Voice Gateways Hot Issues from Cisco TAC

IOS gateway not handling fragmented SIP UDP message properly, Fixed CSCtt38880

Symptom: If SIP message in UDP transportation is fragmented, fragmentation received by IOS gateway are not re-assembled properly. For CVP VXML GW, a large UDP SIP invite sent by CVP/CUSP/CUPS may be fragmented into two packets to fit into Ethernet frame, since the IOS is not re-assembling the fragmentation properly, VXML GW appears not receiving the SIP invite message, and the call is dropped after timing out. For call park in CME with 9971 sip phone CME 8.8 2901 platform with IOS c2900-universalk9-mz.SPA.152-1.T.bin Phones: Cisco 9971 SIP phones with sip9971.9-2-1 firmware ++ Call-park feature enabled as per the below CCO document: http://www.cisco.com/en/US/docs/voice_ip_comm/cucme/admin/configuration/guide/cmepark.html#wp1010875 ++ When user dials the extension and answer the call and try and press the Park feature button: -There is no activity on the phone
Conditions: CME 8.8 SPECIAL NOTE: ++ Affects all fragmented SIP UDP packet processing in 15.1(4)M2 and later
Workaround: Downgrade to IOS c2900-universalk9-mz.SPA.151-4.M CME 8.6 Change sip transportation to TCP Call Park works successfully on 9971 IP phones ( SIP )

SCCP FXS port shared line to CCM may fail to ring or get dialtone, Fixed CSCsw88646

Symptom: With SCCP (STCAPP) FXS ports registered to CCM and assigned a shared line to SCCP IP phones, one of the following issues may occur. 1. When hold/resume functionality is not configured on the SCCP gateway, and CCM's DN configuration for maximum-calls/busy trigger are set to a value of 1: A call is placed, and an IP phone answers. The FXS phone goes off-hook and back on-hook. The IP phone then hangs up. The next call placed will not ring the FXS port. Place the call again and the FXS will ring properly again. 2. When hold/resume functionality is not configured on the SCCP gateway, and CCM's DN configuration for maximum-calls/busy trigger are set to a value of >=2. Call comes into shared line. IP phone answers. While the line is in-use, the analog phone goes off-hook, then back on-hook. IP phone ends the call. From this point on the FXS port gets dead-air when going off-hook to place a call, until the stcapp process is reset with 'no stcapp/stcapp.' STCAPP debugs during the issue show STCAPP:stcapp_get_active_call_ccb:ERROR:There is no ACTIVE call's ccb in lcb (0x645952A4) stcapp_error_handling
Conditions: The issue is seen on 12.4(22T), which introduces the hold/resume feature.
Workaround: For the first issue there is no known workaround other than placing another call to the DN after the issue is seen, or by not having the FXS phone go offhook during active IP phone calls. For the second issue, reset the STCAPP stack as a temporary workaround, or change the max calls/busy trigger under CCM's DN configuration to be 1 for both the analog and IP phones.
Further Problem Description: Note that the second scenario is not a support solution. The max call/busy trigger should be set to 1 when not enabling hold/resume under STCAPP, which is considered a classic shared-line scenario. To configure hold/resume on the SCCP FXS port, use: stcapp supplementary-service port hold-resume

No MoH audio when call traverses IOS MTP co-located with CUBE, Fixed CSCtw90790

Symptom: Network Topology : IP phone A -- CUCM -- IOS MTP -- CUBE -- IP Phone B IP phone B will not hear Music on hold audio (MoH) when phone A puts the call on hold. To verify the symptom get the output of "show voip rtp stats" and check whether "error 38" is incrementing continuously. Example: Router#show voip rtp stats VOIP RTP Error Counters : error 38 count = 696038 1 errortypes observed Router#
Conditions: This problem was observed when IOS MTP is co-located with CUBE. It could also happen in other call flows where two MTP sessions in the same router are connected from a RTP stream perspective.
Workaround: Set the "Duplex Streaming Enabled" service parameter in CUCM to "True".

Router may crash when a fax is received or sent, Fixed CSCtr54327

Symptoms: A Cisco router may crash due to a SegV exception or have a spurious access when a fax comes in.
Conditions: The crash occurs on a voice gateway that is configured with transcoding and fax passthrough where a fax call comes in for a codec, but the fax is not configured for a codec, and the "a=silenceSupp:off" option is set in SDP.
Workaround: Disable fax by going into 'voice service voip' mode and configuring the 'fax protocol none' command.

