Table Of Contents
Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways
Benefits of Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways
MGCP Gateway Behavior and Voice Security Features
Voice Security Features Interoperability with Endpoints
Configuring IPSec on Cisco CallManager
Configuring Voice Security Features on Cisco IOS MGCP Gateways
Configuring Secure IP Telephony Calls
Verifying Voice Security Features on Cisco IOS MGCP Gateways
Voice Security Features Example
mgcp validate call-agent source-ipaddr
Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways
The Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways feature provides support for Cisco Secure Survivable Remote Site Telephony (SRST) and voice security features that include authentication, integrity, and encryption of voice media and related call control signaling.
Feature History for the Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways Feature
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
Prerequisites for Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways
Make sure that the following tasks have been completed before configuring the Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways feature:
•
Cisco IOS Media Gateway Control Protocol (MGCP) is configured.
•
•
•
It is recommended that IP security (IPSec) be configured on the Cisco IOS gateway. Both software and hardware-based IPSec connections are supported.
For more information on configuring Cisco IOS-based (software) IPSec, refer to the following:
•
•
For more information on configuring hardware-based IPSec on the gateway, refer to the following:
•
•
•
•
It is recommended that IPSec be configured on the Cisco CallManager. For more information, refer to the Microsoft Knowledge Base article "Configuring IPSec Between a Microsoft Windows 2000 Server and a Cisco Device."
If you want to interoperate with Cisco IP phones, make sure that the following tasks have been completed before configuring the Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways feature:
•
•
–
–
Restrictions for Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways
The Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways feature is supported on the Cisco IOS MGCP 0.1 only.
Cisco IOS MGCP gateways support voice security features on the following endpoints only: T1, E1, FXS, and FXO.
When a Cisco IOS MGCP voice gateway is used in conjunction with the Cisco CallManager, the automatic download feature that allows you to complete the gateway configuration on the Cisco CallManager server by downloading the configuration to that gateway through a TFTP server is not supported with voice security features.
Voice security during conferencing, transcoding, and music-on-hold is not supported.
Note
Table 1 provides a list of supported IP phones, gateways and network modules for voice security features.
Table 1 Supported IP Phones, Gateways and Network Modules for Voice Security Features
Voice security features impact quality of service (QoS) as follows:
•
•
Table 2 SRTP Codec Bandwidth Requirements
G.711 mu-law, G.711 A-law
10—20
96—80
99.2—81.6
G.729, G.729A
10—220
40—9.454
43.2—9.6
Only G.711 and G.729 codecs support voice security features.
Voice security features support channel density on the TI-5510 digital signal processor (DSP) as shown in Table 3.
Table 3 TI -5510 DSP Channel Density
Use the codec complexity command in voice-card configuration mode to specify secure codec complexity and call density per DSP.
Information About Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways
To configure the Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways feature, you should understand the following concepts:
•
Benefits of Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways
•
•
Feature Design of Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways
The Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways feature implements voice security features that include signaling authentication along with media and signaling encryption on MGCP gateways. The feature provides secure VoIP calls by addressing security requirements for privacy, integrity, and confidentiality of voice conversations. The Cisco IP telephony network establishes and maintains authenticated communications using authentication and encryption technology. Signaling authentication validates that no tampering has occurred to signaling packets during transmission. Encryption, the process of converting clear-text data into enciphered data, provides data integrity and authentication. IPSec, a standards-based set of security protocols and algorithms, ensures that signaling information, that is, DTMF digits, passwords, personal identification numbers (PINs), encryption keys, and so forth., that is sent between the gateway and Cisco CallManager is encrypted. Media encryption using standards-based SRTP ensures that media streams between supported devices are secure.
Voice security features support the following capabilities between gateways and from gateways to IP phones that support the encryption feature:
•
•
•
•
•
Figure 1 shows a typical topology where voice security features are deployed.
Figure 1 Voice Security Features in the Telephony Network
MGCP Gateway Behavior and Voice Security Features
To implement voice security features in Cisco CallManager networks, the MGCP gateway communicates with Cisco CallManager over a secure IPSec connection that provides encryption of IP packets. To ensure that your signaling information is secure, an IPSec connection must be established between the CallManager and the gateways, as described in the section "Prerequisites for Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways." You can verify that the IPSec tunnel is secure using the commands listed in the "Verifying Voice Security Features on Cisco IOS MGCP Gateways" section.
Note
After the IPSec tunnel is established, all call control and signaling of MGCP packets between the gateway and Cisco CallManager go through the secured IPSec tunnel, with the Cisco CallManager directing the MGCP gateway to set up and tear down SRTP streams. SRTP media keys are distributed by Cisco CallManager through the secured IPSec tunnel.
Cisco implements voice security features on MGCP gateways by supporting the SRTP package and SRTP Session Description Protocol (SDP) extensions, as defined in the Internet Engineering Task Force (IETF) specification, draft-ietf-mmusic-sdescriptions-02.txt, Security Descriptions for Media Streams. SRTP package capability is disabled by default. Use the Cisco IOS command line interface (CLI) to enable the feature. For more information, see the section "Configuring Voice Security Features on Cisco IOS MGCP Gateways."
Cisco uses the Internet Key Exchange (IKE) standard to implement IPSec. IKE provides authentication of the IPSec peers, negotiates IPSec keys, and IPSec security associations (SAs). An IPSec SA describes how two or more entities will use security services to communicate securely. For example, an IPSec SA defines the encryption algorithm, the authentication algorithm, and the shared session key to be used during the IPSec connection. Both IPSec and IKE require and use SAs to identify the parameters of their connections. IKE can negotiate and establish its own SA. The IPSec SA is established either by IKE or by manual user configuration. IKE has two phases of key negotiation: phase 1 and phase 2. Phase 1 negotiates a security association (a key) between two IKE peers. The key negotiated in phase 1 enables IKE peers to communicate securely in phase 2. During phase 2 negotiation, IKE establishes keys (security associations) for other applications, such as IPSec.
The Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways feature also implements an extended codec selection algorithm that combines selection of a codec with selection of a cryptographic suite to be used to encrypt the RTP stream. Cisco IOS Release 12.3(11)T supports the AES_CM_128_HMAC_SHA1_32 cryptographic suite, which includes the AES-128-countermode encryption algorithm and the Hashed Message Authentication Codes (HMAC) Secure Hash Algorithm1 (SHA1) authentication algorithm.
Voice Security Features Interoperability with Endpoints
Cisco IOS MGCP gateways support voice security features on T1, E1, FXS, and FXO endpoints supported by network modules listed in Table 1, thereby enabling secure calls from analog phone to analog phone, or fax machine to fax machine. Similarly, secure calls are enabled from time- division multiplexing (TDM) endpoints or analog phones to Cisco IP phones. For a Cisco IP Phone to make and receive secure calls, all endpoints, that is, phones of all call participants, must support voice security features. If a call is nonsecure, no special icon displays on the phone. If a call is secure, the phone displays either the authenticated or encrypted call icons. For more information on secure call icons, refer to Cisco IP Phone 7970 Administration Guide for Cisco CallManager, Release 4.x or later, "Identifying Encrypted and Authenticated Phone Calls" section.
