Voice Gateways Hot Issues from Cisco TAC

Bus error and crash when non-skinny packet with src/dst port 2000 , Fixed CSCsy09250

Symptoms: Router experiences a bus error crash.
Conditions: Occurs when the router is configured for network address translation (NAT). The problem appears to occur when NAT tries to process fragmented Skinny Call Control Protocol (SCCP) packets.
Workaround: Configure no ip nat service skinny tcp port 2000. This will only work for networks where SCCP traffic does not need to be processed by NAT. Double-check before configuring this command.

DSP: Echo cancellation tail changes mid-call, echo on single DSP channel , Open CSCtb26941

Symptom: Intermittent echo on voice calls.
Conditions: A DSP channel, or set of DSP channels, go into a bad state where they no longer cancel echo. The audio stream coming into the DSP will match exactly what is going out. This can be identified by the symptom that the echo-cancellation tail will vary during a call even when the tail is specified on the voice port. Values from 24ms to 112ms have been observed for a single call which this issue occurs on. The command show call active voice echo-canceller summary can be used to observe the echo cancellation tail, and the voice-port command echo-cancel coverage can be used to statically set the echo cancellation tail.
Workaround: The DSP can be reset, or the gateway can be reloaded, and the echo canceler will begin functioning.

One way audio from CMM ACT due to incorrect ARP entries w/ CEF enabled , Fixed CSCsv25107
Symptom: Cisco IOS Communication Media Module (CMM) may experience intermittent one-way audio to devices on and off the same VLAN as the module.
Conditions: WS-SVC-CMM module configured as a VoIP gateway may experience this issue. The problem lies in CEF running and the cached ARP entried on the module. CEF is not supported on the CMM module as seen in the "Usage Guidelines and Restrictions" section of this document: http://www.cisco.com/en/US/docs/ios/12_3/12_3x/release/notes/OL_6314.html When CEF is enabled, intermittent issues of one-way audio may be experienced.
Workaround: The solution is to disabled cef with the configuration command no ip cef if it is enabled.

Voice/Fax fails when mgcp fax t38 inhibit command is configured , Fixed CSCsj24114
Symptom: Voice, Cisco Fax Relay and Fax Passthrough type of calls will fail when mgcp fax t38 inhibit command is configured
Conditions: This problem is noticed on Unified CM 6.0(1) and above.
Workaround: When you disable T.38 fax relay, you also need to disable the default enabled fxr-package, in addition to mgcp fax t38 inhibit, and reset the mgcp service. Otherwise, you enable T.38 fax relay with default enabled fxr-package.
Further Problem Description: Unified CM began to support T38 fax relay (CallAgent-controlled mode) based on if fxr-package is enabled since 4.2 in Windows release and 6.0 in Linux release. The current design states if GW and Call Agent (CUCM) fail on the fax protocol negotiation, all types of calls will be rejected including voice calls.

Call disconnects seen due to %C5510-1-NO_RING_DESCRIPTORS error , Fixed CSCtc70490
Symptom: Cisco IOS VoIP gateway may experience call drops and no audio intermittently. Call disconnects or failures due to the following errors
Conditions: A Cisco IOS VoIP gateway may experience loss of audio and dropped calls intermittently while process voice calls. This occurs when the DSP used in the call fails to respond. When this occurs, the below error messages may be seen. This particular issue documented in this bug ID is impacted only in DSP release 9.4.811 as seen in show voice dsp group all Sep 7 02:09:14.171 PDT: %C5510-1-C5510_CHPI_ERROR: cHPI error for pa_bay 1 pump 1 dsp 9. Sep 7 02:09:15.555 PDT: %C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available on slot 1 dsp 9. Sep 7 02:09:20.555 PDT: %C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available on slot 1 dsp 9.
Workaround: Downgrade either IOS to a release prior to 12.4(15)T10 or load another version of dspware by working with the TAC as documented in the CCO reference below. http://www.cisco.com/en/US/tech/tk652/tk698/technologies_tech_note09186a0080a7af82.shtml