PVDM3: %DSPRM-3-DSPALARM: Received alarm indication from dsp, CSCtk57354

customer is running Version 15.0(1)M4 on 3925 router. We are getting the following error in the logs wrt to the DSP & all the calls drop Dec 1 10:01:13.759 GMT: %DSPRM-3-DSPALARM: Received alarm indication from dsp (0/1). Resetting the DSP. Dec 1 10:01:13.759 GMT: %DSPRM-3-DSPALARMINFO: 002A 0000 0080 0000 0008 0003 5761 7463 6844 6F67 2054 696D 656F 7574 2C20 5043 3D30 3030 6539 3663 3400 162B 4C39 0000 0000 Dec 1 10:01:13.759 GMT: %DSPRM-3-DSPALARMINFO: WatchDog Timeout, PC=000e96c4 Dec 1 10:01:13.759 GMT: %LINK-3-UPDOWN: Interface Foreign Exchange Station 0/1/0, changed state to Administrative Shutdown Dec 1 10:01:14.959 GMT: DSP trace buffer dump for DSP 0/1 DSP version: 26.3.8 Trace buffer size: 1392 bytes ===== Begining of DSP tracebuffer dump===== DSPTB0:00058DD0 00057945 00057944 00057ADB 00057AC6 0014542D 00145428 DSPTB1:00057AC1 00057AC0 0005793B 00057920 0001A421 0001A420 0001A405 DSPTB2:0001A3F0 00007A13 00007A10 00007A09 00007A08 00145441 0014542E DSPTB3:000079FF 000079D2 0014542D 00145428 000079CD 00007980 0001A3DF DSPTB4:0001A3DE 00007359 00007350 0001A3D5 0001A390 00145295 00145282 DSPTB5:00056F71 00056F68 000051DB 000051D4 00145441 0014542E 000051C9 DSPTB6:000051C8 000051B5 00005168 0014542D 00145428 00005163 00005160 DSPTB7:00056F63 00056F60 00056F31 00056F14 00056EF7 00056EE0 0014527F DSPTB8:00145262 00009C17 00009BE0 00145253 001451A4 00009C27 00009C18 DSPTB9:0014519F 001450E6 40000357 40000350 000E96C5 000E96C4 000E96C5 DSPTB10:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB11:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB12:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB13:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB14:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB15:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB16:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB17:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB18:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB19:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB20:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB21:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB22:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB23:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB24:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB25:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB26:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB27:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB28:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB29:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB30:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB31:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB32:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB33:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB34:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB35:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB36:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB37:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB38:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB39:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB40:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB41:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB42:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB43:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB44:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB45:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB46:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB47:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 DSPTB48:000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 000E96C4 DSPTB49:000E96C5 000E96C4 000E96C5 000E96C4 000E96C5 ===== End of DSP tracebuffer dump===== Dec 1 10:01:14.959 GMT: %DSPRM-5-UPDOWN: DSP 1 in slot 0, changed state to up The customer has PVDM3-128 & running DSP firmware 26.3.8.

T.38 negot fails if two m lines are sent in the offer from 3rd part serv, Open CSCsi10343

Symptom:Fax calls from right fax fail using T38. Call tears down right after the T38 negotiation completes.
Conditions: Rightfax sends 2 M lines in SDP.
Workaround: Configure right fax to use only 1 codec. If configured for both PCMU and PCMA (g711ulaw and g711alaw) it will send 2 M lines (incorrectly). Generic steps for changing rightfax: In the configuration tool, in advanced mode, highlight the IP call control stack that you are using in the left pane, ( SIP or H323 ) Click on RTP parameters in the right pane, there is a drop down for the RTP codec list. simply remove pcma and leave pcmu. make sure that there is no spaces after pcmu. Save and then apply. SDP offering after this should only reflect pcmu offering.

Memory leak reported in the CCSIP_SPI_CONTROL process, Open CSCtx40463

Symptom: Memory leak in the "CCSIP_SPI_CONTROL" process
Conditions: A Cisco router running IOS and SIP gateway.
Workaround: There is no known workaround.

Crash in sipSPI_ipip_AddPassthruHdrsToMsgContainer, Open CSCtx66030

Symptom: A Cisco router may unexpectedly reload.
Conditions: This has been experienced on a 3925 router configured for SIP calls. The crashes have been seen on both 15.1(3)T and 15.1(4)M2.
Workaround: No workaround is available at this time.

T38 faxing failing with PVDM3 (SP2600), Open CSCtx87895

Symptom: T38 faxing on PVDM3 (SP2600) will signal to the point of CFR (confirmation message) but the page data will not pass through the DSP
Conditions: T38 fax relay enabled on PVDM3 (SP2600 device running 28.2.0 DSPware (associated with 15.1(4)M
Workaround: If the customer doesn't require T38 you can disable T38 and do a pass-through mechanism but in some cases access to fax servers REQUIRES T38 capabiliy and there is no work around in that case.

Router may crash due to bus error - voip_rtp_dispose_media_service_pak, Fixed CSCtx54882

Symptom: A Cisco router may crash due to Bus error crash at voip_rtp_is_media_service_pak .
Conditions: This has been observed on a Cisco router running IOS version 15.1(4)M2
Workaround: There is no known workaround.

