Contents

Introduction

Requirements

Components Used

Background Information

SIP registration process

SCCP registration process

Problem

Information to be clarified

Logs to collect

From Phone:

From CUCM:

From Switch:

How to collect logs guides

Understand PRT/console logs

IP Phone PCAP Register process

CUCM Traces

Troubleshoot many endpoints unregistration

Steps to narrow down the issue:

EndPointUnregistered System Error message explanation

Device Type Model List

Related Information

Introduction

This document describes how to begin troubleshooting an IP phone that goes unregistered or does not register with CUCM.

Requirements

Cisco recommends that you have knowledge of these topics:

- Cisco IP Phone registration process.

- Cisco Unified Communications Manager (CUCM)

- Domain Name System (DNS)

- Cisco Discovery Protocol (CDP)

- Dynamic Host Configuration Protocol(DHCP)

- Trivial File Transfer Protocol (TFTP)

- Voice Virtual LAN (Voice VLAN)

- Power Over Ethernet (PoE)

Components Used

The information in this document is based on these software and hardware versions:

- CUCM 11.5(1)SU9

- SIP IP Phone 8811 sip88xx.14-2-1-0001-14

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

The registration of a device in CUCM depends on whether it is a device that uses Skinny Protocol (SCCP) or Session Initiation Protocol (SIP), between them a few steps change, however the troubleshoot is the same and focuses on the steps that the phone does to register.

It is essential to troubleshoot device registration issues by understanding the process the device goes through to register correctly.

SIP registration process

SCCP registration process

Problem

Some events such as power outstage, a hardware or software defect, unstable connections, lack of quality of service in the network, and others, can cause one or many phones to be unregistered from Call Manager. Whether it is a single event or something intermittent, it is important to clarify the problem in order to narrow it down.

Information to be clarified

- Full CUCM version

- Does it happen only with a specific model?

- Does it happen at a single site or location?

- How many phones are affected?

- Do all phones share the same firmware version?

- Have you recently upgraded or downgraded the firmware?

- Have you recently regenerated certificates?

- Have you done a factory reset?

- Is the issue reproducible at will?

- Take note of a few MAC addresses for affected phones and timestamp when issue starts to happen.

Logs to collect

It is necessary to have the logs of each component involved in the phone registration process to find where the issue is.

From Phone:

On IP phone web page:

- Phone Problem Report (PRT) or Console logs

On Wireshark (no always needed):

- Pcap from Phone

From CUCM:

From RTMT (Real Time Monitor Tool):

- Cisco CallManager Traces

- Event Viewer Application Log

- Event Viewer System Log

- Cisco TFTP

From CUCM CLI session (no always needed):

- Pcap from primary CUCM (where the phone registers)

From Switch:

- Span (optional in case phone pcap can not be collected)

Note: Have the Timestamp when issue occurred is important and phone(s) detail.

How to collect logs guides

- How to collect CUCM logs from RTMT

- How to collect IP Phone pcap

- How to collect CUCM pcap

- How to collect IP Phone PRT

- How to collect phone console logs

- How to collect a SPAN on switch

Understand PRT/console logs

The process that the phone takes to request specific features (IP, Configuration file and others) from the other components involved can be seen in the PRT or in the console logs. The PRT includes the console logs.

Note: To be able to read the console logs within the PRT, it is necessary to uncompress the folders contained in the path prt-date-time-MACAddress > data > logsave > main

******** PRT/Console logs shows how phone loads its firmware image: ********

1429 NOT Jul 21 18:05:16.217247 (620-869) JAVA-SIPCC-PLAT_API: extract_release_num_from_phone_load_name: load_name:[sip88xx.14-2-1-0001-14.loads] release_num:[14.2.1]

******** Phone requests the Certificate Trust List (CTL) file ********

2056 NOT Jul 21 18:05:24.839195 (351-928) downd-GETXXTP [GT351][src=CTLSEPD0EC35C1D98E.tlv][dest=/tmp/CTLFile.tlv][serv=][serv6=][sec=0]

2057 NOT Jul 21 18:05:24.839912 (351-928) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml

2058 NOT Jul 21 18:05:24.840023 (351-928) downd-handle_get_file:dst:/tmp/CTLFile.tlv

2059 NOT Jul 21 18:05:24.891683 (351-928) downd-In normal mode, call - > makeXXTPrequest (V6...)

2060 NOT Jul 21 18:05:24.892095 (351-928) downd-EMCC mode is false

2061 NOT Jul 21 18:05:24.893087 (351-928) downd-parseDhcpInfoIntoTftpList(): no valid load server

2062 NOT Jul 21 18:05:24.893555 (351-928) downd-AUTH.SRVR [GT351] look up server - 0 - 198.51.100.30

2063 NOT Jul 21 18:05:24.944833 (351-928) downd-AUTH.SRVR [GT351] authentication retval = 9

2064 NOT Jul 21 18:05:24.944987 (351-928) downd-XXTP Non secure file requested

2065 NOT Jul 21 18:05:24.945138 (351-928) downd-tftp.avail file does not exist, so creating it

If the cluster is in non-secure mode, the TFTP sends 404 Not Found to the request (if cluster is in mixed mode, TFTP should send a 200 OK)

