I have replaced a failed router with an RB-750G. It’s sole task is to route network traffic between two network segments.
I configured IP’s to the interfaces and NAT. It has been working fine for all traffic so far. Today I installed a new ShoreTel VoIP switch on the “other” segment and it is failing to communicate with the primary switch on this segment. I can Ping one switch from the other & back. It appears that we are routing & passing ICMP back & forth but the switches wont talk. The manufacturer had me try a “lsp_ping” which failed. Thier conclusion was that I have a network issue. The only device between the two switches is the RB750 so I assumed that it was blocking traffic. I looked at the firewall settings and found what appear to be default rules in place. One by one I removed them all but it made no difference. I can still pass a variety of traffic between the two segments but apparently not “LSP”. The vendor did give me a list of UDP ports that must be open (5004, 5440-5445). If I have no firewall rules in place I am not sure what else to do to insure that this traffic will pass.
If you’re just routing traffic between network segments, then you shouldn’t be using any NAT. It sounds like issues with NAT and misunderstanding of the VoIP protocols involved. Assuming you’re using SIP, you cannot just “open ports” to get things to work. SIP is just call control. There are also the protocols used to carry the voice, video, or data being described in the SDP package of the SIP messages, e.g. RTP, RTCP, UDPTL, etc.
I am pouring over documentation and loosing IQ points by the minute. At this rate I had better cancel my appearance on “Are you smarter than a 5th grader?”…
I am looking at disabling NAT (which has been meeting our need until now) and implimenting static routes. Should be rather simple but I have managed to confuse myself to the point that I am not getting there.
If the 750G is the router between subnets, you don’t need any nat or firewall for routing. If you assign each interface an address, you will get a “dynamic” static route added.
/ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S 0.0.0.0/0 ether1 1
1 ADC 10.7.0.0/24 10.7.0.2 ether2 0
2 ADC 10.7.3.0/24 10.7.3.2 ether3 0
If your devices are set to the router addresses as the default gw (10.7.X.2) then you should have no issues routing between subnets. If you have connectivity elsewhere, then add an address to another interface and you can set that as the default gw (0.0.0.0/0) so that any you can connect to any non directly connected network.
Make sure your VOIP switches point to the 750G addresses and not the cisco as the default GW - otherwise it won’t work without a route added to the cisco device(one that tells cisco that 10.7.0.4 can route the 10.7.3.0 network). ** I see this route was already added
[admin@MikroTest] > /ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
I am a little slow. I was typing my response to your first post when you posted the second. I now have:
[admin@MikroTest] > /ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
That looks okay to me. Make sure no NAT or firewall rules are enabled. If you want them added later - test connectivity without them first then add rules slowly and test often. If this is an internal network - no nat or firewall rules will be needed.
I have just the two IP addresses applied and allowed dynamic routs to be applied then added default route. Tried changing gateway on voice switch(B) from 10.7.0.4 to 10.7.0.1 (do have route in Cisco 10.7.3.0/24—>10.7.0.4).
I am passing traffic from A to B and A to Internet via B. All good except voice switch B cannot ping anything on network A or see voice switch A.
No I can’t. Looks like the trouble may in the Access Control rules in the Cisco. The route is there and I can ping 10.7.3.x hosts from the Cisco but not from other hosts on the 10.7.0.x network. I tried the Packet Tracer function in ASDM and it fails on the second pass through the ACL when trying to route traffic to 10.7.0.4.
Not a cisco person, but if the voip devices just need to communicate with each other, you should just be able to change the default gw of each device to the RB750. The RB750 will route traffic between voip devices. If all devices on the network need to connect to the voip devices on both subnets, you will either have to fix the ASA or change the default GW for the 10.7.0.0 network for all devices to point to 10.7.0.4. I’m not sure how much traffic you have and if the 750 will be able to handle it, but it is an option.
I need for VoIP devices on several routed segments to communicate with each other so I should get the Cisco issue resolved.
For initial testing I set the switch on teh 10.7.0.0 network with 10.7.0.4 as gateway and it could ping the switch on the 10.7.3.0 network but could not pass UDP traffic. With all of my tinkering I managed to break that as well. When I left on Friday I could not get the switches to see each other in any way. This morning I come in and they are working fine… There was a power failure at the 10.7.3.0 facility that lasted longer than my UPS’s.
I hate mystery fixes…
Still need to fix the ACL issue. Any ASA wizards out there?