ISDN Call Failure w/ cause 47 after DSP Allocation Failure on Channel , Fixed CSCsx67255
Symptoms: An outgoing call from an IP phone to PSTN through ISDN PRI fails on a channel due to a DSP allocation failure (not enough DSPs to support the call). Subsequent calls through that same channel continue to fail with "resource unavailable" cause value equal to 47 even after DSP resources have been made available to handle the call.
Conditions: The symptom occurs on a router running Cisco IOS Release 12.4(15)T8 or higher. The call must first fail with a legitimate DSP allocation error. Any call made through the same channel as the failed call will also fail. DSP allocation failures on gateway can be checked through the use of the exec command show voice dsp group all. The last line of the show command output includes a counter for "DSP resource allocation failure". This issue can be seen also in some cases upon bootup. When a gateway is reloaded, system resources will come up with slightly different timing. If, for example, a PRI interface comes up before the DSP resources have fully initialized, there may be a similar failure.
Workaround: 1. Reload the router to clear the channel. If a reload cannot be done, busy out the channel with the failed calls using the isdn busy b_channel command under the serial interface. 2. If this issue is due to oversubscription of the DSP resources, change the configuration to meet the DSP resources available on the gateway. Further information can be found with the CCO "DSP Calculator" at http://www.cisco.com/cgi-bin/Support/DSP/cisco_prodsel.pl. 3. If the issue is related to timing issues upon reload, shutdown the voice-port in question before reloading the gateway. When the gateway comes back up, take the voice-port out of shutdown.

MGCP T38 Fax Relay is disabled even when it is configured , Fixed CSCsy29533
Symptoms: A T.38 fax relay call may fail.
Conditions: The symptom is observed with an MGCP-controlled T.38 fax relay call when the gateway is configured for CA control T.38. The output of the debug voip vtsp all command shows fax relay as "DISABLED."
Workaround: Use Cisco IOS Release 12.4(15)T7 or Release 12.4(22)T.

Router crash pointing to SYS-6-STACKLOW on IPIPGW , Fixed CSCta14536
Symptoms: A Cisco IOS VoIP gateway configured for IPIPGW (CUBE) functionality may crash.
Conditions: A gateway configured for IPIPGW functionality with the command allow-connections under voice service voip under rare conditions will crash while processing VoIP calls. This has been found to occur in some scenarios where a single voip call loops (meaning the call is from the IPIPGW back to the same IPIPGW) through the IPIPGW. When this occurs, the following error message may be noticed: %SYS-6-STACKLOW: Stack for process IP Input running low, 0/12000
Workaround: The workaround is to track down the source of the call looping and correct the problem there. The other possible workaround is to introduce another termination point in the RTP packet flow beside the IPIPGW. For example, if interworking with Cisco Unified Communications Manager (Callmanager) a MTP resource may be used to prevent this loop as long as the MTP resource is not the CUBE gateway.

SIP overides Diversion Header from APP RDN number from OR to LRD , Fixed CSCsy24266
Symptoms: A call from a night hunt forwarded to BACD dial by an extension to an ephone (call forwarding no answer) to voicemail goes to the night hunt number and not the last redirected number.
Conditions: The symptom is observed with Cisco IOS Release 12.4(22)T.
Workaround: There is no workaround.

No audio for G.729 calls on MGCP GW due to asymmetric RTP payload types , Fixed CSCsy10653
Symptoms: Calls on an MGCP gateway negotiating the g729br8 codec may fail to have audio in one or both directions.
Conditions: This occurs on MGCP gateways with the fix for CSCsu66759 when the g729br8 codec is being negotiated.
Workaround: Any of the following will be sufficient to get around this issue: 1. Configure the gateway for static payload type using the following commands on the gateway: mgcp behavior g729-variants static-pt mgcp behavior dynamically-change-codec-pt disable 2. Disable g729br8 from being negotiated for this call. If CUCM is involved, this is done with the service parameter "Strip G.729 Annex B (Silence Suppression) from Capabilities". 3. Use a Cisco IOS code on the gateway which does not contain the fix for CSCsu66759 (Cisco IOS Release 12.4(22)T and below).