Mobile agent hears static or hissing sound on PVDM2s and PVDM3s, Open CSCtx82621

Symptom: - This is a mobile agent solution for optus i.e we have a RCP ( remote cti port ) that calls out to a mobile agent phone on PSTN across a 3945 GW with PRI's . The agent phone rings , and then the agent desktop which controls the cti port ( RCP ) puts the call on hold . The moment this happens , the agent should hear MOH from CUCM . The customer has silence.wav with no audio ( business requirement ) . The remote agent phone displays hissing or static . - When a customer calls in which is represented as another CTI port , the RTP stream is switched from the MOH server to the ingress GW - the mobile agent hears static or hissing sound throughout , but the caller does not - after the caller drops the call, RCP call stays up ( as per design ) and we continue to hear static or hissing - the subsequent LCP/Caller call again has static or hissing - sometimes we do not hear any static or hissing during the RCP call as described above , but only after the LCP call that we hear hissing or static. - we tested using an ip phone as customer/caller call , and this call does not ingress any GW , but rather just an inbound call to the same number ( so caller is on-net and RCP is off-net )and still we hear static on mobile agent phone
Conditions: Issue is only seen if the call is a mobile agent call.
Workaround: Convert to H323 gatways and use software MTP.

UC560 crashes with CLI command "show memory 0", Fixed CSCtg79105

Symptoms: A UC560 unexpectedly reboots.
Conditions: The symptom is observed when the show memory 0 command is executed.
Workaround: There is no workaround.

Memory leak in Dead processes due to AFW_application_process, Terminated CSCse09315

back out changes in the FAX stuck in TSP_DISC_PROG_IND_REL state, Fixed CSCeh39561

Symptoms: A fax call may be stuck in the RINGING, ACTIVE, or FXSLS_WAIT_RELEASE_REQ state.
Conditions: This symptom is observed on a Cisco router that is configured for VoIP and fax relay during a test that includes call waiting.
Workaround: There is no workaround.

VWIC3 E1 interface doesn't come up when connecting with Teleco, Fixed CSCtr63427

Symptom: VWIC3 controller e1 goes down when connecting to teleco
Conditions:
Workaround: No workaround

CMTS: UGS flows do not see any matching packet, Open CSCtx68722

Symptoms: Voice UGS flows is not receiving any packet
Conditions: This seems to occur only on calls where DATA path is between two MTA of the same CMTS
Workaround: delete the modem
Further Problem Description: In this particular case you will see that the CMTS still counts the Grants for this UGS flow but no packet is matching, Codeword is not increasing either although RTCP is showing increased counter from the MTA point of view

Crashes due to allocator Fax3SetupState, Open CSCtx66000

Symptom: A router may experience intermittent crashes:
Conditions: This has been experienced on an AS5400 running 12.4(24)T4 and 12.4(24)T6, which is configured for fax calls.
Workaround: No workaround is available at this time.

IPIPGW mem related crash (double free) at ccsip_update_srtp_caps, Terminated CSCtj69620

Symptom: During regular operations, a Cisco router running 12.4(24)T and possibly other releases experiences a crash. The crashinfo will report the following: %SYS-2-FREEFREE: Attempted to free unassigned memory at 4A001C2C, alloc 4180794C, dealloc 417616B0, %SYS-6-BLKINFO: Attempt to free a block that is in use blk 4A001BFC, words 134, alloc 4180794C, Free, dealloc 417616B0, rfcnt 0,
Conditions: N/A.
Workaround: N/A.
Further Problem Description: CSCtb25563 is another known issue that is likely to be related to this bug. Both are in Unreproducible state. For us to make progress, we need additional information. If you are a Cisco customer and suspect running into this, please engage Cisco/TAC if you are willing to -set the router to write a core file -run a special IOS image

A Cisco router may report alignment errors when SIP calls are made, Fixed CSCtq77512

Symptom: A Cisco router may report alignment errors while making SCCP audio call with Mandatory policy in MTP
Conditions: A Cisco router running IOS and configured as a voice gateway.
Workaround: Not known

Crash on voice gateway while saving SDP context, Fixed CSCtu25150

Symptom: A Cisco Router acting as a Voice Gateway may unexpectedly reload due to SegV exception, bus error or experience a spurious access.
Conditions: The exact conditions leading to the crash weren't known, the fix was determined by code inspection. The issue is only present in 15.1(4)M and later.
Workaround: None known

VXML tree not release when subdialog root document is shared, Fixed CSCsk97130

Symptoms: VXML application causes memory leak
Conditions:If the calling docuemnt and called docuemnt of a subdialog share the same root document, the tree structure used for the root document will not be released after the call session is finished.
Workaround: There is no workaround.

