Issue with Voice transmission over VPN

[sunil.kumar]

I have two fortigate firewall at two location. I made IPSEC tunnel between them. At one end, I have mitel 3300 ICP. 

I connect one IP phone 5212 at remote location. I configured  ICP of Mitel Server IP address in IP phone 5212. My phone 5212 is able to connect to Mitel server. IP phone is booting properly. I configured the extension in IP phone 5212. I am able to call to other extension also. The phone is ringing but i am not getting voice in either side.

I am using Minet protocol in my IP phone 5212.

Can anyone please help to figure out the issue?
where am i making mistake?
what should i do to resolve it?

 

[ralph]

Is the firewall allowing UDP packets through?

Ralph

[sunil.kumar]

Thanks for your response.

I did not make any type of restriction in between local and remote network over the ipsec  :(tunnel. both the network can access fully to each other.


Can you please let me, how this communication will occur between Mitel IP Phone and Mitel 3300 ICP server using Minet protocol.

[martyn]

If there isn't any port blocking in place then the issue has to be a routing one.

Are there dedicated voice vlans at both sites? If so, or even if not, does the subnet for the opposite voice vlan appear in the routing table of the gateway at both sites?

[mgodinez]

Hello,

We had a similar one way audible situation w/ our 3300 and remote IP sets.

Turned out to be ACLs in our Cisco router(s) were not allowing VOIP packets over the T1. 

From my experiences, sounds like you hava routing problem.

Regards,

Mike G.
Seattle, WA

[v2win]

Try this

Maintenance and Diagnostics->All IP telephones

On the bottom right of the screen click the ping button on one of the local phones and try and ping the other remote phone.

My guess is the local phones dont have the correct default gateway to get to the remote phones since the controller can set up the call but there is no audio.

[LoopyLou]

The phones communicate with the 3300 using the Mitai protocol for call setup or to use a feature. If you have copper trunks or a PRI for your calls then the phones stream RTP to/from the 3300 when making or taking a trunk call. If the IP phones are calling between them then the 3300 is not involved past setup and monitoring of the status. At that point when two IP phones are talking all RTP ( voice ) streams from the IP of one phone to the IP of another phone.

What you have is communication from the phones to/from the 3300. That is why you can dial and why the phones ring. What you don't have is communications between the IP's of all the sets. You will have to setup the firewalls to allow RTP to flow between the subnets of any of your remote phones and all the subnets containing your phones at the primary location. That is not currently happening and that is why no voice. 

[ralph]

Loopylou said: What you have is communication from the phones to/from the 3300. That is why you can dial and why the phones ring. What you don't have is communications between the IP's of all the sets.

I need to diagram this out and put it on line for a visual reference.

The firewalls have to allow communication to ALL devices on the voice network.  Not just the 3300.
Once the call set up is established, the PBX drops out and the voice goes between devices.

Ralph

[LoopyLou]

Its a pretty common mistake that gets made. Don't know how many times I have had to run down voice issues due to network configuration problems. The assumption by the customer is that there are voice issues so it must be the 3300. Had one site where all the phones connected to a 48 port layer 2 had one way audio calling phones on the other layer 2 switches. All other phones were fine and they could call phones on the same layer 2 just fine. They swore up and down it was the 3300.

[edwarneke]

I currently have a fortinet setup similar to yours using a 3300 and a 5320 IP Phone. I ran into some issues with my policies between my internal LAN and the LAN of the remote site. If you have NAT set on any of your policies between these 2 sites you will have issues.

You'll need to also make sure that you have routes setup on both firewalls to route traffic to the other LAN over the VPN rather than trying to do it over the internet.
You should be able to ping the phone/a computer/the MCD on both networks. If you are using windows, try using the command tracert <ip of device you were pinging> in order to verify it is routing correctly. Remember that you need routing on both sides so the traffic knows not only how to get to the MCD, but then also back to the phone.

-Ed

[johnp]

Seems the phone system gateway address is correct as you get signaling. Check the gateway (router) value for the ip phones. If you can ping a phone remotely, it's gateway addy is good that is if you allow ping.