Router crashed at http code due to corrupted bad pointer , Fixed CSCsd33134
Symptoms: A router reloads unexpectedly when HTTP client sockets hang.
Conditions: This symptom is observed on a Cisco router that runs Cisco IOS Release 12.3(11)T2, or a later release, including Release 12.4 and Release 12.4T, when VXML is used to play long audio prompts that are streaming from an HTTP server.
Workaround: Enter the ivr prompt streamed none command on the router.

Crash illegal deallocation of unassigned/in-use memory , Fixed CSCsm55045
Symptoms: A Cisco router configured with Call Manager Express (CME) may reload due to point to illegal deallocation of unassigned/in-use memory.
Conditions: Occurs when CME is enabled.
Workaround: There is no workaround.

CUE clock does not sync up with the CME using NTP , Fixed CSCsu36827
Symptoms: The CUE clock does not synch up with the CME using NTP.
Conditions: This symptom is observed when the UC500 is configured as the NTP master.
Workaround: Use an external NTP server other than the UC500.

Multiple IPIP media loop causes stack overrun and crash in VoIP RTP , Fixed CSCsg44748
Symptoms: A Cisco IOS VoIP gateway configured for IPIPGW (CUBE) functionality may crash.
Conditions: A gateway configured for IPIPGW functionality with the command allow-connections under voice service voip under rare conditions will crash while processing VoIP calls. This has been found to occur in some scenarios where a single voip call loops (meaning the call is from the IPIPGW back to the same IPIPGW) through the IPIPGW. When this occurs, the following error message may be noticed: %SYS-6-STACKLOW: Stack for level Network interfaces running low, 0/9000 ***Note that a similar issue can be seen on images which are running a version with this fix. See CSCta14536. In this case the error output would be: %SYS-6-STACKLOW: Stack for process IP Input running low, 0/12000 If a media loop is causing the system to crash, either the source of the loop needs to be found, a workaround implemented or a fix including CSCta14536 needs to be implemented.***
Workaround: The workaround is to track down the source of the call looping and correct the problem there. The other possible workaround is to introduce another termination point in the RTP packet flow beside the IPIPGW. For example, if interworking with Cisco Unified Communications Manager (Callmanager) a MTP resource may be used to prevent this loop as long as the MTP resouce is not the CUBE router.

Show running-configs triggers unwanted MGCP error message , Fixed CSCsq16200
Symptom: %MGCP-3-INTERNAL_ERROR: mgcp_cfg_commands: nvgen lawful-intercept: should not happen message is seen after show run.
Conditions: The error is seen in all images other then adventerprisek9_ivs_li-mz image.
Workaround: None

Traceback observed@mgcpapp_chunk_mem_delete , Fixed CSCsq26285
Symptom: Traceback observed@mgcpapp_chunk_mem_delete
Conditions: Issue observed for MGCP calls in 12.4(19.19)
Workaround: No workaround
Further Problem Description:

MGCP calls to analog ports with caller-id length over 15 characters fail , Fixed CSCsr87229
Symptoms: Callers that use a caller-ID length of 15 characters or greater cannot call out of analog MGCP ports. Example: MGCP Packet received from ---> CRCX 132 AALN/S0/SU1/0@nicmatth-ipipgw MGCP 0.1 C: A000000001000026000000F5 X: 23 L: p:20, a:PCMU, s:off, t:b8 M: recvonly R: L/hd S: L/rg, L/ci(08/08/15/44,1002,This is my long name) Q: process,loop <--- MGCP Packet sent to ---> 510 132 unsupported caller id length
Conditions: The BELLCORE standards support only 15 characters, and the MGCP gateway disconnects the call because of unsupported caller-ID length and displays the following message: 510 unsupported caller id length.
Workaround: Configure a caller ID less then 15 character, or use the port with SCCP or H323 to prevent this. Also, the following cptones are not affected: "FR", "DE", "NO", "IT", "ES", "ZA", "TR", "GB", "AT".