2078 NOT Jul 21 18:05:24.947516 (351-931) downd-XXX arg[4] CTLSEPD0EC35C1D98E.tlv

2079 NOT Jul 21 18:05:24.947550 (351-931) downd-XXX arg[5] /tmp/CTLFile.tlv

2080 NOT Jul 21 18:05:24.947584 (351-931) downd-XXX arg[6] (null)

2081 NOT Jul 21 18:05:24.976370 (931-931) GHTTP-LIMIT downdload will be limited to 8192 KB

2082 ERR Jul 21 18:05:24.994707 (931-931) GHTTP-http get [HTTP/1.1 404 Not Found^M

******** Phone requests Identity Trust List (ITL) file ********

2088 NOT Jul 21 18:05:25.049240 (351-935) downd-GETXXTP [GT351][src=ITLSEPD0EC35C1D98E.tlv][dest=/tmp/ITLFile.tlv][serv=][serv6=][sec=0]

2089 NOT Jul 21 18:05:25.049419 (351-935) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml

2090 NOT Jul 21 18:05:25.049484 (351-935) downd-handle_get_file:dst:/tmp/ITLFile.tlv

2091 NOT Jul 21 18:05:25.049525 (351-935) downd-handle_get_file:downloading ITLFILE

2092 NOT Jul 21 18:05:25.100110 (351-935) downd-In normal mode, call - > makeXXTPrequest (V6...)

TFTP sends 200 OK for the ITL File request

2110 NOT Jul 21 18:05:25.153781 (351-938) downd-XXX arg[4] ITLSEPD0EC35C1D98E.tlv

2111 NOT Jul 21 18:05:25.153815 (351-938) downd-XXX arg[5] /tmp/ITLFile.tlv

2112 NOT Jul 21 18:05:25.153849 (351-938) downd-XXX arg[6] (null)

2113 NOT Jul 21 18:05:25.166084 (938-938) GHTTP-LIMIT downdload will be limited to 8192 KB

2114 NOT Jul 21 18:05:25.168904 (938-938) GHTTP-hdr->HTTP/1.1 200 OK

2115 NOT Jul 21 18:05:25.169081 (938-938) GHTTP-hdr->Content-length: 11698

2116 NOT Jul 21 18:05:25.169149 (938-938) GHTTP-hdr->Cache-Control: no-store

2117 NOT Jul 21 18:05:25.169211 (938-938) GHTTP-hdr->Content-type: */*

2118 NOT Jul 21 18:05:25.170338 (351-935) downd-PARENT, child process status: 25600

2119 NOT Jul 21 18:05:25.170472 (351-935) downd-NORMAL tftp-exit 100

2120 NOT Jul 21 18:05:25.170724 (351-935) downd-XXTP complete - status = 100

2121 NOT Jul 21 18:05:25.170755 (351-935) downd-cancel the monitor timer

2122 NOT Jul 21 18:05:25.175638 (355-939) SECUREAPP-validateSignedCTL: new TL matches old, not updating

2123 NOT Jul 21 18:05:25.186516 (351-935) downd-DDGETTFTP.RESULT [_100_ HTTP NO ERROR

******** Phone requests to TFTP the configuration file ********

2140 NOT Jul 21 18:05:26.436017 (351-965) downd-GETXXTP [GT351][src=SEPD0EC35C1D98E.cnf.xml][dest=/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036][serv=][serv6=][sec=2]

2141 NOT Jul 21 18:05:26.436216 (351-965) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml

2142 NOT Jul 21 18:05:26.436285 (351-965) downd-handle_get_file:dst:/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036

2143 NOT Jul 21 18:05:26.436346 (351-965) downd-handle_get_file:downloading CNF FILE

2144 NOT Jul 21 18:05:26.487402 (351-965) downd-In normal mode, call - > makeXXTPrequest (V6...)

2145 NOT Jul 21 18:05:26.487841 (351-965) downd-EMCC mode is false

2146 NOT Jul 21 18:05:26.488595 (351-965) downd-parseDhcpInfoIntoTftpList(): no valid load server

2147 NOT Jul 21 18:05:26.488787 (351-965) downd-AUTH.SRVR [GT351] look up server - 0 - 198.51.100.30

2148 NOT Jul 21 18:05:26.539279 (351-965) downd-AUTH.SRVR [GT351] authentication retval = 9

2149 NOT Jul 21 18:05:26.539419 (351-965) downd-XXTP Secure file requested

2150 NOT Jul 21 18:05:26.539536 (351-965) downd-XXTP authenticated file approved - add .sgn if necessary -- SEPD0EC35C1D98E.cnf.xml.sgn