The "isdn layer2-flap" command does not show up in the running config, Fixed CSCtx43520

Symptom: The "isdn layer2-flap restart|status-enq" command when configured does not show up in the running configuration of the gateway. This is cosmetic and does not affect the functionality of the command.
Conditions: IOS voice gateway with support for the "isdn layer2-flap" command introduced in 12.4(15)T.
Workaround: none

PnP-CME: network-locale not pushed to vg202, Open CSCtx67486

Symptom: Plug-and-Play (PnP) CME Feature: CME has network-locale configured, hence we expect CME to push this config to the VG in order for the VG to auto-generate cptone CLI under the voice-port. This does not happen.
Conditions:
Workaround: none

DSP isn't told to "turn off" digits with mgcp dtmf-relay nte-gw / nte-ca, Fixed CSCta69407

Symptom: When using mgcp dtmf-relay type nte-gw, a sniffer trace will reveal that digits are sent both in-band (within the audio stream) and out-of-band (dtmf-relay). Because of this, double digits can be seen in Unity and MeetingPlace.
Conditions: GW with PRI/CAS backhaul via MGCP to CUCM and mgcp dtmf-relay configured to use nte-gw.
Workaround: Use mgcp dtmf-relay type out-of-band.
Further Problem Description:

On Ocassion, NSE events are generated with a payload type of 101, Fixed CSCtq30313

Symptom: Under certain conditions, it is seen that the NSE payload type is 101 even when the default provisioned payload type is 100.
Conditions: One such condition is when RFC2833 is enabled on the endpoint.
Workaround: No available workaround.

CUBE responds with "481/Transaction does not exist" for CANCEL message, Fixed CSCtq09542

Symptoms: CUBE responds with "481/Transaction does not exist" for CANCEL message.
Conditions: This symptom is observed with Cisco IOS Release 15.1(4)M.
Workaround: Use Tel URI instead of SIP URI.
Further Problem Description: SP----(SIP)-----CUBE-----(SIP)---CUCM Basic Call Scenarios are working fine with one exception: Party A (outside SIP Network) is calling party B (CUCM Phone). B is ringing, A gets ring-back. Now A cancels the call (before B answers the call). A gets released, B continues ringing.

Tracebacks in CME-CUBE call @ cch323_ct_main, Fixed CSCsx07692

Symptom: A Cisco router may report a spurious access.
Conditions: This is released to voice calls.
Workaround: None at this time.

SIP-One-way audio on SIP CFU calls and GW uses route map., Fixed CSCtx84059

Symptom: One way audio on calls from FXS to SIP which are call-forwarded in the SIP network.
Conditions: Router uses route-map for routing to the SIP network
Workaround: Add static route to the CFU party IP address.

SIP source binding CLI removed after serial subinterface flaps, Open CSCth63196

Symptom: The sip source interface binding commands disappear after being configured and functional.
Conditions: The T1 subinterface which is bound flaps with an active call present on it.
Workaround: Reapply the CLI manually.

AFW_application_ Process causing high CPU, Terminated CSCtl58335

Symptom: AFW_application_ Process is causing high CPU and reboot is required to clear the problem. Platform - 2811 c2800nm-advipservicesk9-mz.124-24.T4.bin
Conditions: AFW_application_ Process
Workaround: None.

gccb->context is NULL in DO-EO callflow, Fixed CSCtr30121

Problem Description: Delayed offer to Early offer calls that go through CUBE may not be communicated properly between CUBEs in an HA environment. The result could be no audio on failover.
Condition:Using CUBE HA
Workaround: None

isdn switch-type ntt not support International as TON and ISDN as NPI, Open CSCti51968

Symptom: If GW receives Q.931 SETUP from ISDN switch, GW does not send PROC.
Conditions: isdn switch-type ntt receives Q.931 SETUP with International as TON and ISDN as NPI.
Workaround: None on isdn swich-type ntt.

Hold/Resume: Multicast IP in SIP SDP sent by gateway causes oneway audio, Terminated CSCtx84013

Symptom: When a call coming via a SIP gateway is put on hold and resumed, the call will end up in one-way audio where IP phone could hear the caller, but the PSTN caller could not hear the IP phone
Conditions: The SIP gateway was also acting as Multicast Music on Hold(MMoH) audio source as defined in the callmanager and this MMoH audio source was used when the call was put on hold. Callmanager version 8.5 where the SIP trunk to the gateway was enabled with SIP profile which had the following flags set Early Offer support for voice and video calls (insert MTP if needed) Send send-receive SDP in mid-call INVITE
Workaround: Disable "Send send-receive SDP in mid-call INVITE" in the SIP profile and enable "Require SDP Inactive Exchange for Mid-Call Media Change"

CUBE does not consume early dialog UPDATE, Open CSCtr57059

Symptom: CUBE does not consume early-dialog Update and responds with 491
Conditions: CUCM - SIP -- CUBE -- SIP Cloud SIP cloud not supporting UPDATE method UPDATE can be required when doing transfer on CUCM where for the call to the transfer destination, going via CUBE into the SIP cloud, we have early media
Workaround: Different options: - Disable 1XX-rel on CUCM and/or - Using SIP profiles on CUBE to remove Update from Allow and 1xxrel from required header in requests/responses send to CUCM

Device crashing at swmtpmsp_msp_input, CSCtt30364

Symptom: Device crashes showing CPUHOGS, and watchdogs for process = VOIP_RTCP
Conditions: The symptom is observed on a Cisco IOS Voice over IP (VOIP) gateway.
Workaround: There is no workaround at this time.

Router crash + ip_sendself, Fixed CSCtn79475

Symptoms: A Cisco router reloads often due to stack overflow under some traffic conditions.
Conditions: This symptom is observed when calls resulting in VOIPRTP media loop are seen.
Workaround: There is no workaround.