How to Configure Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways
This section contains the following procedures:
•
•
•
•
•
Installing Cisco CallManager
This task installs Cisco CallManager and configures it to work with IPSec and the Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways feature.
Step 1
•
•
Step 2
Step 3
•
–
–
Follow the steps listed in the ReadMe file.
Step 4
•
–
–
Follow the steps listed in the ReadMe file.
Step 5
•
•
•
Step 6
Configuring IPSec on Cisco CallManager
This task configures the IPSec connection between the MGCP gateway and the Cisco CallManager.
Step 1
•
•
•
•
•
Step 2
•
•
•
•
•
•
•
•
•
Step 3
•
•
•
•
•
•
•
Step 4
•
•
•
•
Note
•
Note
•
•
•
•
Note
•
Step 5
•
•
•
•
•
•
Step 6
•
Step 7
Step 8
Step 9
Configuring Voice Security Features on Cisco IOS MGCP Gateways
This task configures voice security features on the gateway.
Prerequisites
We strongly recommend that you first establish an IPSec connection between the Cisco CallManager and the MGCP gateway before you use the MGCP SRTP package. Otherwise, media keys will be sent in clear text and your voice call will not be considered secure. For more information, see the sections "Installing Cisco CallManager" and "Configuring IPSec on Cisco CallManager."
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Configuring Secure IP Telephony Calls
This task enables secure IP telephony calls from gateway to IP phone.
Certificate Trust Lists
Voice security features use digital certificates contained in eTokens for device authentication. This process validates the identity of a device and ensures that the entity is who it claims to be. Device authentication occurs between the Cisco CallManager server and supported IP phones when each entity accepts the certificate of the other entity. Cisco implements device authentication using the CTL feature on the Cisco CallManager. The CTL Client creates a certificate on each server in the cluster and generates a CTL file in the TFTP Path of the server for the phones to download. This file provides the IP phone with a list of certified hosts that it can trust. For more information, refer to Cisco IP Phone Authentication and Encryption for Cisco CallManager 4.0(1), "Signaling Authentication" chapter.
Prerequisites
•
•
•
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
•
•
Verifying Voice Security Features on Cisco IOS MGCP Gateways
This task verifies voice security feature configuration and MGCP gateway to Cisco CallManager IPSec connections.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
DETAILED STEPS
Step 1
Router# show mgcpMGCP Admin State ACTIVE, Oper State ACTIVE - Cause Code NONEMGCP call-agent: 10.7.0.200 Initial protocol service is MGCP 0.1The following line shows that call-agent validation is enabled:
MGCP validate call-agent source-ipaddr ENABLEDMGCP block-newcalls DISABLEDMGCP send SGCP RSIP: forced/restart/graceful/disconnected DISABLEDMGCP quarantine mode discard/stepMGCP quarantine of persistent events is ENABLEDMGCP dtmf-relay for VoIP disabled for all codec typesMGCP dtmf-relay for VoAAL2 disabled for all codec typesMGCP voip modem passthrough disabledMGCP voaal2 modem passthrough disabledMGCP voip modem relay: Disabled.MGCP TSE payload: 100MGCP T.38 Named Signalling Event (NSE) response timer: 200MGCP Network (IP/AAL2) Continuity Test timer: 200MGCP 'RTP stream loss' timer disabledMGCP request timeout 500MGCP maximum exponential request timeout 4000MGCP gateway port: 2427, MGCP maximum waiting delay 3000MGCP restart delay 0, MGCP vad DISABLEDMGCP rtrcac DISABLEDMGCP system resource check DISABLEDMGCP xpc-codec: DISABLED, MGCP persistent hookflash: DISABLEDMGCP persistent offhook: ENABLED, MGCP persistent onhook: ENABLEDMGCP piggyback msg DISABLED, MGCP endpoint offset DISABLEDMGCP simple-sdp ENABLEDMGCP undotted-notation DISABLEDMGCP codec type g711ulaw, MGCP packetization period 20MGCP JB threshold lwm 30, MGCP JB threshold hwm 150MGCP LAT threshold lwm 150, MGCP LAT threshold hwm 300MGCP PL threshold lwm 1000, MGCP PL threshold hwm 10000MGCP CL threshold lwm 1000, MGCP CL threshold hwm 10000MGCP playout mode is adaptive 60, 4, 200 in msecMGCP Fax Playout Buffer is 300 in msecMGCP media (RTP) dscp: ef, MGCP signaling dscp: af31MGCP default package: line-packageThe following lines show that the srtp-package command is enabled:
MGCP supported packages: gm-package dtmf-package mf-package trunk-packageline-package ms-package dt-package mo-package mt-packagesst-package fxr-package srtp-packageMGCP Digit Map matching order: shortest matchSGCP Digit Map matching order: always left-to-rightMGCP VoAAL2 ignore-lco-codec DISABLEDMGCP T.38 Fax is ENABLEDMGCP T.38 Fax ECM is ENABLEDMGCP T.38 Fax NSF Override is DISABLEDMGCP T.38 Fax Low Speed Redundancy: 0MGCP T.38 Fax High Speed Redundancy: 0MGCP control bound to interface FastEthernet0/0MGCP media bind :DISABLEDMGCP Upspeed payload type for G711ulaw: 0, G711alaw: 8MGCP Dynamic payload type for G.726-16K codecMGCP Dynamic payload type for G.726-24K codecMGCP Dynamic payload type for G.Clear codecStep 2
Router# show mgcp connectionEndpoint Call_ID(C) Conn_ID(I) (P)ort (M)ode (S)tate (CO)dec (E)vent[SIFL] (R)esult[EA] Encryption(K)The following line shows that encryption status is enabled, K=1.