******** Phone downloads the configuration file ********

137 NOT Jul 21 18:05:26.432207 (620-840) JAVA-configmgr MQThread|cip.cfg.Config: - Requesting CONFIG file: ram/SEPD0EC35C1D98E.cnf.xml.19036 from TFTP Service(1), encrypt = false,isApplyingConfigFromFlash:false

2138 INF Jul 21 18:05:26.432653 (620-840) JAVA-[[MESSAGE_1.0]]: [CONFIG-MGR] --> tftpRequest(ram/SEPD0EC35C1D98E.cnf.xml.19036) --> [TFTP] :

2139 NOT Jul 21 18:05:26.435882 (351-965) downd-start the monitor timer

2140 NOT Jul 21 18:05:26.436017 (351-965) downd-GETXXTP [GT351][src=SEPD0EC35C1D98E.cnf.xml][dest=/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036][serv=][serv6=][sec=2]

2141 NOT Jul 21 18:05:26.436216 (351-965) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml

2142 NOT Jul 21 18:05:26.436285 (351-965) downd-handle_get_file:dst:/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036

2143 NOT Jul 21 18:05:26.436346 (351-965) downd-handle_get_file:downloading CNF FILE

2144 NOT Jul 21 18:05:26.487402 (351-965) downd-In normal mode, call - > makeXXTPrequest (V6...)

2145 NOT Jul 21 18:05:26.487841 (351-965) downd-EMCC mode is false

2146 NOT Jul 21 18:05:26.488595 (351-965) downd-parseDhcpInfoIntoTftpList(): no valid load server

2147 NOT Jul 21 18:05:26.488787 (351-965) downd-AUTH.SRVR [GT351] look up server - 0 - 198.51.100.30

2148 NOT Jul 21 18:05:26.539279 (351-965) downd-AUTH.SRVR [GT351] authentication retval = 9

2149 NOT Jul 21 18:05:26.539419 (351-965) downd-XXTP Secure file requested

2150 NOT Jul 21 18:05:26.539536 (351-965) downd-XXTP authenticated file approved - add .sgn if necessary -- SEPD0EC35C1D98E.cnf.xml.sgn

TFTP sends 200 OK to the configuration file request

2163 NOT Jul 21 18:05:26.541364 (351-968) downd-XXX arg[4] SEPD0EC35C1D98E.cnf.xml.sgn

2164 NOT Jul 21 18:05:26.541398 (351-968) downd-XXX arg[5] /tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036

2165 NOT Jul 21 18:05:26.541432 (351-968) downd-XXX arg[6] (null)

2166 NOT Jul 21 18:05:26.552194 (968-968) GHTTP-LIMIT downdload will be limited to 8192 KB

2167 NOT Jul 21 18:05:26.603994 (968-968) GHTTP-hdr->HTTP/1.1 200 OK

2168 NOT Jul 21 18:05:26.604360 (968-968) GHTTP-hdr->Content-length: 14939

2169 NOT Jul 21 18:05:26.604470 (968-968) GHTTP-hdr->Cache-Control: no-store

2170 NOT Jul 21 18:05:26.604523 (968-968) GHTTP-hdr->Content-type: */*

2171 NOT Jul 21 18:05:26.607331 (351-965) downd-PARENT, child process status: 25600

2172 NOT Jul 21 18:05:26.607479 (351-965) downd-NORMAL tftp-exit 100

2173 NOT Jul 21 18:05:26.607504 (351-965) downd-XXTP complete - status = 100

******** Phone loads the new firmware  ********

2202 NOT Jul 21 18:05:27.530229 (620-981) JAVA-Seamless Upgrade Thread|UpgradeService: - Got request for (sip88xx.14-2-1-0001-14.loads) when we are already running (sip88xx.14-2-1-0001-14.loads)

2203 NOT Jul 21 18:05:27.530908 (620-981) JAVA-Seamless Upgrade Thread|UpgradeService: - and (sip88xx.14-0-1-0201-171.loads) when we already have (sip88xx.14-0-1-0201-171.loads). Ignoring this request.