Call kept on hold gets disconnected due to media inactivity timer, Fixed CSCtd80929

Symptom: SIP call may get disconnected during call hold state due to media inactivity timer.
Conditions: This problem was observed when the remote destination did not send any RTP or RTCP packets during call on hold (for example: either silence or tone on hold)
Workaround: Configure the media inactivity timer to a large value such that it is greater than the call hold time. Example : 1) RTP only (nonDSP based) ip rtcp report interval 65535 gateway timer receive-rtcp 1000 2) RTP only (DSP based) ip rtcp report interval 65535 gateway timer media-inactive 1000 3) RTCP only ip rtcp report interval 65535 gateway timer receive-rtcp 1000 4) RTP and RTCP (all) ip rtcp report interval 65535 gateway timer receive-rtcp 1000

Call Ringin and phone offhook timing issue causes phone hung, Fixed CSCtg36989

Symptom: When a phone goes offhook, and receives an incoming call at the same time, the offhook will be interpreted by the call controller as the "answer" to the incoming call, therefore causes the un-sync of the number of calls between gateway and the call controller. Eventually causes the port hung.
Conditions: Customer reported this issue.
Workaround: There is no workaround.

PVDM3 crash with Universal Transcoding when bad RTP timestamp received, Fixed CSCtr38804

Symptom: PVDM3 crash with Universal Transcoding when bad RTP timestamp received
Conditions: After loading the DSPware 26.3.400 with the fix of CSCtq85227, DSPs randomly get reset. Crash appears to be due to bad g711packets that were sent to the g711 to g729b transcoder. Bad g711 packet has a timestamp that is way out of range from the prior packet stream. Bad packets will not always cause the crash, but it can happen.
Workaround: None.

2900 PVDM 3:Fax not working from few numbers, other works all the time, CSCtr74194

Symptom: Incoming faxes from few numbers are not working 95% of the time on cisco 2900 routers using PVDM3. From the rest of the numbers, the faxes work 100% of the time. For example - When I fax from Cisco office fax machine, the fax is received by the customer successfully all the time, but when a partner faxes from his Xmedius (Sagemcom) fax server, it fails most of the time (95% ). Hence, for a few numbers it fails most of the time.
Conditions: Issue happening when PVDM3 is used. Issue is not happening with PVDM2 (2800 Routers).
Workaround: None

OLC message in "transmitter side paused" state, Open CSCtx29090

Symptom: CUBE doesn't process incoming OLC message in "transmitter side paused" "Transmitter side paused" describes in ITU-T, H323, 8.4.6 Third party initiated pause and re-routing
Conditions: If a empty TSC message comes before CONNECT.
Workaround: none

MGCP T38 fails to fallback to passthrough ., Terminated CSCsk66432

Symptom: Faxes fail between MGCP GW with T38 and ATA or H323 GW with modem passthrough configured
Conditions: TGW must have modem passthrough configured and all other fax-relay methods disabled. Fax can either originate or terminate at the MGCP GW
Workaround: Disable MGCP T38

GW fails to detect fax signal due to signal level is higher than -9dbm, Fixed CSCtu18634

Symptoms: ISR G2 fails to relay specific T30 messages in the POTS->IP direction. This would be a dropped DCS/TCF for an inbound fax, or a dropped DIS/CFR for an outbound fax. This will cause fax failure reproducible almost every time from/to specific sources where there is minimal dB loss in the PSTN. It is also commonly seen in PSTN hair-pinning scenarios.
Conditions: The symptom is observed with fax calls through a fax gateway configured for T.38 and running Cisco IOS Release 15.1(3)T2 or higher. The issue is seen when the input signal amplitude is too strong. It can be identified by obtaining a PCM capture and a packet capture and comparing the T30 data. The inbound stream of the PCM capture will show the T30 message, but the packet capture will not.
Workaround: Any one of the following workarounds apply: - Applying BOTH an input gain of -6 dB and an output attenuation of 6 dB to the voice-port. Note that this will cause audio conversations through the circuit to be 6dB quieter in each direction as well. - Downgrade to Cisco IOS Release 15.1(3)T1 or earlier. - Convert to fax/modem passthrough.

Ports Unregister on V224 and need VG restart to gets ports register, Open CSCtx57536

Symptom: SCCP Ports are getting unregistered
Conditions: No specific condition found. Need to restart the VG completely inroder to get the ports register back.
Workaround: NA

chunk corruption due to SIP, Open CSCtt26692

Symptoms: Router crashes due to memory corruption. In the crashinfo you may see: %SYS-2-CHUNKBADMAGIC: Bad magic number in chunk header, chunk AC2CFFC data 131FE064 chunkmagic 3938008B chunk_freemagic EF4321CD - Process= "CCSIP_SPI_CONTROL", ipl= 0, pid= 374 chunk_diagnose, code = 1 chunk name is MallocLite
Conditions: Router is configured for SIP. Further conditions unknown.
Workaround: There is no workaround.