1. S1/DS1-0/1 C=2,1,2 I=0x2 P=18204,0 M=2 S=4,4 CO=1 E=0,0,0,0 R=0,0 K=1Step 3
Router# show mgcp srtp summaryMGCP SRTP Connection SummaryEndpoint Conn Id Crypto Suiteaaln/S3/SU0/0 8 AES_CM_128_HMAC_SHA1_32aaln/S3/SU0/1 9 AES_CM_128_HMAC_SHA1_32S3/DS1-0/1 6 AES_CM_128_HMAC_SHA1_32S3/DS1-0/2 7 AES_CM_128_HMAC_SHA1_324 SRTP connections activeRouter# show mgcp srtp detailMGCP SRTP Connection Detail for Endpoint *Definitions: CS=Crypto Suite, KS=HASHED Master Key/Salt, SSRC=Syncronization Source, ROC=Rollover Counter, KDR=Key Derivation Rate, SEQ=Sequence Number, FEC=FEC Order, MLT=Master Key Lifetime, MKI=Master Key Index:MKI SizeEndpoint aaln/S3/SU0/0 Call ID 2 Conn ID 8Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=3NaOYXS9dLoYDaBHpzRejREfhf0= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Endpoint aaln/S3/SU0/1 Call ID 101 Conn ID 9Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:Not ConfiguredEndpoint S3/DS1-0/1 Call ID 1 Conn ID 6Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=3NaOYXS9dLoYDaBHpzRejREfhf0= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Endpoint S3/DS1-0/2 Call ID 100 Conn ID 7Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:Not Configured4 SRTP connections displayedRouter# show mgcp srtp detail S3/DS1-0/*MGCP SRTP Connection Detail for Endpoint S3/DS1-0/*Definitions: CS=Crypto Suite, KS=HASHED Master Key/Salt, SSRC=Syncronization Source, ROC=Rollover Counter, KDR=Key Derivation Rate, SEQ=Sequence Number, FEC=FEC Order, MLT=Master Key Lifetime, MKI=Master Key Index:MKI SizeThe following lines allow you to compare and validate a hashed version of the master key and salt, as indicated by the KS field, without the display revealing the actual master key and salt.
Endpoint S3/DS1-0/1 Call ID 1 Conn ID 6Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=3NaOYXS9dLoYDaBHpzRejREfhf0= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Endpoint S3/DS1-0/2 Call ID 100 Conn ID 7Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:Not Configured2 SRTP connections displayedStep 4
Router# show mgcp statisticsUDP pkts rx 0, tx 0Unrecognized rx pkts 0, MGCP message parsing errors 0Duplicate MGCP ack tx 0, Invalid versions count 0The following line shows the number of dropped packets from unconfigured call agents.
rx pkts from unknown Call Agent 0CreateConn rx 0, successful 0, failed 0DeleteConn rx 0, successful 0, failed 0ModifyConn rx 0, successful 0, failed 0DeleteConn tx 0, successful 0, failed 0NotifyRequest rx 0, successful 0, failed 0AuditConnection rx 0, successful 0, failed 0AuditEndpoint rx 0, successful 0, failed 0RestartInProgress tx 0, successful 0, failed 0Notify tx 0, successful 0, failed 0ACK tx 0, NACK tx 0ACK rx 0, NACK rx 0IP address based Call Agents statistics:No Call Agent message.System resource check is DISABLED. No available statisticStep 5
Router# show call active voiceGENERIC: SetupTime=21072 Index=0 PeerAddress= PeerSubAddress= PeerId=0PeerIfIndex=0 LogicalIfIndex=0 ConnectTime=0 CallState=3 CallSecurity = On CallOrigin=2 ChargedUnits=0InfoType=0 TransmitPackets=375413 TransmitBytes=7508260 ReceivePackets=377734ReceiveBytes=7554680VOIP: ConnectionId[0x19BDF910 0xAF500007 0x0 0x58ED0] RemoteIPAddress=17635075RemoteUDPPort=16394 RoundTripDelay=0 SelectedQoS=0 SessionProtocol=1SessionTarget= OnTimeRvPlayout=0 GapFillWithSilence=0 GapFillWithPrediction=600GapFillWithInterpolation=0 GapFillWithRedundancy=0 HiWaterPlayoutDelay=110LoWaterPlayoutDelay=64 ReceiveDelay=94 VADEnable=0 CoderTypeRate=0GENERIC: SetupTime=21072 Index=1 PeerAddress=+14085271001 PeerSubAddress=PeerId=0 PeerIfIndex=0 LogicalIfIndex=5 ConnectTime=21115 CallState=4 CallOrigin=1ChargedUnits=0 InfoType=1 TransmitPackets=377915 TransmitBytes=7558300ReceivePackets=375594 ReceiveBytes=7511880 TotalPacketsEncrypted=375594The following lines show statistics for encrypted and decrypted packets.
TotalPacketsDecrypted=375594 DecryptionFailurePacketCount=0 TotalPacketsAuthenticated=375594 AuthenticationFailurePacketCount=0 DuplicateReplayPacketCount=0 OutsideWindowReplayPacketCount=0TELE: ConnectionId=[0x19BDF910 0xAF500007 0x0 0x58ED0] TxDuration=16640VoiceTxDuration=16640 FaxTxDuration=0 CoderTypeRate=0 NoiseLevel=0 ACOMLevel=4OutSignalLevel=-440 InSignalLevel=-440 InfoActivity=2 ERLLevel=227SessionTarget=Step 6
Router# show voice call 1/0/01/0/0vtsp level 0 state = S_CONNECTvpm level 1 state = FXSLS_CONNECTvpm level 0 state = S_UPcalling number , calling name unavailable, calling time 01/08 03:44c3745_13# ***DSP VOICE TX STATISTICS***Tx Vox/Fax Pkts: 108616, Tx Sig Pkts: 0, Tx Comfort Pkts: 0Tx Dur(ms): 2172320, Tx Vox Dur(ms): 2172320, Tx Fax Dur(ms): 0***DSP VOICE RX STATISTICS***Rx Vox/Fax Pkts: 108602, Rx Signal Pkts: 0, Rx Comfort Pkts: 0Rx Dur(ms): 2172320, Rx Vox Dur(ms): 2171990, Rx Fax Dur(ms): 0Rx Non-seq Pkts: 3, Rx Bad Hdr Pkts: 0Rx Early Pkts: 0, Rx Late Pkts: 0***DSP VOICE VP_DELAY STATISTICS***Clk Offset(ms): -2819596, Rx Delay Est(ms): 65Rx Delay Lo Water Mark(ms): 65, Rx Delay Hi Water Mark(ms): 65***DSP VOICE VP_ERROR STATISTICS***Predict Conceal(ms): 250, Interpolate Conceal(ms): 0Silence Conceal(ms): 0, Retroact Mem Update(ms): 0Buf Overflow Discard(ms): 0, Talkspurt Endpoint Detect Err: 0***DSP LEVELS***TDM Bus Levels(dBm0): Rx -37.7 from PBX/Phone, Tx -35.5 to PBX/PhoneTDM ACOM Levels(dBm0): +5.0, TDM ERL Level(dBm0): +5.0TDM Bgd Levels(dBm0): -35.9, with activity being silence***DSP VOICE ERROR STATISTICS***Rx Pkt Drops(Invalid Header): 0, Tx Pkt Drops(HPI SAM Overflow): 0***DSP VOICE SRTP STATISTICS***The following lines show voice SRTP statistics.