SIP Call with TLS rejected with 400 response , Fixed CSCtd00332
Symptom: When call comes with Contact header having an unsupported transport type ( like TLS in 12.4 codebase), then the call is immediately rejected with 400 Bad request response. The call is rejected even if the SIP INVITE has Record-Route header with transport as non-TLS ( TCP or UDP).
Conditions: When a proxy sits between two SIP UAs, and is interworking between the two UA for the transport, this issue can be seen. For Eg: If the Originating UA uses TLS and the Terminating UA uses non-TLS ( TCP or UDP), the proxy forwards the INVITE from the Originating UA to the Terminating UA, with the same Contact header ( having the TLS as the transport). However, the proxy adds the Record-Route header to indicate that the responses/subsequent requests should go via the proxy using non-TLS transport. Here, the Terminating UA is Cisco SIP-TDM Gw.
Workaround: The workaround for this issue is to not send an unsupported transport in the Contact, when the actual transport being used to send the SIP message is a supported one.
Further Problem Description:

H323 - Display shows Fake Display for outgoing calls , Fixed CSCsi69413
Symptom: When calls are made to the PSTN from the Remote CME router, the name "Fake Display" is being shown while the call is being connected. It disappears after connecting the call.
Conditions: This occurs in a QSIG Configuration with a third party PBX and a Local/Remote CME Configuration.
Workaround: None.

MGCP fax T38 inhibit and ecm configured upon reload , Fixed CSCta26864
Symptom: On a Cisco MGCP gateway registered to Cisco Unified Callmanager server, running IOS 124-24T we have enabled T38. But after a reload following command lines are seen in the configuration and all T38 faxes fail: mgcp fax t38 ecm mgcp fax t38 inhibit
Conditions: Specific to MGCP T38 fax. The command "ccm-manager config" needs to be enabled to cause this issue. Debug capture during boot up will show: 000386: Jun 18 21:58:06.588: cmapp_xml_cfg_router: configuring [mgcp fax t38 inhibit]
Workaround: This issue is not seen in Cisco IOS images 124-15T9 and 124-20T3. You can also manually configure this after the reload: mgcp default-package fxr-package (if need be) no mgcp fax t38 inhibit no mgcp fax t38 ecm and then reset the gateway from the Callmanager

Traceback during load run traffic in 2811 for 1 hour , Fixed CSCsq65251
Symptom : Continuous tracebacks and may lead to router halt.
Condition: When we run the calls for longtime( ex. 5 to 10 days)
Workaround : None

c7206VXR/NPE400 reloaded due to bus error running 12.4(15)T2 and T3 , Fixed CSCsm49826
Symptom: H323 gateways crash under load.
Conditions: Multiple H323 calls were made simultaneously.
Workaround: Configuring the following CLI should prevent the crash. c2691-15(config)#voice service voip c2691-15(conf-voi-serv)#h323 c2691-15(conf-serv-h323)#no h245 simultaneous-connection-handle

Device reloaded at voiceport_busyout_swif_comingup , Terminated CSCsy62803
Symptom: Cisco device might crash with a bus error, with a voice related decode. In the crashinfo file, this message is present : *****cm_fallback_create_dns fails for max dn ...
Conditions: There is a "call-manager-fallback" configuration.
Workaround: Try to decrease the number of "max-dn" to a low value under "call-manager-fallback".