CME - H323 FS to SIP EO One-way Audio when transcoder invoked, Open CSCts96266

Symptom: One way audio - Caller cannot hear voicemail prompts or calling party
Conditions: Call must invoke a transcoder Transcoding CME is running version 15.1(4)M or later Initiating side of the call is H323 Fast Start, receiving side of the call is SIP Early Offer
Workaround: ***Any one of these workarounds apply*** A. Downgrade to 15.1(3)T2 or earlier B. Disable H323 Fast Start voice service voip h323 call start slow C. Convert H323 side of call to SIP

router 2811 crash due to Process= DSMP, Fixed CSCti13493

Symptoms: A router crashes and the following traceback is seen: ASSERTION FAILED : ../voip/ccvtsp/vtsp.c: vtsp_cdb_assert: 1491: unkn - Traceback= ASSERTION FAILED : ../voip/ccvtsp/vtsp.c: vtsp_cdb_assert: 1491: unkn - Traceback= %SYS-3-MGDTIMER: Uninitialized timer, timer stop, timer = 47523D58. - Process= "DSMP", ipl= 0, pid= 226, -Traceback= TLB (load or instruction fetch) exception, CPU signal 10, PC = 0x430853EC
Conditions: The symptom is observed with the DSMP process.
Workaround: There is no workaround.

FXO caller-id display problem with China Telecom, Fixed CSCtq94408

Symptom: If the call is from PSTN to 2811 via FXO ports, we can't see caller-id on the ip phone.
Conditions: Ip phone-----2811CME-----fxo-------pstn When you configure the cptone as China and call alerting as 1, and do a "show voice-port port_id", we can see the caller-id as :: Caller ID Info Follows: Standard ETSI Caller ID is received after 1 ring(s) Translation profile (Incoming): Translation profile (Outgoing): lpcor (Incoming): But it should be Bellcore as per the standards.
Workaround: Use a different cp tone such as US which uses Bellcore which will resolve the caller-id issue.

C5510 DSP crashing continuously causing call drops, Open CSCtx54905

Symptom: T1/E1 circuit flap and call drops occurring on DSP associated with the crash. Output of "show voice dsp detail" indicates DSP in an "Unknown" state. The "RST" counter in the "show voice dsp detail" output is a non-zero value. Following output is seen when the DSP crash occurs, Dec 14 11:03:22.009: %DSPRM-3-DSPALARMINFO: 0018 0000 0080 FFFF 0004 4900 7469 6563 686F 2834 3833 2900 Dec 14 11:03:22.009: %DSPRM-3-DSPALARMINFO: tiecho(483) Dec 14 11:03:22.009: %DSMP-3-DSPALARM: Alarm on DSP 1/1:1: status=0x1 message=0x0 text=-
Conditions: PVDM2-x (5510 DSPs) and IOS 12.4(24)T4 on an ISR (28xx or 38xx) router. DSPware 24.3.4 on the DSPs.
Workaround: none

Leak in small buffer pool on 2911 router, Open CSCtx57074

Symptom: Leak in the small buffer pool.
Conditions: Unknown
Workaround: None

2921 router is crashing while running 15.0(1)M3 due to Process= DSMP, Fixed CSCtq63838

Symptoms: A Cisco 2921 router crashes, and the following traceback is seen: ASSERTION FAILED : ../voip/ccvtsp/vtsp.c: vtsp_cdb_assert: 1528: unkn -Traceback= 0x24A19810z 0x24A5DC8Cz 0x24A4A560z 0x24DF6618z 0x24DF6BBCz 0x24A2DD5Cz 0x24A2E274z 0x233DEA40z 0x233DEA24z ASSERTION FAILED : ../voip/ccvtsp/vtsp.c: vtsp_cdb_assert: 1528: unkn -Traceback= 0x24A19810z 0x24A5DC8Cz 0x24A4A7E0z 0x24DF6618z 0x24DF6BBCz 0x24A2DD5Cz 0x24A2E274z 0x233DEA40z 0x233DEA24z %SYS-3-MGDTIMER: Uninitialized timer, timer stop, timer = 315556E0. -Process= "DSMP", ipl= 0, pid= 306, -Traceback= 0x246EBB2Cz 0x24719984z 0x24A19810z 0x24A5DC8Cz 0x24A4A7E0z 0x24DF6618z 0x24DF6BBCz 0x24A2DD5Cz 0x24A2E274z 0x233DEA40z 0x233DEA24z 23:50:00 UTC Sun May 1 2011: TLB (load or instruction fetch) exception, CPU signal 10, PC = 0x2581FB94
Conditions: This symptom is observed with the DSMP process.
Workaround: There is no workaround.