*Jan 8 2004 04:21:01.743 PAT: TotalPacketsEncrypted: 108616 TotalPacketsDecrypted: 108602DecryptionFailurePacketCount: 0 TotalPacketsAuthenticated: 108602AuthenticationFailurePacketCount: 0 DuplicateReplayPacketCount: 0OutsideWindowReplayPacketCount: 0 packetsBadReceivedSSRC: 0
Note
Step 7
Router# show voice call statusCallID CID ccVdb Port DSP/Ch Called # Codec Dial-peers0x5 11DE 0x660B24D0 1/0/0 1/1 g711ulaw 999100/00x7 11E1 0x665031A8 1/0:23.-1 1/2 * g729ar8 0/9990x11 11E4 0x6652B3B4 1/1:1.1 1/3 232222 g729ar8 999/03 active calls foundStep 8
Router# show voice call status 5Gathering information (10 seconds)...CallID Port DSP/Ch Codec Rx/Tx En/De ERL/Reflctr Jitter0x5 1/0/0 1/1 g711ulaw 500/500 500/500 5.0/3 65/0Router# show voice call status 7Gathering information (10 seconds)...CallID Port DSP/Ch Codec Rx/Tx En/De ERL/Reflctr Jitter0x7 1/0:23.-1 1/2 g729ar8 500/500 500/500 6.0/4 70/0Router# show voice call status 11Gathering information (10 seconds)...CallID Port DSP/Ch Codec Rx/Tx En/De ERL/Reflctr Jitter0x11 1/1:1.1 1/3 g729ar8 500/500 500/500 7.0/4 70/0Step 9
Router# show voice dspDSP DSP DSPWARE CURR BOOT PAK TX/RXTYPE NUM CH CODEC VERSION STATE STATE RST AI VOICEPORT TS ABORT PACK COUNT==== === == ======== ======= ===== ======= === == ======== === ==== ===========C549 1 01 {medium} 4.4.3 IDLE idle 0 0 1/0:0 1 0 9357/9775C549 1 02 {medium} 4.4.3 IDLE idle 0 1/0:0 2 0 0/0C549 2 01 {medium} 4.4.3 IDLE idle 0 0 1/0:0 3 0 0/0C549 2 02 {medium} 4.4.3 IDLE idle 0 1/0:0 4 0 0/0C549 3 01 {medium} 4.4.3 IDLE idle 0 0 1/0:0 5 0 0/13C549 3 02 {medium} 4.4.3 IDLE idle 0 1/0:0 6 0 0/13Step 10
Router# show rtpspi callRTP Service Provider info:No. CallId dstCallId Mode LocalRTP RmtRTP LocalIP RemoteIP SRTP1 6 5 Snd-Rcv 18662 19392 0xA0A0A0D 0xA0A0A0B 12 8 7 Snd-Rcv 18940 16994 0xA0A0A0D 0xA0A0A0B 13 16 17 Snd-Rcv 19038 17198 0xA0A0A0D 0xA0A0A0B 1Step 11
Router# show rtpspi statisticsRTP Statistics info:No. CallId Xmit-pkts Xmit-bytes Rcvd-pkts Rcvd-bytes Lost pkts Jitter Latenc1 6 0x842C 0x54AC30 0x842A 0x54AAE8 0x0 0x41 0x22 8 0x52B8 0x7C140 0x52B5 0x7C0F8 0x0 0x46 0x23 16 0x2EB0 0x46080 0x2EAF 0x46068 0x0 0x46 0x2Step 12
Router# show ccm-managerMGCP Domain Name: routerPriority Status Host============================================================Primary Registered 10.10.10.130First Backup Duplicate of Primary 10.10.10.130Second Backup NoneCurrent active Call Manager: 10.10.10.130Backhaul/Redundant link port: 2428Failover Interval: 30 secondsKeepalive Interval: 15 secondsLast keepalive sent: 04:06:40 PAT Jan 8 2004 (elapsed time: 00:00:04)Last MGCP traffic time: 04:06:40 PAT Jan 8 2004 (elapsed time: 00:00:04)Last failover time: NoneLast switchback time: NoneSwitchback mode: GracefulMGCP Fallback mode: Enabled/OFFLast MGCP Fallback start time: 03:42:25 PAT Jan 8 2004Last MGCP Fallback end time: 03:42:44 PAT Jan 8 2004MGCP Download Tones: DisabledBackhaul Link info:Link Protocol: TCPRemote Port Number: 2428Remote IP Address: 10.10.10.130Current Link State: OPENStatistics:Packets recvd: 7Recv failures: 0Packets xmitted: 13Xmit failures: 0PRI Ports being backhauled:Slot 1, port 0Configuration Error History:FAX mode: ciscoStep 13
Router# show crypto engine accelerator statisticVirtual Private Network (VPN) Module in slot : 0Statistics for Hardware VPN Module since the last clearof counters 1814 seconds ago638 packets in 638 packets out88640 bytes in 87601 bytes out0 paks/sec in 0 paks/sec out0 Kbits/sec in 0 Kbits/sec out315 packets decrypted 323 packets encrypted37680 bytes before decrypt 49921 bytes encrypted21104 bytes decrypted 67536 bytes after encrypt0 packets decompressed 0 packets compressed0 bytes before decomp 0 bytes before comp0 bytes after decomp 0 bytes after comp0 packets bypass decompr 0 packets bypass compres0 bytes bypass decompres 0 bytes bypass compressi0 packets not decompress 0 packets not compressed0 bytes not decompressed 0 bytes not compressed1.0:1 compression ratio 1.0:1 overall33 commands out 33 commands acknowledgedLast 5 minutes:60 packets in 60 packets out0 paks/sec in 0 paks/sec out121 bits/sec in 120 bits/sec out1720 bytes decrypted 1140 bytes encrypted46 Kbits/sec decrypted 30 Kbits/sec encrypted1.0:1 compression ratio 1.0:1 overallErrors:ppq full errors : 0 ppq rx errors : 0cmdq full errors : 0 cmdq rx errors : 0no buffer : 0 replay errors : 0dest overflow : 0 authentication errors : 0Other error : 0 RNG self test fail : 0DF Bit set : 0 Hash Miscompare : 0Unwrappable object : 0 Missing attribute : 0Invalid attrribute value: 0 Bad Attribute : 0Verification Fail : 0 Decrypt Failure : 0Invalid Packet : 0 Invalid Key : 0Input Overrun : 0 Input Underrun : 0Output buffer overrun : 0 Bad handle value : 0Invalid parameter : 0 Bad function code : 0Out of handles : 0 Access denied : 0Warnings:sessions_expired : 0 packets_fragmented : 0general: : 0HSP details:hsp_operations : 0 hsp_sessions : 0Step 14
