CUCM - Block OffNet To OffNet Transfer

2016-08-25T09:03:00.001-07:00

I got called to look into an issue for a customer who were in the process of migrating users from an old 8.6 to a new 11.0 cluster. PSTN access was being routed through the new cluster and calls worked fine, however there were issues with transfers failing in certain scenarios.

The call flow was as follows -

PSTN ----> SIP GW ----> V11 CUCM ----> V11 User ----> V8.6 CUCM ----> V8.6 User

After making a number of test calls and taking the appropriate traces I found the following in the SDL logs on the V11 cluster.

69285831.001 |15:11:13.743 |AppInfo |Transferring - Cannot Complete Transfer with PrimaryTransferredIsOffnetDevice =1, SecondaryTransferDestinationIsOffnetDevice =1

The message is clear that CUCM believes this to be an "OffNet To OffNet Transfer" which on this particular cluster was blocked in the service parameters for Toll Fraud prevention, however in my view this appeared to be an OffNet originated call, with a fully On-Net transfer and therfore shouldnt have met the block criteria.

I decided to look at the Sip Trunk between the cluster, which on investigation had been correctly classified as "On-Net"

I then looked at the route pattern that was being used to route from V11 to the 8.6 and found the culprit.

As you can see, the call classification is incorrectly set as "offnet". Once changed to "OnNet" transfers worked as expected.

The Netscreen 5GT and PPPOE Broadband Providers

2011-04-25T13:54:00.000-07:00

If you are like me and need to have remote access to your systems over your broadband connection then you should carefully consider the type of firewall you have securing the connection.

Most isp supplied firewalls and routers provide varying levels of functionality in the form of port forwarding/dmz access but these can be tricky to configure and miss some of the advanced features like Ipsec which are useful for secure "on the road" remote access.

A few years ago I worked for a Service provider that used Netscreen firewalls for CPE, and it was here that I discovered the powerful features that make the smaller models ideal for soho environments.

My home firewall is an older 5GT model that I picked up a few years ago on eBay for around £60 although there are now various flavours including an ADSL and Wireless model.
The 5GT has five 10/100 ethernet ports one for the internet side and four for the LAN in standard trust/untrust mode, for simplicity I would have opted for a cable broadband connection with ethernet hand off and enabled dhcp on the Netscreen untrust port to obtain the public ip address, however there is no cable availability in my area so ADSL and PPPOE (ppp over Ethernet) was the only option.

I obtained a second hand adsl modem/router from ebay that supports RFC 1483 ADSL Bridging mode to terminate the line and provide an Ethernet port for my netscreen to connect to the isp with pppoe.

The next problem you will have is finding a good broadband provider that supports pppoe because as you may know pppoa(ppp over atm) is the typical encapsulation for UK adsl connections.
After a false promise from TalkTalk and a few hours troubleshooting they admitted they didn't support pppoe and that their salesmen would "say anything to get a sale" - so I promptly cancelled.

I looked into BT as I know they support pppoe on all of their broadband offerings however I found them pricey and in the end opted for Post Office Broadband which unofficially resells BT Broadband under their own banner but at their own prices.

I know have my Netscreen providing the following services -

- Ipsec dialup vpn for on the road remote access to LAN devices and NAS
- Voip media proxy using SIP ALG to ITSP
- Sip access to Asterisk PBX when on the road.
- Ssh access to Linux servers from Internet

The UC Tech Blog

CUCM - Block OffNet To OffNet Transfer

The Netscreen 5GT and PPPOE Broadband Providers