CAS wink-start gets stuck in EM_GUARD_ALL_RLS_REQ due to glare condition , Fixed CSCsy74903
Symptom: T1 wink-start channels stop processing incoming and outgoing calls.
Conditions: The show voice call summary show the port in this state: S_SETUP_FAIL EM_GUARD_ALL_RLS_REQ
Workaround: This can be fixed by reloading the gateway, or issuing a shutdown and no shutdown on the voice-port. As well, the channel or circuit selection algorithm can be changed to help minimize glare.

device reloads at removeDollarSign , Fixed CSCtb19260
Symptom: device crashed when all inbound calls ring to an auto attendant.
Conditions: the crash is found at c2800 platform with 12.4(24)T and 12.4(24)T1
Workaround: no workaround at this time.

in-band DTMF leakage of 40-50msec observed when using DTMF relay , Fixed CSCso87127
Symptom: DTMF digits generated after a call connects may experience intermittent double digits which in turn may cause issues when interworking with certain systems like IVR which utilize DTMF for signaling.
Conditions: Double DTMF digits may be experienced in an environment with Cisco IOS VoIP gateways. The issue is that the VoIP gateway with the voice-port detecting the DTMF in conjunction with out-of-band (OOB) DMTF relay may allow a small portion of the DTMF to be sent in-band in the RTP stream. This could then cause the terminating device/gateway to generate the DTMF from the OOB DTMF relay method as well as allowing the in-band DTMF present in the RTP stream through resulting in the possibility of double DTMF digits being detected. This would be present only after a call has connected where DTMF digits may be relayed in an RTP stream. This issue is present on 5510 DSPs on Cisco IOS VoIP gateways running with a release of dspware of 4.4.27 and 9.4.5 and later. The dspware comes bundled with the IOS release. In gateways that support 5510 DSPs, this release can be manually changed independent of the IOS release. To verify the release running on a gateway, confirm the firmware version with the command show voice dsp group all
Workaround: Disable DTMF relay would prevent this problem from occurring. This may cause other problems and would not generally be the recommended action with using codecs other than G711/G722. Downgrade IOS to a release that contains a prior dspware release or work with the TAC to get access and guidance on a possible dspware to load while retaining the IOS release currently in use. This bug is fixed in DSPware 9.4.7, which is packaged in with IOS 12.4(15)T8.

T.37 fax store-forward offramp failures with newer dspware , Fixed CSCsm05555
Symptom: A Cisco IOS VoIP gateway configured for T.37 offramp functionality may exhibit fax failures.
Conditions: Intermittent fax failures (eithre failure to train or transmit data) may occur on a Cisco IOS VoIP gateway configured for T.37 offramp faxing. This appears to have been introduced in later version of DSP firmware and can be seen in firmware version 4.4.25 and 4.4.26. The firmware version can be viewed with show voice dsp group all or show voice dsp. This does not appear to impact either T38 nor T37 onramp faxing.
Workaround: Downgrade the dsp firmware.

router crashes when RTP loop exists in IPIPGW environment , Open CSCtb77593
Symptoms: A Cisco IOS VoIP gateway configured for IPIPGW (CUBE) functionality may crash.
Conditions: A gateway configured for IPIPGW functionality with the command allow-connections under voice service voip under rare conditions will crash while processing VoIP calls. This has been found to occur in some scenarios where a single voip call loops (meaning the call is from the IPIPGW back to the same IPIPGW) through the IPIPGW. When this occurs, the following error message may be noticed: %SYS-6-STACKLOW: Stack for process IP Input running low, 0/12000
Workaround: The workaround is to track down the source of the call looping and correct the problem there. The other possible workaround is to introduce another termination point in the RTP packet flow beside the IPIPGW. For example, if interworking with Cisco Unified Communications Manager (Callmanager) a MTP resource may be used to prevent this loop as long as the MTP resource is not the CUBE gateway.

ccm-manger switchback scheduled-time does not work , Open CSCtc87384
Symptom: ccm-manger switchback scheduled-time does not work
Conditions: using scheduled time switchback method an mgcp router will not switch back from secondary ccm to primary ccm at the scheduled time
Workaround: use one of the othter switchback methods , graceful, immediate etc.