router# show crypto ipsec sainterface: FastEthernet0/0Crypto map tag: Gateway, local addr. 10.10.10.13protected vrf:local ident (addr/mask/port/port): (10.10.10.13/255.255.255.255/0/0)remote ident (addr/mask/port/port): (10.10.10.130/255.255.255.255/0/0)current_peer: 10.10.10.130:500PERMIT, flags={origin_is_acl,}#pkts encaps: 324, #pkts encrypt: 324, #pkts digest: 324#pkts decaps: 316, #pkts decrypt: 316, #pkts verify: 316#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 71, #recv errors 0local crypto endpt.: 10.10.10.13, remote crypto endpt.: 10.10.10.130path mtu 1500, media mtu 1500current outbound spi: 9073D35inbound esp sas:spi: 0x9FCB508(167556360)transform: esp-3des esp-sha-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 5121, flow_id: 1, crypto map: gatewaycrypto engine type: Hardware, engine_id: 2sa timing: remaining key lifetime (k/sec): (4446388/1913)ike_cookies: 6A391EE1 E57F3670 D4D78758 2F5C8E7CIV size: 8 bytesreplay detection support: Yspi: 0xD132AE54(3509759572)transform: esp-3des esp-sha-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 5123, flow_id: 3, crypto map: gatewaycrypto engine type: Hardware, engine_id: 2sa timing: remaining key lifetime (k/sec): (4402107/1913)ike_cookies: 6A391EE1 E57F3670 D4D78758 2F5C8E7CIV size: 8 bytesreplay detection support: Yinbound ah sas:inbound pcp sas:outbound esp sas:spi: 0x7D078A45(2097646149)transform: esp-3des esp-sha-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 5122, flow_id: 2, crypto map: gatewaycrypto engine type: Hardware, engine_id: 2sa timing: remaining key lifetime (k/sec): (4446388/1911)ike_cookies: 6A391EE1 E57F3670 D4D78758 2F5C8E7CIV size: 8 bytesreplay detection support: Yspi: 0x9073D35(151469365)transform: esp-3des esp-sha-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 5124, flow_id: 4, crypto map: gatewaycrypto engine type: Hardware, engine_id: 2sa timing: remaining key lifetime (k/sec): (4402077/1911)ike_cookies: 6A391EE1 E57F3670 D4D78758 2F5C8E7CIV size: 8 bytesreplay detection support: Youtbound ah sas:outbound pcp sas:protected vrf:local ident (addr/mask/prot/port): (10.10.10.13/255.255.255.255/0/0)remote ident (addr/mask/prot/port): (10.10.10.131/255.255.255.255/0/0)current_peer: 10.10.10.131:500PERMIT, flags={origin_is_acl,}#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 0, #recv errors 0local crypto endpt.: 10.10.10.13, remote crypto endpt.: 10.10.10.131path mtu 1500, media mtu 1500current outbound spi: 0inbound esp sas:inbound ah sas:inbound pcp sas:outbound esp sas:outbound ah sas:outbound pcp sas:Step 15
Router# show crypto isakmp sadst src state conn-id slot10.10.10.130 10.10.10.13 QM_IDLE 1 0Step 16
Router# show crypto sessionCrypto session current statusInterface: FastEthernet0/0Session status: UP-ACTIVEPeer: 10.10.10.130/500IKE SA: local 10.10.10.13/500 remote 10.10.10.130/500 ActiveIPSEC FLOW: permit ip host 10.10.10.13 host 10.10.10.130Active SAs: 4, origin: crypto mapStep 17
Router# show crypto session detailCrypto session current statusCode: C - IKE Configuration mode, D - Dead Peer DetectionK - Keepalives, N - NAT-traversal, X - IKE Extended AuthenticationInterface: FastEthernet0/0Session status: UP-ACTIVEPeer: 10.10.10.130/500 fvrf: (none) ivrf: (none)Phase1_id: 10.10.10.130Desc: (none)IKE SA: local 10.10.10.13/500 remote 10.10.10.130/500 ActiveCapabilities:(none) connid:1 lifetime:07:30:00IPSEC FLOW: permit ip host 10.10.10.13 host 10.10.10.130Active SAs: 4, origin: crypto mapInbound: #pkts dec'ed 335 drop 0 life (KB/Sec) 4402106/1800Outbound: #pkts enc'ed 327 drop 71 life (KB/Sec) 4402076/1800
Configuration Examples for Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways
This section provides the following configuration example:
•
Voice Security Features Example
The following example shows voice security features enabled:
Router# show running-configBuilding configuration...Current configuration : 2304 bytes!version 12.3service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname router!boot-start-markerboot-end-marker!voice-card 1no dspfarm!voice-card 2no dspfarm!The following lines show secure codec complexity enabled:
voice-card 4codec complexity securedspfarm!!no aaa new-modelip subnet-zero!ip cefno ip domain lookup!ip domain name cisco.comThe IP domain name should match the domain name configured on Cisco CallManager.
!Cisco CallManager-manager mgcp!crypto isakmp policy 1authentication pre-sharelifetime 28800crypto isakmp key cisco123 address 10.1.1.12The crypto key should match the key configured on Cisco CallManager. This method and encapsulation mode should also match the method and encapsulation mode configured on Cisco CallManager. Other methods of key exchange are also supported. For more information refer to Cisco IOS Security Configuration Guide, Release 12.3.
!crypto ipsec transform-set rtpset esp-des esp-md5-hmacmode transportThe crypto IPSec configuration should match the Cisco CallManager configuration.
!crypto map rtp 1 ipsec-isakmpset peer 10.1.1.12set transform-set rtpsetmatch address 115!interface FastEthernet0/1ip address 10.1.1.212 255.255.255.0load-interval 30duplex autospeed autocrypto map rtp!The following line shows the IPSec access list.
access-list 115 permit ip host 10.1.1.212 host 10.1.1.12!voice-port 1/0/0!voice-port 2/0/0!mgcpmgcp call-agent 10.1.1.12 service-type mgcp version 0.1The mgcp package-capability command enables the MGCP application ability to manage SRTP calls and advertise SRTP capability in SDP sent to remote gateways.
mgcp package-capability srtp-package!mgcp profile default!dial-peer voice 100 potsapplication mgcpappport 1/0/0!dial-peer voice 200 potsapplication mgcpappport 2/0/0!dial-peer voice 201 potsapplication mgcpappport 2/0/1!dial-peer voice 202 potsapplication mgcpappport 2/0/2!dial-peer voice 203 potsapplication mgcpappport 2/0/3!dial-peer voice 101 potsapplication mgcpappport 1/0/1!dial-peer voice 110 potsapplication mgcpappport 1/1/0!dial-peer voice 111 potsapplication mgcpappport 1/1/1!!alias exec k show mgcp conn | inc K=alias exec sr sh call active voi | inc SRTPalias exec rs sh rtpspi call | inc Snd-Rcvalias exec vc sh voi callalias exec m sh mgcp connalias exec cav sh call active voialias exec rsa sh rtpspi callalias exec cc clear countersalias exec sta sh int fa0/1 statalias exec cef sh ip cef!line con 0exec-timeout 0 0logging synchronousline aux 0line vty 0 4login!!endAdditional References
The following sections provide references related to the Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways feature.