******** Phone charges all the parameters written on the configuration file ********

4479 NOT Jul 17 22:29:45.818159 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - HEADSET_DISCOVERY_URL: https://{cucm}:9444/headset/{devicename}

4480 NOT Jul 17 22:29:45.819013 (559-1232) JAVA-configmgr MQThread|cip.cfg.SipConfig: - Entering setProtocolConfigProperties() at 1689650985818 millisecs....<RemoveItLater>

4481 NOT Jul 17 22:29:45.998381 (559-1232) JAVA-configmgr MQThread|cip.cfg.SipConfig:? - embrace feature hack, update line 1, featureId = 9, name = 0236

4482 NOT Jul 17 22:29:46.037905 (559-1232) JAVA-configmgr MQThread|cip.cfg.SipConfig: - Exiting setProtocolConfigProperties() at 1689650986037 millisecs....<RemoveItLater>

4483 NOT Jul 17 22:29:46.106088 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #0 XmlCallAgentObject: IPv4-name=[198.51.100.80] IPv6-name=[] ethernetPhonePort=2000 sipPort=5060 securedSipPort=5061 priority=0

4484 NOT Jul 17 22:29:46.107950 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #1 XmlCallAgentObject: IPv4-name=[198.51.100.46] IPv6-name=[] ethernetPhonePort=2000 sipPort=5060 securedSipPort=5061 priority=1

4485 NOT Jul 17 22:29:46.109415 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #2 XmlCallAgentObject: IPv4-name=[] IPv6-name=[] ethernetPhonePort=0 sipPort=0 securedSipPort=0 priority=32767

4486 NOT Jul 17 22:29:46.111032 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #3 XmlCallAgentObject: IPv4-name=[] IPv6-name=[] ethernetPhonePort=0 sipPort=0 securedSipPort=0 priority=32767

4487 NOT Jul 17 22:29:46.112528 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #4 XmlCallAgentObject: IPv4-name=[] IPv6-name=[] ethernetPhonePort=0 sipPort=0 securedSipPort=0 priority=32767

4488 WRN Jul 17 22:29:46.291408 (345-2829) SECUREAPP-SEC_CAPF_N_IN_USE: CAPF not in use, user cancel ignored

4489 NOT Jul 17 22:29:46.341949 (559-1232) JAVA-configmgr MQThread|cip.sec.CapfProperty:? - CapfProp 96

******** Register message  ********

6260 DEB Jul 17 22:29:50.880584 (610-796) JAVA-SIPCC-SIP_STATE: 201/1, sip_reg_sm_change_state: Registration state change: SIP_REG_STATE_REGISTERED ---> SIP_REG_STATE_IDLE

6261 DEB Jul 17 22:29:50.880638 (610-796) JAVA-SIPCC-SIP_MSG_SEND: ccsip_register_send_msg: cmd=85=SIP_REG_REQ ndx=201

6262 DEB Jul 17 22:29:50.880750 (610-796) JAVA-SIPCC-SIP_STATE: 201/1, sip_reg_sm_change_state: Registration state change: SIP_REG_STATE_IDLE ---> SIP_REG_STATE_IDLE

******** Phone sends a SIP REGISTER message to CUCM ********

76 DEB Jul 17 22:29:50.882403 (610-796) JAVA-sipio-sent---> REGISTER sip:198.51.100.31 SIP/2.0^M

Via: SIP/2.0/TCP 198.51.100.109:50020;branch=z9hG4bK775c97a8^M

From: <sip:***@198.51.100.31>;tag=d0ec35c1d98e2e142ea51ccd-2fdbbe4d^M

To: <sip:***@198.51.100.31>^M

Call-ID: d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109^M

Max-Forwards: 70^M

Session-ID: 0ffda3aa00105000a000d0ec35c1d98e;remote=00000000000000000000000000000000^M

Date: Mon, 17 Jul 2023 22:29:50 GMT^M

CSeq: 11749 REGISTER^M

User-Agent: Cisco-CP8811/14.2.1^M

Contact: <sip:***@198.51.100.109:50020;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217"^M

Supported: replaces,join,sdp-anat,norefersub,resource-priority,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-7.0.0,X-cisco-xsi-8.5.1^M

Content-Length: 0^M

Expires: 3600^M

^M

******** SIP Trying message to the REGISTER received from CUCM ********

6284 DEB Jul 17 22:29:50.884485 (610-796) JAVA-sipio-recv<--- SIP/2.0 100 Trying^M

Via: SIP/2.0/TCP 198.51.100.109:50020;branch=z9hG4bK775c97a8^M

From: <sip:***@198.51.100.31>;tag=d0ec35c1d98e2e142ea51ccd-2fdbbe4d^M

To: <sip:***@198.51.100.31>^M

Date: Mon, 17 Jul 2023 22:29:52 GMT^M

Call-ID: d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109^M

CSeq: 11749 REGISTER^M

Content-Length: 0^M

^M

******** 200 OK in response to the REGISTER message from CUCM ********

6294 DEB Jul 17 22:29:50.885744 (610-796) JAVA-sipio-recv<--- SIP/2.0 200 OK^M

Via: SIP/2.0/TCP 198.51.100.109:50020;branch=z9hG4bK775c97a8^M

From: <sip:***@198.51.100.31>;tag=d0ec35c1d98e2e142ea51ccd-2fdbbe4d^M

To: <sip:***@198.51.100.31>;tag=696179034^M

Date: Mon, 17 Jul 2023 22:29:52 GMT^M

Call-ID: d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109^M

Server: Cisco-CUCM14.0^M

CSeq: 11749 REGISTER^M

Expires: 120^M

Contact: <sip:***@198.51.100.109:50020;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217"^M