voice channels stuck in S_WAIT_STATS state , Fixed CSCsy01185
Symptoms: Voice channels are hung in a S_WAIT_STATS state: Router#show voice call sum PORT CODEC VAD VTSP STATE VPM STATE ============== ========= === ==================== ====================== ... Se7/0:4:1 g711ulaw n S_WAIT_STATS S_TSP_WAIT_RELEASE Inbound calls on this voice channel fail with a cause of "Resource unavailable, unspecified". This can be seen from the "debug isdn q931" output.
Conditions: Currently unknown.
Workaround: Reload the router.

FXS Port fails to use allocated DSP , Open CSCsw87778
Symptom: Call through fxs port fails with .Nov 18 14:15:20: mbrd_e1t1_vic_connect: setup failed .Nov 18 14:15:20: %FLEXDSPRM-3-TDM_CONNECT: failed to connect voice-port (0/0/3) to dsp_channel(0/0/0)
Conditions: .Nov 18 14:15:20: mbrd_e1t1_vic_connect: setup failed .Nov 18 14:15:20: %FLEXDSPRM-3-TDM_CONNECT: failed to connect voice-port (0/0/3) to dsp_channel(0/0/0)
Workaround: Restart port -->

Memory leak at DSMP DSP REQ c and DSMP EVENT chu , CSCsd18451
Symptom: Memory leak at processes DSMP DSP REQ c & DSMP EVENT chu while running h.323 or mixture of h.323 & sip stress
Conditions: This is observed on both AS5400 and AS5850 platforms
Workaround: No workaround as of now

Memory fragmentation on VXML gateway , Fixed CSCsz00326
Symptom: Memory fragementation, no call accepted, no output for "show run"
Conditions:
Workaround: Reload router.
Further Problem Description:

Un-hide/document sip-ua connection-reuse command , Open CSCtc94886
Symptom: Other SIP endpoints send SIP signaling to the gateway's source port. By default, this is an ephemeral port.
Conditions: This command is used to solve the problem: sip-ua connection-reuse However, this is a hidden command and customers, partners, and other parties that work with SIP gateways are unaware of this capability. Without proper documentation, we are unable to give customers accurate information about the implications of the command. It it widespread enough to justify fully supporting the issue as it is one of the common interoperability problems with the gateway. This can be compared to other products like CUCM which have the opposite behavior, and use the same source and destination port.
Workaround: No other workarounds for the problem, and no other existing documentation for the command.

c2811 hairpinned calls are failing with cause code 47 , Terminated CSCso24123
b>Symptoms after some time from reload gateway starts dropping calls with cause code 47 with debug isdn q931 and debug voice tsp all following errors are seen: CALL_ERROR; Hairpin Attempt Failed Cause Value=47 ISDN Se0/0/0:15 Q931: TX -> RELEASE_COMP pd = 8 callref = 0x0362 Cause i = 0x80AF - Resource unavailable, unspecified
Conditions - voice GW with E1 VWIC card(s) - calls traverse between 2 PRI trunks
Workaround enable 'no local-bypass' on a voice-card to process all calls via DSP voice-card 0 no local-bypass

Traceback seen at hpi_receive_data while making modem call , Fixed CSCsd43489
Symptom: The error message, %SYS-2-BADSHARE: Bad refcount in datagram_done, may be seen in the syslog while making MGCP modem calls. These calls can still successfully connect.
Conditions: The symptom can be seen on a Cisco router running an image with the fix for CSCsc58981.
Workaround: None

H323/H245 - 2nd TCP session not tagged as H323 flow , CSCsu26210
None Symptoms H323 calls are not successful through a NAT box
Conditions A second TCP session not using well-known port is initiated to carry H245 information
Workaround none
Further Problem Description Call setup is terminated successfully but embedded IP in messages of 2nd TCP session are not translated. This prohibits RTP streams to flow properly.