Related Documents
Cisco CallManager configuration
Cisco IP Phone Authentication and Encryption for Cisco CallManager 4.0(1)
Cisco CallManager and IPSec configuration
•
•
Cisco IP Phone 7940 and 7960 administration
Cisco IP Phone Model 7960G and 7940G Administration Guide for Cisco CallManager Release 4.1
Cisco IP Phone 7970 administration
Cisco IP Phone 7970 Administration Guide for Cisco CallManager
Cisco 2621 configuration
Cisco 2621 Modular Access Router with AIM-VPN/BP Security Policy
Cisco 2651 configuration
Cisco 2651 Modular Access Router with AIM-VPN/BP Security Policy
Cisco 3640 configuration
Cisco 3640 Modular Access Router with AIM-VPN/BP Security Policy
Cisco 3660 configuration
Cisco 3660 Modular Access Router with AIM-VPN/BP Security Policy
Cisco SRST configuration
Cisco SRST command reference
Secure SRST router configuration
"Setting Up Secure SRST"
Advanced Encryption Standard (AES) feature
IPSec configuration
Cisco IOS Security Configuration Guide, Release 12.3
IPSec commands
Cisco IOS Security Command Reference, Release 12.3
MGCP configuration
Cisco IOS voice configuration
Cisco IOS voice command reference
Cisco IOS Voice, Video, and Fax Command Reference, Release 12.3T
Standards
IETF draft draft-ietf-mmusic-sdescriptions-02.txt
Security Descriptions for Media Streams
MIBs
CISCO-VOICE-DIAL-CONTROL-MIB
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Command Reference
This section documents new and modified commands only:
•
codec complexity
To specify call density and codec complexity according to the codec standard that is being used, use the codec complexity command in voice-card configuration mode. To reset the flex complexity default, use the no form of this command.
codec complexity {flex [reservation-fixed {high | medium}] | high | medium | secure}
no codec complexity
Syntax Description
Defaults
flex complexity
Command Modes
Voice-card configuration
Command History
Usage Guidelines
Codec complexity refers to the amount of processing required to perform voice compression. Codec complexity affects the call density—the number of calls reconciled on the DSPs. With higher codec complexity, fewer calls can be handled. Select a higher codec complexity if that is required to support a particular codec or combination of codecs. Select a lower codec complexity to support the greatest number of voice channels, provided that the lower complexity is compatible with the particular codecs in use.
For codec complexity to change, all of the DSP voice channels must be in the idle state.
When you have specified the flex keyword, you can connect (or configure in the case of DS0 groups and PRI groups) more voice channels to the module than the DSPs can accommodate. If all voice channels should go active simultaneously, the DSPs become oversubscribed, and calls that are unable to allocate a DSP resource fail to connect. The flex keyword allows the DSP to process up to 16 channels. In addition to continuing support for configuring a fixed number of channels per DSP, the flex keyword enables the DSP to handle a flexible number of channels. The total number of supported channels varies from 6 to 16, depending on which codec is used for a call. Therefore, the channel density varies from 6 per DSP (high-complexity codec) to 16 per DSP (g.711 codec).
The high keyword selects a higher codec complexity if that is required to support a particular codec or combination of codecs. When you use the codec complexity high command to change codec complexity, the system prompts you to remove all existing DS0 or PRI groups using the specified voice card, then all DSPs are reset, loaded with the specified firmware image, and released.
The medium keyword selects a lower codec complexity to support the greatest number of voice channels, provided that the lower complexity is compatible with the particular codecs in use.
The secure keyword restricts the number of TI-549 DSP channels to 2, which is the lower codec complexity required to support Secure Real-Time Transport Protocol (SRTP) package capability on the NM-HDV and enable media authentication and encryption. If the secure command is not configured then the gateway will not advertise secure capability to Cisco CallManager, resulting in nonsecure calls. You do not need to use any command to specify secure codec complexity for TI-5510 DSPs, which support SRTP capability in all modes. Use the mgcp package-capability srtp-package command to enable MGCP gateway capability to process SRTP packages. Use the show voice dsp command to view codec complexity status.
Examples
The following example sets the codec complexity to high on voice card 1 installed on a router, and configures local calls to bypass the DSP:
voice-card 1codec complexity highlocal-bypassThe following example sets the codec complexity to secure on voice card 1 installed on the NM-HDV, and configures it to support SRTP package processing, media authentication and encryption:
voice-card 1codec complexity secureRelated Commands
mgcp package-capability
To specify an MGCP package capability type for a media gateway, use the mgcp package-capacity command in global configuration mode. To remove a specific MGCP package capability from the list of capabilities, use the no form of this command.
mgcp package-capability package
no mgcp package-capability package
Syntax Description
Defaults
For residential gateways: line-package
For trunk gateways: trunk-packageCommand Modes
Global configuration
Command History
Usage Guidelines
Events specified in the MGCP messages from the call agent must belong to one of the supported packages. Otherwise, connection requests are refused by the gateway.
By default, certain packages are configured as supported on each platform type. Using this command, you can configure additional package capability only for packages that are supported by your call agent. You can also disable support for a package with the no form of this command. Enter each package you want to add as a separate command.
Use the show mgcp command to see the packages that are supported on the gateway.
Use this command before specifying a default package with the mgcp default-package command. Specify at least one default package.
Packages that are available to be configured with this command vary by platform and type of gateway. Use CLI help to ascertain the packages available on your gateway. This example shows the CLI help output for a Cisco 3660:
Router# mgcp package-capability ?as-package Select the Announcement Server Packageatm-package Select the ATM Packagedtmf-package Select the DTMF Packagegm-package Select the Generic Media Packagehs-package Select the Handset Packageline-package Select the Line Packagemf-package Select the MF Packageres-package Select the RES Packagertp-package Select the RTP Packagetrunk-package Select the Trunk Package
Note
When the lcs-package keyword is used on the Cisco IAD, the named telephony events (NTEs) associated with the line control signalling (LCS) package are enabled automatically. NTEs are used by a media gateway to transport telephony tones and trunk events across a packet network. Refer to RFC-2833.
Note
Examples
The following example enables the trunk package, DTMF package, and script package on the gateway, and then names the trunk package as the default package for the gateway:
Router(config)# mgcp package-capability trunk-packageRouter(config)# mgcp package-capability dtmf-packageRouter(config)# mgcp package-capability script-packageRouter(config)# mgcp default-package trunk-packageRelated Commands
mgcp validate call-agent source-ipaddr
To enable the Media Gateway Control Protocol (MGCP) application to validate that packets are received from a configured call agent, use the mgcp validate call-agent source-ipaddr command in global configuration mode. To disable the validation feature, use the no form of this command.
mgcp validate call-agent source-ipaddr
no mgcp validate call-agent source-ipaddr
Syntax Description
This command has no arguments or keywords.
Defaults
No validation occurs.
Command Modes
Global configuration
Command History
Usage Guidelines
This command verifies that incoming packets are received from MGCP or Cisco CallManager configured call agents only. When the command is enabled, all MGCP messages received from call agents that are not configured in MGCP or Cisco CallManager are dropped. Use the mgcp validate call-agent source-ipaddr command in place of access lists to filter out packets from unconfigured call agents. Use the mgcp bind control source-interface interface command to restrict the MGCP application from responding to unconfigured call agent requests on nonsecure interfaces. Use the ccm-manager config server server address command to configure the Cisco CallManager address to be used when verifying incoming packets.