Supported: X-cisco-srtp-fallback,X-cisco-sis-10.0.0^M

Content-Length: 0^M

^M

IP Phone PCAP Register process

In pcap is shown the complete process on how device perform the communication with the other components as CUCM, TFTP, DHCP. If you want to see in detail what was not seen in the logs, the pcap would be necessary.

A recommended filter in case SIP devices: (((tcp) || (http)) || (sip)) && (ip.addr == XX.XX.XX.XX)

A recommended filter in case SCCP devices: (((tcp) || (http)) || (skinny)) && (ip.addr == XX.XX.XX.XX)

Where the XX.XX.XX.XX is the IP of the phone.

or another option

In case SIP devices: (((tcp) || (http)) || (sip)) && (eth.addr == YYYYYYYYYYYY)

in case SCCP devices: (((tcp) || (http)) || (skinny)) && (eth.addr == YYYYYYYYYYYY)

Where the YYYYYYYYYYYY is the MAC of the phone.

You can also use the MAC address with the colon: eth.addr == YY:YY:YY:YY:YY:YY

The phone opens a TCP session with the TFTP

Phone request the CTL file and receives and 404 not found from the TFTP

Phone request the ITL file and receives from TFTP the file via TCP packets

TFTP sends 200 OK for ITL file request, the phone ACKs the data it received and closes the TCP session

Note: For each request to TFTP the phone try to establish a new TCP connection

Phone requests the configuration file to TFTP and receives from TFTP the file via TCP packets

TFTP sends 200 OK for ITL file request, the phone ACKs the data it received

Phone requests the configurations from TFTP and receives each file via TCP packets.

SIP Register messages and 200 OK from CUCM.

CUCM Traces

******** REFER to inform CUCM about the last registration status ********

REFER sip:198.51.100.31 SIP/2.0

Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK25771c8e

From: "2001" <sip:2001@198.51.100.109>;tag=d0ec35c1d98e00030abbb40d-0dadaa5e

To: <sip:198.51.100.31>

Call-ID: d0ec35c1-d98e0003-657a07f3-6d626333@198.51.100.109

Session-ID: 92eb5cca00105000a000d0ec35c1d98e;remote=00000000000000000000000000000000

Date: Fri, 21 Jul 2023 18:05:31 GMT

CSeq: 1000 REFER

User-Agent: Cisco-CP8811/14.2.1

Expires: 10

Max-Forwards: 70

Contact: <sip:fa7155fd-ec0d-7b35-c49b-86e9f163bf11@198.51.100.109:50806;transport=tcp>;+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E"

Require: norefersub

Referred-By: "2001" <sip:2001@198.51.100.109>

Refer-To: cid:28820b4e@198.51.100.109

Content-Id: <28820b4e@198.51.100.109>

Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE

Content-Length: 1693

Content-Type: application/x-cisco-alarm+xml

Content-Disposition: session;handling=required

<?xml version="1.0" encoding="UTF-8"?>

<x-cisco-alarm>

<Alarm Name="LastOutOfServiceInformation">

<ParameterList>

<String name="DeviceName">SEPD0EC35C1D98E</String>

<String name="DeviceIPv4Address">198.51.100.109/24</String>

<String name="IPv4DefaultGateway">198.51.100.1</String>

<String name="DeviceIPv6Address"></String>

<String name="IPv6DefaultGateway"></String>

<String name="ModelNumber">CP-8811</String>

<String name="NeighborIPv4Address">198.51.100.98</String>

<String name="NeighborIPv6Address"></String>

<String name="NeighborDeviceID">jpazjaim_SW</String>

<String name="NeighborPortID">GigabitEthernet0/2</String>

<Enum name="DHCPv4Status">1</Enum>

<Enum name="DHCPv6Status">3</Enum>

<Enum name="TFTPCfgStatus">1</Enum>

<Enum name="DNSStatusUnifiedCM1">0</Enum>

<Enum name="DNSStatusUnifiedCM2">0</Enum>

<Enum name="DNSStatusUnifiedCM3">0</Enum>

<Enum name="DNSv6StatusUnifiedCM1">0</Enum>

<Enum name="DNSv6StatusUnifiedCM2">0</Enum>

<Enum name="DNSv6StatusUnifiedCM3">0</Enum>

<String name="VoiceVLAN">360</String>

<String name="UnifiedCMIPAddress">198.51.100.31</String>

<String name="LocalPort">50020</String>

<String name="TimeStamp">1689962095016</String>

<Enum name="ReasonForOutOfService">25</Enum>

<String name="LastProtocolEventSent">Sent:REGISTER sip:198.51.100.31 SIP/2.0 Cseq:11810 REGISTER CallId:d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109 </String>