Middle buffer leak at skinny_service_moh_multicast process, Open CSCtx27284

Symptom: MIddle buffer leak with Multicast MOH packets
Conditions: Multicast MOH configuration under ccm-call-manager
Workaround: Remove multicast MOH configuration

GW Interprets TDM-SIP call as H323-SIP call after Invite with replaces, Fixed CSCso17609

Symptom: Phone calls into GW to SIP Phone A. Sip Phone A places the call on hold and when the call is resumed from SIP Phone B the call drops
Conditions: Call fails when Invite with replaces header is treated as an H323-SIP call rather than TDM-SIP call
Workaround: none

CUBE - No INVITE sent to peer side - UNHOLD_FAILED, CSCtx52820

Symptom:User experiencing dropped calls with SIP integration and UCCX when they hold/unhold IP phone conversations
Conditions: NonCisco <--> CUBE<-------->CUCM <--INVITE 100--> <--INVITE 200(SDP)--> 200(SDP)--> <--ACK(SDP) <--INVITE(SDP) <<=== No invite sent to peer side 100--> <--ACK(SDP) <--BYE (Invite Timeout) <--BYE 200_BYE--> 200_BYE-->
Workaround:None found.

DSP is generating DTMF Out of bound and In band, Open CSCtx73839

Symptom: IOS GW, controlled by PGW via MGCP generates DTMF signals twice
Conditions: This happens, when call is going from TDM to IP side. PGW instructs GW to send OOB DTMF (MGCP RQNT/NTFY). GW is not sending NTFY message towards PGW, and is not able to supress the DTMF tone in outgoing RTP. That leads to the situation, that terminating IP part receives double DTMF
Workaround: You can route the calls via PSTN leg instead of IP.

Max. speed for G3 calls using T.38 version 3 is limited to 9600 bps, Fixed CSCtn96490

Symptom: The speed negotiated in a G3 Fax call may not exceed 9600 bps in the following network topology : 3rd Party Fax server -- SIP -- CUCM -- SIP -- ISR / ISR-G2 -- T1 PRI -- PSTN Fax machine
Conditions: This problem was observed when T.38 version 3 is negotiated between the Fax server and voice gateway i.e ISR / ISR-G2.
Workaround: Disable T.38 version 3 either under "voice service voip" (system setting) or under the dial-peer : voice service voip no fax protocol t38 version 3 ls-redundancy 0 hs-redundancy 0 fallback none fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none dial-peer voice 1 no fax protocol t38 version 3 ls-redundancy 0 hs-redundancy 0 fallback none fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none Note : Dial-peer configuration takes higher precedence than the system setting.

mgcp:FXS state machine didn't stop ringing, Fixed CSCtx43757

Symptom: FXS state machine didn't stop the ringing
Conditions: gateway running ios version 151-4M1, if the handset is answered during the ON ring cycle
Workaround: picked up the handset during OFF cycle

Refresh Re-Invite disconnect call because CUBE does not send out 200 OK, Fixed CSCsm34933

Symptom: In 12.4(15)XY, when cube receives the session refresh re-invite with sdp then it sends 100 trying but no 200 OK and therefore call gets dropped.
Conditions: Call gets dropped since no 200 OK sent by CUBE
Workaround: none

CUBE crash at sipSPISendOptionsResponse when removing cable, Fixed CSCtn56573

Symptom: CUBE keep crashing when removing cable from interface.
Conditions: This symptom is observed when voice-class sip bind command is configured in dial-peer and CUBE receives SIP options ping from peer node.
Workaround: no workaround

Memory leak in Dead processes due to AFW_application_process, Terminated CSCsv46093

Symptoms: Memory utilization on a router is increasing under Dead processes. 'sh mem dead tot' output shows that memoy is hold under 'AFW_application_process'.
Conditions: This happens on a 5350 running 12.3T or 12.4.
Workaround: Reload the router before bedore it runs out of memory - this should change if this defect gets resolved - the point of this defect is to avoid the reload associated with recovering from this condition.

Chunk leaks at "ipnat node" and "ipnat entry" with Codenomicon SIP suite, Fixed CSCts12366

Symptoms: Memory may not properly be freed when malformed SIP packets are received on the NAT interface.
Conditions: None
Workaround: None
Further Problem Description: None. PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 5/4.8: https://intellishield.cisco.com/security/alertmanager/cvssCalculator.do?dispatch=1&version=2&vector=AV:N/AC:L/Au:N/C:N/I:N/A:P/E:F/RL:U/RC:C CVE ID CVE-2011-2578 has been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html

VXML ASR mrcpv1 media pakcet got dropped due to CSCtn79475, Fixed CSCtr94887

Symptoms: Using MRCP v1, VXML script with ASR operation will always receive noinput event.
Conditions: The symptom is observed with Cisco IOS Release 15.2(1)T.
Workaround: There is no workaround.