Examples
The following example shows that MGCP call-agent validation is enabled:
Router(config)# mgcp validate call-agent source-ipaddrRelated Commands
show mgcp
To display values for Media Gateway Control Protocol (MGCP) parameters, use the show mgcp command in privileged EXEC mode.
show mgcp [connection | endpoint | nas | profile | statistics]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command provides high-level administrative information about the values configured for MGCP parameters on the router. For more specific types of information, use one of the optional keywords.
Use the show mgcp endpoint command to show a list of MGCP endpoint responses when using the Media and Signaling Authentication and Encryption Feature for Cisco IOS MGCP Gateways feature.
The BRI endpoints are displayed in a similar manner to the way analog (POTS) endpoints are displayed. The existing functions used for the analog endpoints are invoked. This display is independent of the platforms and hence the changes are required in the common code only.
This command checks for all "htsp_info_t" structures allocated. These structures store information corresponding to all the endpoints. These structures are allocated during system start up time only. The structures are allocated for all the interfaces present, but the "vtsp_sdb_t" structure is allocated only for the first channel of the BRI port.
Because endpoints using the MGCPAPP as the application layer have to be displayed, the endpoints are also displayed if the application being used by the endpoint is MGCPAPP only. Because the MGCPAPP is shared across both of the BRI channels and is port specific, both ports are displayed.
Examples
The following is sample output from this command:
Router# show mgcpMGCP Admin State ACTIVE, Oper State ACTIVE - Cause Code NONEMGCP call-agent: 172.18.195.147 2300 Initial protocol service is SGCP 1.5MGCP block-newcalls DISABLEDMGCP send SGCP RSIP:forced/restart/graceful DISABLED, disconnected ENABLEDMGCP quarantine mode discard/stepMGCP quarantine of persistent events is ENABLEDMGCP dtmf-relay for VoIP disabled for all codec typesMGCP dtmf-relay voaal2 codec allMGCP voip modem passthrough mode: NSE, codec: g711ulaw, redundancy: DISABLED,MGCP voaal2 modem passthrough mode: NSE, codec: g711ulawMGCP TSE payload: 100MGCP T.38 Named Signalling Event (NSE) response timer: 200MGCP Network (IP/AAL2) Continuity Test timer: 3000MGCP 'RTP stream loss' timer: 2MGCP request timeout 500MGCP maximum exponential request timeout 4000MGCP gateway port: 2427, MGCP maximum waiting delay 3000MGCP restart delay 0, MGCP vad DISABLEDMGCP rtrcac DISABLEDMGCP system resource check DISABLEDMGCP xpc-codec: DISABLED, MGCP persistent hookflash: DISABLEDMGCP persistent offhook: ENABLED, MGCP persistent onhook: DISABLEDMGCP piggyback msg DISABLED, MGCP endpoint offset DISABLEDMGCP simple-sdp DISABLEDMGCP undotted-notation DISABLEDMGCP codec type g711ulaw, MGCP packetization period 20MGCP JB threshold lwm 30, MGCP JB threshold hwm 150MGCP LAT threshold lmw 150, MGCP LAT threshold hwm 300MGCP PL threshold lwm 1000, MGCP PL threshold hwm 10000MGCP CL threshold lwm 1000, MGCP CL threshold hwm 10000MGCP playout mode is adaptive 60, 4, 200 in msecMGCP IP ToS low delay disabled, MGCP IP ToS high throughput disabledMGCP IP ToS high reliability disabled, MGCP IP ToS low cost disabledMGCP IP RTP precedence 5, MGCP signaling precedence: 3MGCP default package: line-packageMGCP supported packages: gm-package dtmf-package trunk-package line-packagehs-package atm-package ms-package dt-package res-packagemt-package srtp-package fxr-package lcs-packageTable 4 describes significant fields shown in this output.
Related Commands
show mgcp srtp
To display information for active Secure Real-Time Transport Protocol (SRTP) connections that are controlled by Media Gateway Control Protocol (MGCP), use the show mgcp srtp command in privileged EXEC mode.
show mgcp srtp {summary | detail [endpoint]}
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command provides information about secure calls created by the MGCP application. To specify connection endpoints for display, use the show mgcp srtp detail endpoint command. To display valid values for the endpoint argument, that is, the endpoint port numbers, use the show mgcp connection command. Use the show mgcp srtp detail command to display a hashed version of the master key and salts (encryption mechanisms) used on each connection. This display allows you to validate keys and salts for each endpoint of a call without revealing the actual master key and salt.
Examples
The following is sample output from this command for encrypted connections:
Router# show mgcp srtp summaryMGCP SRTP Connection SummaryEndpoint Conn Id Crypto Suiteaaln/S3/SU0/0 8 AES_CM_128_HMAC_SHA1_32aaln/S3/SU0/1 9 AES_CM_128_HMAC_SHA1_32S3/DS1-0/1 6 AES_CM_128_HMAC_SHA1_32S3/DS1-0/2 7 AES_CM_128_HMAC_SHA1_324 SRTP connections activeRouter# show mgcp srtp detailMGCP SRTP Connection Detail for Endpoint *Definitions: CS=Crypto Suite, KS=HASHED Master Key/Salt, SSRC=Syncronization Source, ROC=Rollover Counter, KDR=Key Derivation Rate, SEQ=Sequence Number, FEC=FEC Order, MLT=Master Key Lifetime, MKI=Master Key Index:MKI SizeEndpoint aaln/S3/SU0/0 Call ID 2 Conn ID 8Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=3NaOYXS9dLoYDaBHpzRejREfhf0= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Endpoint aaln/S3/SU0/1 Call ID 101 Conn ID 9Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:Not ConfiguredEndpoint S3/DS1-0/1 Call ID 1 Conn ID 6Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=3NaOYXS9dLoYDaBHpzRejREfhf0= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Endpoint S3/DS1-0/2 Call ID 100 Conn ID 7Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:Not Configured4 SRTP connections displayedRouter# show mgcp srtp detail S3/DS1-0/*MGCP SRTP Connection Detail for Endpoint S3/DS1-0/*Definitions: CS=Crypto Suite, KS=HASHED Master Key/Salt, SSRC=Syncronization Source, ROC=Rollover Counter, KDR=Key Derivation Rate, SEQ=Sequence Number, FEC=FEC Order, MLT=Master Key Lifetime, MKI=Master Key Index:MKI SizeEndpoint S3/DS1-0/1 Call ID 1 Conn ID 6Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=3NaOYXS9dLoYDaBHpzRejREfhf0= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Endpoint S3/DS1-0/2 Call ID 100 Conn ID 7Tx:CS=AES_CM_128_HMAC_SHA1_32 KS=llYCQoqxtxtdf7ECe+x+DK+G9v4= SSRC=Random ROC=0 KDR=1 SEQ=Random FEC=FEC->SRTP MLT=0x80000000 MKI=0:0Rx:Not Configured2 SRTP connections displayedTable 5 describes the significant fields shown in the display.
