Moved 3300 from MPLS to VPN and now cannot handshake with MBG

[filip.korngut]

Hello all,

I have moved over a 3300 Controller from an MPLS to another office that has an IPSEC VPN tunnel, and the 3300 device cannot handshake with the MBG.    The controller is remaining in Critical state with SIP LINK FAILURE, however , from my wireshark traces, I am seeing that the MBG is not responding back to the Controller with any messages.

I have no idea why this is happening.

I am able to successfully ping and resolve names from both devices to each other (each direction).  Additionally, I am fairly confident that all ports are passing thru the firewall correctly including 5060 (I am able to telnet over port 5060 to and from each device).

Any ideas why this could be happening?

[VinceWhirlwind]

I suppose this is a silly question, but did you update the MBG, Service Configuration, ICP, Hostname or IP Address?

[filip.korngut]

I suppose this is a silly question, but did you update the MBG, Service Configuration, ICP, Hostname or IP Address?

I feel like i don't need to update anything as I just moved the entire network the controller was on to work over IPSEC instead of MPLS including all the phones, etc.    The MBG stayed in the same spot (MPLS).

Basically the only thing different is the routing on the network to and from the MBG.    But everything is pinging, name resolving, etc.

Maybe I need to update something?
Firewall setting?

[VinceWhirlwind]

Maybe SIP connectivity from the ICP is being routed to the wrong MBG interface?
Does the VPN present the moved network on the same side of the MBG as it was before?

[filip.korngut]

Maybe SIP connectivity from the ICP is being routed to the wrong MBG interface?
Does the VPN present the moved network on the same side of the MBG as it was before?

I do believe it is going to the same MBG interface as we only have one MBG device on the network  The FQDN/Ip address is correct and resolves correctly. 

The VPN is coming into the network via the firewall now and not the MPLS - but technically the same network, just moved - the MBG and ICP can ping each other.

[Chatlonut]

I think the way you think. I also want to know. I hope someone will answer this question.

[filip.korngut]

I solved it today.   The firewall was blocking SIP packets.  Once i got SIP packets to pass, everything worked.