VG224 doesn't support renegotiation of the call parameters, Fixed CSCsw62177

Symptom: One way voice after a renegotiation of the call parameters. With "debug voip app stcapp port x/x" Dec 15 11:13:07.935: 2/3 : ==> Received event:STCAPP_DC_EV_MEDIA_OPEN_XMT_CHNL Dec 15 11:13:07.935: 2/3 : Call State:ONHOOK_PEND Dec 15 11:13:07.935: 2/3 : Uninteresting event
Conditions: Sip reinvite to the callmanager
Workaround: None
Further Problem Description: Phone goes off hook OpenReceiveChannel OpenReceiveChannel Ack Message from VG224 to 3PCC: Goodbye (this message is not received by 3PCC which take few milliseconds to open the channels). CloseReceive Channel StopToneMessage OpenReceiveChannel StopMediaTransmission Message from VG224 to 3PCC: Goodbye StartMediaTransmission Onhook CloseReceive Channel StopToneMessage

%SIP-3-UNSUPPORTED: Unsupported ptime value, CSCts03959

Symptom: %SIP-3-UNSUPPORTED: Unsupported ptime value constantly being logged on a SIP to SIP Cisco Unified Border Element (CUBE) gateway running Cisco IOS 151-4M1.
Conditions: Observed on a SIP-SIP CUBE.
Workaround: None.

WS-SVC-CMM crashes with SNMP polling for DSP MIB file, Fixed CSCeg78279

Symptoms: A Cisco Catalyst 6500 series Communication Media Module (WS-CMM-SVC) may crash frequently.
Conditions: This symptom is observed on a Catalyst 6509 that is configured with a Supervisor Engine 720 that runs Cisco IOS Release 12.2(18)SXD2 while the WS-CMM-SVC runs Release 12.3(8)XY2. The symptom may also occur in Release 12.3T.
Workaround: There is no workaround.

Duplicate DTMF sends in h245-alphanumeric signal., Terminated CSCtx58311

Symptom: Duplicate DTMF digits been relayed in h245-alphanumeric signal.
Conditions: Only happens, when DTMF digits are entered which prompts the IVR the skip the remaining announcement, and re-negotiate TCS with different codec, and opend the channel again to trnasfer to agent. DSP channel detects the beginning of digit, and IOS close the channel then reopen a new channel. This happens in the middle of the digit. Before detecting the digit end, Channel is been closed and re-opened, So DSP would report the beginning of digit which causes duplication.
Workaround: None

CrossTalk w/PVDM3 15.1(1)T3 26.8.2DSP, Terminated CSCtt01553

Symptom: Customers using PVDM3 on IOS 15.1(1) T3 may hear crosstalk.
Conditions: Customers using 15.1(1) T3 may hear crosstalk.
Workaround: None

ISRG2: 1900 series(1921 and 1941) does not support NAT ALG of H323 pkt, Fixed CSCtr53311

Symptom: H323 protocol is not properly handled by NAT on C1900 platform. NAT'g fails for H.323 packets always.
Conditions: H323 signalling, and NAT configured on 1900 (this is ISRG2 1900 specific - 1921/1941)
Workaround: None
Further Problem Description: NAT support for H.323 packets were removed from 1921 and 1941 platforms. We will look to add the support feature back here.

Courtesy CallBack VoIP GW not sending 200ok on mid-call invite from CVP, Open CSCtx59441

Symptom: Courtesy Callback with VoIP GW using VoIP IP phone calls failing
Conditions: Caourty Call back success when using TDM leg calls but failing on call originatin from VoIP legs using IP phones
Workaround: none

Gateway is responding with 200 ok without SDP to the invite, Open CSCtx76030

Symptom: Gateway doesnt respond with SDP in the 200 ok for the re-invite from the SIP server
Conditions: Call flow Mobile phone---T1--->Cisco GW--->SIPServer(NLB)----> Polycom SIP Phone When ever the polycom SIP phone puts a call on hold a re-invite is sent to the GW. However when needed to resume the call back the Gateway does not send SDP in the 200 ok to the re-invite making the call to fail
Workaround: None

T.37 OnRamp Failing with error %LAPP_ON_MSGS-6-LAPP_ON_CAUSE_NO_MEMORY, Fixed CSCtu02542

Symptom: T.38 OnRamp consistently fails for every call with the error: %LAPP_ON_MSGS-6-LAPP_ON_CAUSE_NO_MEMORY: No memory available Debugs show: %LAPP_ON_MSGS-6-LAPP_ON_CAUSE_NO_MEMORY: No memory available //1093/4DE38C71808E/FOIP_ON/lapp_on_call_handoff: SOFTWARE_ERROR; Not enough memory; Free Process Memory Bytes=-1922868956 Which reflects a negative number for free process memory. Monitoring memory does not show any issues with available memory resources: Router#show memory stat Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 2AC0BEE0 2436776224 59890020 2376886204 2113970464 1034143696 I/O C000000 67108864 20001528 47107336 46989820 46943484
Conditions: Not known
Workaround: None

ISDN Restart message causes call disconnects on secondary span, Open CSCtx53323

Symptom: Call drops on ISDN triggered by an ISDN restart message on adjacent span
Conditions: H323 controller ISDN trunks
Workaround: None.

Memory corruption crash when freeing unassigned memory, Terminated CSCtc52911

Symptom: Memory corruption crash on a voice gateway related to SIP.
Conditions: Corruption occurs in the processor pool. The following message may be seen just prior to the crash - %SYS-2-FREEFREE: Attempted to free unassigned memory at

Workaround: None