<String name="LastProtocolEventReceived">Rcvd:SIP/2.0 202 Accepted Cseq:1000 REFER CallId:d0ec35c1-d98e0002-1e0df6e4-4cae92c9@198.51.100.109 </String>

<String name="ReasonForOutOfServiceText">LastTimeInitialized</String>

<String name="ActiveInterface">Wired</String>

</ParameterList>

</Alarm>

</x-cisco-alarm>

******** 202 Accepted message to the REFER ********

SIP/2.0 202 Accepted

Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK25771c8e

From: "2001" <sip:2001@198.51.100.109>;tag=d0ec35c1d98e00030abbb40d-0dadaa5e

To: <sip:198.51.100.31>;tag=1984400291

Date: Fri, 21 Jul 2023 18:08:58 GMT

Call-ID: d0ec35c1-d98e0003-657a07f3-6d626333@198.51.100.109

CSeq: 1000 REFER

Contact: <sip:198.51.100.31:5060;transport=tcp>

Content-Length: 0

******** REGISTER SIP messages from IP Phone ********

REGISTER sip:198.51.100.31 SIP/2.0

Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK0aeff5a4

From: <sip:2001@198.51.100.31>;tag=d0ec35c1d98e00044e764ab3-2227c9d6

To: <sip:2001@198.51.100.31>

Call-ID: d0ec35c1-d98e0002-71e1f429-052f5580@198.51.100.109

Max-Forwards: 70

Session-ID: 92eb5cca00105000a000d0ec35c1d98e;remote=00000000000000000000000000000000

Date: Fri, 21 Jul 2023 18:05:31 GMT

CSeq: 101 REGISTER

User-Agent: Cisco-CP8811/14.2.1

Contact: <sip:fa7155fd-ec0d-7b35-c49b-86e9f163bf11@198.51.100.109:50806;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217"

Supported: replaces,join,sdp-anat,norefersub,resource-priority,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-7.0.0,X-cisco-xsi-8.5.1

Reason: SIP;cause=200;text="cisco-alarm:25 Name=SEPD0EC35C1D98E ActiveLoad=sip88xx.14-2-1-0001-14.loads InactiveLoad=sip88xx.14-0-1-0201-171.loads Last=initialized"

Expires: 3600

Content-Type: multipart/mixed; boundary=uniqueBoundary

Mime-Version: 1.0

Content-Length: 1313

******** CUCM send the 200 OK to the REGISTER message ********

SIP/2.0 200 OK

Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK0aeff5a4

From: <sip:2001@198.51.100.31>;tag=d0ec35c1d98e00044e764ab3-2227c9d6

To: <sip:2001@198.51.100.31>;tag=757446526

Date: Fri, 21 Jul 2023 18:08:58 GMT

Call-ID: d0ec35c1-d98e0002-71e1f429-052f5580@198.51.100.109

Server: Cisco-CUCM14.0

CSeq: 101 REGISTER

Expires: 120

Contact: <sip:fa7155fd-ec0d-7b35-c49b-86e9f163bf11@198.51.100.109:50806;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217";x-cisco-newreg

Supported: X-cisco-srtp-fallback,X-cisco-sis-10.0.0

Content-Type: application/x-cisco-remotecc-response+xml

Content-Length: 381

Troubleshoot many endpoints unregistration

For this issue, a couple of MAC addresses of some affected phones are needed.

To make easier the process, it is necessary to have a text editor such as Notepad++, Visual Studio or others.

To troubleshoot this issue, the event viewer logs can be verified. In the event viewer logs, events such as the registered and unregistered endpoint, ITL and CTL information, endpoint type, active firmware, phone protocol, reason for non-registration and much more can be found here.

Steps to narrow down the issue:

1. Open logs folder in your text editor

2. Search in all the folders

3. Search for endpointunregistered

This shows us all the results from syslog folder and SDL files that contain this word.

5440: Jul 17 21:45:17 cucmsub local6 6 ccm: 19: xxxxxxx.xxxxxx.xx Jul 18 2023 02:45:17 UTC : %UC_CALLMANAGER-6-EndPointUnregistered: %[DeviceName=SEPXXXXXXXXXXXX][IPAddress=198.51.100.117][Protocol=SIP][DeviceType=622][Description=SEPXXXXXXXXXXXX_CP_7841][Reason=28][IPAddrAttributes=0][AppID=Cisco CallManager][ClusterID=SSPTSite}][NodeID=cucmsub]: An endpoint has unregistered

EndPointUnregistered System Error message explanation

IPAddress: IP for the affected endpoint.

