Description

This article describes the issue of IP phones being unable to register with Cisco Call Manager across the SRX with the Skinny Client Control Protocol (SCCP) application-level gateway (ALG) enabled.

Symptoms

When the phone boots up, it is able to obtain the CTL and configuration file from the TFTP server. The phone establishes a TCP connection (port 2000) with the Call Manager Server. The data exchange is present in the session output on the SRX, but registration still fails.

root@FW_01# run show security flow session source-prefix 172.16.1.1
node0:
----------------------------------------------------------------

Session ID: 283428, Policy name: Voice_Policy/4, State: Active, Timeout: 2, Valid
In: 172.16.1.1/50011 --> 192.168.1.1/2000;tcp, If: reth0.0, Pkts: 4, Bytes: 164 << <Usage of well-known port 2000 / sccp?</strong>
Out: 192.168.1.1/2000 --> 172.16.1.1/50011;tcp, If: reth1.0, Pkts: 2, Bytes: 84

----------------------------------------------------------------

Solution

  • SCCP is a Cisco proprietary protocol.

  • Skinny messages are carried above TCP and use port 2000.

  • The latest firmware for most phones runs SCCP version 17 or later. However, as of now, Junos OS supports SCCP version 0. If there is traffic for any SCCP version other than 0, the registration will fail.

Support for SCCP versions 16, 17, and 20 have been included in Junos OS Release 12.1X46-D10 and later.

If you are running an earlier Junos OS version, there are two possible workarounds:

  • Disable the SCCP ALG on the SRX. You will need to open the required RTP range of ports for audio traffic.

Or

  • Bring the firmware version down on the IP phone to use SCCP version 0.

Note:  Starting with Junos OS Release 12.1X46-D10, the SCCP ALG supports SCCP versions 16, 17, and 20, and several SCCP messages have been updated with a new format. Cisco Call Manager (CM) version 7 uses SCCP version 20.