We have been having some issues with our Cisco VOIP system here, such as phones rebooting, SRST Fallback messages etc. During the troubleshooting process I discovered what I thought was latency with the route to the Call Manager:
MDF1#ping
Protocol [ip]:
Target IP address: 192.168.XXXX
Repeat count [5]: 100
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 192.168.22.1, timeout is 2 seconds:
!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!
!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!
Success rate is 84 percent (84/100), round-trip min/avg/max = 1/2/9 ms
We got on the phone with Cisco, replaced the adjoining switch to no avail. Upon further investigation we discovered that this is normal and has to do with the firewall policy. Cisco CUCM and other VOIP products(CUC) use a rate limit on their firewall to protect against DOS attacks, and we can safely ignore this:
MDF1#ping
Protocol [ip]:
Target IP address: 192.168.XXXX
Repeat count [5]: 100
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 192.168.22.1, timeout is 2 seconds:
!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!
!.!!!!!.!!!!!.!!!!!.!!!!!.!!!!
Success rate is 84 percent (84/100), round-trip min/avg/max = 1/2/9 ms
We got on the phone with Cisco, replaced the adjoining switch to no avail. Upon further investigation we discovered that this is normal and has to do with the firewall policy. Cisco CUCM and other VOIP products(CUC) use a rate limit on their firewall to protect against DOS attacks, and we can safely ignore this:
admin:utils firewall ipv4 list
***output Omitted***
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8 limit: avg 10/sec burst 5
LOG icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 1/min burst 5 LOG flags 0 level 4 prefix `ping flood '
DROP icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
***output Omitted***
***output Omitted***
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8 limit: avg 10/sec burst 5
LOG icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 1/min burst 5 LOG flags 0 level 4 prefix `ping flood '
DROP icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
***output Omitted***