DeviceName: Mac Address for affected endpoint.

Protocol: Protocol with which the endpoint was registered.

DeviceType: Type of endpoint model.

To know the device type model number and name, run on CLI: run sql select enum,name from typemodel

Description: Description set in Call Manager when registering the phone.

Reason: Reason of the system error message.

Find all the reasons for system error messages here.

IPAddrAttributes: Describe the use of the IP.

AppID: Type of unified server.

NodeID: Node name.

You must focus on the reason number of the error message, mac address and timestamp to match the alert with your occurrence and then navigate to the page where reasons are found.

Note: The page for system error message contains all alarms available on RTMT, the explanation and description of reasons why the alarm was triggered.

Once you open the page:

1. Press CTRL + F (on windows) or Command + F (on MacOs)

2. Search for EndPointUnregistered

3. Scroll down until you find Enum Definitions - Reason

4. Search the number(s) of the reasons on the system error message

In case more information is needed, the pcap on the phone is the best option to view the phone registration process step by step.

Device Type Model List

To know the device types associated with the DeviceType field that appear in the alert, you can run a query in the CLI of the CUCM where the phones are registered.

Query: run sql select enum,name from typemodel

enum name

===== ==================================================

1 Cisco 30 SP+

2 Cisco 12 SP+

3 Cisco 12 SP

4 Cisco 12 S

5 Cisco 30 VIP

6 Cisco 7910

7 Cisco 7960

8 Cisco 7940

9 Cisco 7935

10 Cisco VGC Phone

11 Cisco VGC Virtual Phone

12 Cisco ATA 186

15 EMCC Base Phone

20 SCCP Phone

30 Analog Access

40 Digital Access

42 Digital Access+

43 Digital Access WS-X6608

47 Analog Access WS-X6624

48 VGC Gateway

50 Conference Bridge

51 Conference Bridge WS-X6608

52 Cisco IOS Conference Bridge (HDV2)

53 Cisco Conference Bridge (WS-SVC-CMM)

61 H.323 Phone

62 H.323 Gateway

70 Music On Hold

71 Device Pilot

72 CTI Port

73 CTI Route Point

80 Voice Mail Port

83 Cisco IOS Software Media Termination Point (HDV2)

84 Cisco Media Server (WS-SVC-CMM-MS)

85 Cisco Video Conference Bridge (IPVC-35xx)

86 Cisco IOS Heterogeneous Video Conference Bridge

87 Cisco IOS Guaranteed Audio Video Conference Bridge

88 Cisco IOS Homogeneous Video Conference Bridge

90 Route List

100 Load Simulator

110 Media Termination Point

111 Media Termination Point Hardware

112 Cisco IOS Media Termination Point (HDV2)

113 Cisco Media Termination Point (WS-SVC-CMM)

115 Cisco 7941

119 Cisco 7971

120 MGCP Station

121 MGCP Trunk

122 GateKeeper

124 7914 14-Button Line Expansion Module

125 Trunk

126 Tone Announcement Player

131 SIP Trunk

132 SIP Gateway

133 WSM Trunk

134 Remote Destination Profile

227 7915 12-Button Line Expansion Module

228 7915 24-Button Line Expansion Module

229 7916 12-Button Line Expansion Module

230 7916 24-Button Line Expansion Module

232 CKEM 36-Button Line Expansion Module

253 SPA8800

254 Unknown MGCP Gateway

255 Unknown

302 Cisco 7985

307 Cisco 7911

308 Cisco 7961G-GE

309 Cisco 7941G-GE

335 Motorola CN622

336 Third-party SIP Device (Basic)

348 Cisco 7931

358 Cisco Unified Personal Communicator

365 Cisco 7921

369 Cisco 7906

374 Third-party SIP Device (Advanced)

375 Cisco TelePresence

376 Nokia S60

404 Cisco 7962

412 Cisco 3951

431 Cisco 7937

434 Cisco 7942

435 Cisco 7945

436 Cisco 7965

437 Cisco 7975

446 Cisco 3911

468 Cisco Unified Mobile Communicator

478 Cisco TelePresence 1000

479 Cisco TelePresence 3000

480 Cisco TelePresence 3200

481 Cisco TelePresence 500-37

484 Cisco 7925