Related Commands
show mgcp statistics
To display Media Gateway Control Protocol (MGCP) statistics regarding received and transmitted network messages, use the show mgcp statistics command in privileged EXEC mode.
show mgcp statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Examples
The following is sample output from this command for VoIP and VoAAL2 statistics:
Router# show mgcp statisticsUDP pkts rx 8, tx 9Unrecognized rx pkts 0, MGCP message parsing errors 0Duplicate MGCP ack tx 0, Invalid versions count 0Rx packets from unknown Call Agent 0CreateConn rx 4, successful 0, failed 0DeleteConn rx 2, successful 2, failed 0ModifyConn rx 4, successful 4, failed 0DeleteConn tx 0, successful 0, failed 0NotifyRequest rx 0, successful 4, failed 0AuditConnection rx 0, successful 0, failed 0AuditEndpoint rx 0, successful 0, failed 0RestartInProgress tx 1, successful 1, failed 0Notify tx 0, successful 0, failed 0ACK tx 8, NACK tx 0ACK rx 0, NACK rx 0IP address based Call Agents statistics:IP address 10.24.167.3, Total msg rx 8, successful 8, failed 0The following is an example of the MGCP VoIP SRC CAC portion of this command output for a gateway configured with MGCP VoIP SRC CAC:
Router# show mgcp statisticsMGCP System Resource Check Statistics:-------------------------------------Total CreateConn checked by SRC :0CreateConn accepted by SRC:0CreateConn rejected by SRC:0Total ModifyConn checked by SRC :0ModifyConn accepted by SRC:0ModifyConn rejected by SRC:0Reason Num. of requests rejected------ -------------------------cpu-5sec: 0cpu-avg: 0total-mem: 0io-mem: 0proc-mem: 0total-calls: 0Table 6 describes significant fields shown in this output.
Related Commands
show voice dsp
To show the current status of all digital signal processor (DSP) voice channels, use the show voice dsp command in privileged EXEC mode.
show voice dsp
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use this command when abnormal behavior occurs in the DSP voice channels.
Examples
The following sample output shows the current status of the codec, set for modem relay, on channel 1.
Router# show voice dsp----------------------------FLEX VOICE CARD 1 ------------------------------*DSP VOICE CHANNELS*DSP DSP DSPWARE CURR BOOT PAK TX/RXTYPE NUM CH CODEC VERSION STATE STATE RST AI VOICEPORT TS ABRT PACK COUNT===== === == ======== ======= ===== ======= === == ========= == ==== ============C5510 001 01 modem-re 4.5.909 busy idle 0 0 1/1/0 05 0 298/353*DSP SIGNALING CHANNELS*DSP DSP DSPWARE CURR BOOT PAK TX/RXTYPE NUM CH CODEC VERSION STATE STATE RST AI VOICEPORT TS ABRT PACK COUNT===== === == ======== ======= ===== ======= === == ========= == ==== ============C5510 001 05 {flex} 4.5.909 alloc idle 0 0 1/1/3 02 0 15/0C5510 001 06 {flex} 4.5.909 alloc idle 0 0 1/1/2 02 0 17/0C5510 001 07 {flex} 4.5.909 alloc idle 0 0 1/1/1 06 0 31/0C5510 001 08 {flex} 4.5.909 alloc idle 0 0 1/1/0 06 0 321/0------------------------END OF FLEX VOICE CARD 1 ----------------------------The following sample output shows the current status of all DSP voice channels:
Router# show voice dspDSP# 0, channel# 0 G729A BUSYDSP# 0, channel# 1 G729A BUSYDSP# 1, channel# 2 FAX IDLEDSP# 1, channel# 3 FAX IDLEDSP# 2, channel# 4 NONE BADDSP# 2, channel# 5 NONE BADDSP# 3, channel# 6 NONE BADDSP# 3, channel# 7 NONE BADDSP# 4, channel# 8 NONE BADDSP# 4, channel# 9 NONE BADDSP# 5, channel# 10 NONE BADDSP# 5, channel# 11 NONE BADThe following is sample output from this command on a Cisco 1750 router:
Router# show voice dspDSP#0: state IN SERVICE, 2 channels allocatedchannel#0: voice port 1/0, codec G711 ulaw, state UPchannel#1: voice port 1/1, codec G711 ulaw, state UPDSP#1: state IN SERVICE, 2 channels allocatedchannel#0: voice port 2/0, codec G711 ulaw, state UPchannel#1: voice port 2/1, codec G711 ulaw, state UPDSP#2: state RESET, 0 channels allocatedThe following is sample output from this command on a secure Survivable Remote Site Telephony (SRST) router with the NM-HDV network module and the TI-549 (C549) DSP installed:
Router# show voice dspDSP DSP DSPWARE CURR BOOT PAK TX/RXTYPE NUM CH CODEC VERSION STATE STATE RST AI VOICEPORT TS ABORT PACK COUNT==== === == ======== ======= ===== ======= === == ======== === ==== ===========C549 1 01 {medium} 4.4.3 IDLE idle 0 0 1/0:0 1 0 9357/9775C549 1 02 {medium} 4.4.3 IDLE idle 0 1/0:0 2 0 0/0C549 2 01 {medium} 4.4.3 IDLE idle 0 0 1/0:0 3 0 0/0C549 2 02 {medium} 4.4.3 IDLE idle 0 1/0:0 4 0 0/0C549 3 01 {medium} 4.4.3 IDLE idle 0 0 1/0:0 5 0 0/13C549 3 02 {medium} 4.4.3 IDLE idle 0 1/0:0 6 0 0/13Table 7 describes the significant fields shown in the displays.
Related Commands
Glossary
CCM—Cisco Call Manager. For the purposes of this document this is the MGCP Call Agent.
CLI—Ccommand-line interface.
CTL—Certificate Trust List.
DTMF—Dual-tone multifrequency
HMAC—Hashed Message Authentication Codes.
IETF— Internet Engineering Task Force. Standards body for Internet Standards.
IKE—Internet Key Exchange.
IPSec—IP security.
MGCP— Multimedia Gateway Control Protocol.
PIN—Personal identification number.
RTCP—Real-Time Transport Protocol Control Protocol.
RTP—Real-Time Transport Protocol
SDP— Session Description Protocol.
SHA1—Secure Hash Algorithm1.
SRST—Survivable Remote Site Telephony.
SRTP—Secure RTP.
SRTCP— Secure RTCP.
VoIP— Voice over IP.
Note
CCSP, the Cisco Square Bridge logo, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0406R)
Copyright © 2004, 2005 Cisco Systems, Inc. All rights reserved.
Guest
