled, R - running 

 2  R name="CVAP1" mtu=1500 mac-address=02:0C:42:2B:41:53 arp=enabled master-interface=wlan1 ssid="suite2814" wds-mode=disabled wds-default-bridge=none 
      wds-ignore-ssid=no default-authentication=no default-forwarding=yes default-ap-tx-limit=0 default-client-tx-limit=0 hide-ssid=yes 
      security-profile=suite2814 

[admin@dist-1] /ip address> print
Flags: X - disabled, I - invalid, D - dynamic 
 #   ADDRESS            NETWORK         BROADCAST       INTERFACE                                                                                           
 0   ;;; Suite 2814 - xxx xxxxx Tunnel Endpoint
     192.168.5.2/24     192.168.5.0     192.168.5.255   Tunnel 100

The VOIP guy who set up the phone system isn’t that bright

You can’t throw a dead cat without hitting someone who’s clueless about VoIP.

Make sure you are not accidently NAT’ing the traffic moving across the AP. This can occur when you have enabled “IP Firewall” on bridging and you are not specific enough on your src-nat rule(s). The lack of received audio indicates a problem in your RTP streams and that usually is a NAT problem. Packet capture the SIP traffic and look at it with Wireshark to see more details. Again, check your src-nat rules.