493 Cisco 9971

495 Cisco 6921

496 Cisco 6941

497 Cisco 6961

503 Cisco Unified Client Services Framework

505 Cisco TelePresence 1300-65

520 Cisco TelePresence 1100

521 Transnova S3

522 BlackBerry MVS VoWifi

537 Cisco 9951

540 Cisco 8961

547 Cisco 6901

548 Cisco 6911

550 Cisco ATA 187

557 Cisco TelePresence 200

558 Cisco TelePresence 400

562 Cisco Dual Mode for iPhone

564 Cisco 6945

575 Cisco Dual Mode for Android

577 Cisco 7926

580 Cisco E20

582 Generic Single Screen Room System

583 Generic Multiple Screen Room System

584 Cisco TelePresence EX90

585 Cisco 8945

586 Cisco 8941

588 Generic Desktop Video Endpoint

590 Cisco TelePresence 500-32

591 Cisco TelePresence 1300-47

592 Cisco 3905

593 Cisco Cius

594 VKEM 36-Button Line Expansion Module

596 Cisco TelePresence TX1310-65

597 Cisco TelePresence MCU

598 Ascom IP-DECT Device

599 Cisco TelePresence Exchange System

604 Cisco TelePresence EX60

606 Cisco TelePresence Codec C90

607 Cisco TelePresence Codec C60

608 Cisco TelePresence Codec C40

609 Cisco TelePresence Quick Set C20

610 Cisco TelePresence Profile 42 (C20)

611 Cisco TelePresence Profile 42 (C60)

612 Cisco TelePresence Profile 52 (C40)

613 Cisco TelePresence Profile 52 (C60)

614 Cisco TelePresence Profile 52 Dual (C60)

615 Cisco TelePresence Profile 65 (C60)

616 Cisco TelePresence Profile 65 Dual (C90)

617 Cisco TelePresence MX200

619 Cisco TelePresence TX9000

620 Cisco TelePresence TX9200

621 Cisco 7821

622 Cisco 7841

623 Cisco 7861

626 Cisco TelePresence SX20

627 Cisco TelePresence MX300

628 IMS-integrated Mobile (Basic)

631 Third-party AS-SIP Endpoint

632 Cisco Cius SP

633 Cisco TelePresence Profile 42 (C40)

634 Cisco VXC 6215

635 CTI Remote Device

640 Usage Profile

642 Carrier-integrated Mobile

645 Universal Device Template

647 Cisco DX650

648 Cisco Unified Communications for RTX

652 Cisco Jabber for Tablet

659 Cisco 8831

681 Cisco ATA 190

682 Cisco TelePresence SX10

683 Cisco 8841

684 Cisco 8851

685 Cisco 8861

688 Cisco TelePresence SX80

689 Cisco TelePresence MX200 G2

690 Cisco TelePresence MX300 G2

20000 Cisco 7905

30002 Cisco 7920

30006 Cisco 7970

30007 Cisco 7912

30008 Cisco 7902

30016 Cisco IP Communicator

30018 Cisco 7961

30019 Cisco 7936

30027 Analog Phone

30028 ISDN BRI Phone

30032 SCCP gateway virtual phone

30035 IP-STE

36041 Cisco TelePresence Conductor

36042 Cisco DX80

36043 Cisco DX70

36049 BEKEM 36-Button Line Expansion Module

36207 Cisco TelePresence MX700

36208 Cisco TelePresence MX800

36210 Cisco TelePresence IX5000

36213 Cisco 7811

36216 Cisco 8821

36217 Cisco 8811

36219 Interactive Voice Response

36224 Cisco 8845

36225 Cisco 8865

36227 Cisco TelePresence MX800 Dual

36232 Cisco 8851NR

36235 Cisco Spark Remote Device

36239 Cisco Webex DX80

36241 Cisco TelePresence DX70

36247 Cisco 7832

36248 Cisco 8865NR

36250 Cisco Meeting Server

36251 Cisco Webex Room Kit

36254 Cisco Webex Room 55

36255 Cisco Webex Room Kit Plus

36256 CP-8800-Video 28-Button Key Expansion Module

36257 CP-8800-Audio 28-Button Key Expansion Module

36258 Cisco 8832

36259 Cisco Webex Room 70 Single

36260 Cisco 8832NR

36262 Cisco ATA 191

36265 Cisco Webex Room 70 Dual

36292 Cisco Webex Room Kit Pro

36295 Cisco Webex Room 55 Dual

36296 Cisco Webex Room 70 Single G2

36297 Cisco Webex Room 70 Dual G2

36299 Cisco Webex Room Kit Mini

36304 Cisco Webex Board 55

36305 Cisco Webex Board 70

36306 Cisco Webex Board 85

36307 Cisco Webex Desk Pro

36308 Cisco Webex Room Panorama

36309 Cisco Webex Room 70 Panorama

36312 Cisco Webex Room Phone

Note: The result of the query can change based on the CUCM version.

Related Information

- Cisco Technical Support & Downloads