tcp header compression and fair-queue cause corrupted TCP packets , Open CSCtb48397
Symptoms: On an ISR router running 124-25a or 124-24.T, running interface-based TCP header compression (tested with Microsoft Remote Desktop Protocol) on any data link may result in corrupted TCP headers when all of the following are true: 1. Frame-Relay with "frame-relay ip tcp header-compression" or PPP or HDLC with "ip tcp header-compression" 2. The queueing mechanism is fair-queue (either interface based or in map-class frame-relay) 3. >1 TCP sessions are traversing the compressing mechanism 4. The packets are in the hardware (CEF) switching path. With exactly two MS Remote Desktop Protocol TCP sessions, when the UUT's Serial transmit-ring (or frame-relay shaper Bc) congests and the fair-queue invokes, the compressed header from the second-established TCP flow is erroneously written into headers of some packets from the first-established TCP flow, resulting in post-decompression frames erroneously *added* to the first-established TCP flow and erroneously *removed* from the second-established TCP flow, thereby causing a performance degradation.
Conditions: The symptoms may affect 12.4 and 12.4T releases The symptoms have never been seen with 12.3(3a) or 12.2(15)T10
Workarounds: 1. Do not use "frame-relay ip tcp header-compression" 2. Disable hardware switching for all interfaces on ISR with "no ip route-cache". 3. Do not using any form of "fair-queue" on interfaces configured with "frame-relay ip tcp header-compression" ("no frame-relay fair-queue" in the "map-class frame-relay" or "no fair-queue" on physical interface).

Rapid re-invites on H323 - SIP CUBE may cause race condition , Open CSCtd31465
Symptom: An H323 to SIP CUBE may get stuck in a race condition if a reINVITE with delayed media is quickly followed by a reINVITE with early media while still renegotiating the H323 side of the call for the delayed media INVITE. This may lead to one-way or no-way audio.
Conditions: This was seen with the following topology: IP phone---CUCM---H.323 Fast Start---CUBE---SIP---Genesys SIP server---CallCenter Calls are flowing from the IP phone to the CallCenter hanging off the Genesys device. The Genesys device re-INVITEs, rapidly, as calls traverse through its menu / IVR system.
Workaround: None.

%SYS-3-MGDTIMER: Process= DSMP , Fixed CSCsf96908
Symptom: 000128: Sep 5 15:04:25.537 UTC: ASSERTION FAILED : ../voip/ccvtsp/vtsp.c: vtsp_cdb_assert: 1211: unkn 000130: Sep 5 15:04:25.577 UTC: ASSERTION FAILED : ../voip/ccvtsp/vtsp.c: vtsp_cdb_assert: 1211: unkn 000132: Sep 5 15:04:25.577 UTC: %SYS-3-MGDTIMER: Uninitialized timer, timer stop, timer = 46AC5254. -Process= "DSMP", ipl= 0, pid= 224 -Traceback 12:04:25 SPT Tue Sep 5 2006: TLB (load or instruction fetch) exception, CPU signal 10, PC = 0x42CCA970
Conditions: Cisco IOS VoIP gateway experiences an unexpected reload while processing voice calls. This happens when the caller Id is enabled on the FXO port with the voice-port subcommand caller-id alerting dsp-pre-allocate enabled. Also, the reload is seen for a call, when its previous call was terminated even before it could have been established completely.
Workaround:There are two possible workarounds for this problem: 1. Disable the caller-id alerting dsp-pre-allocate command. This will, however, not support caller Id on Old FXO cards where the Caller Id Type is set to Type I ( i.e. caller Id reception before connect). 2. Disable the caller-id enable command. This again will not provide the Caller Id feature, but prevent the router from unexpected reloads.

AS5400 show memory leak for DSMP , VTSP and MGCP processes , Fixed CSCsy73981
Symptoms: Cisco AS5400 shows memory leak for DSMP, VTSP, and MGCP processes. Occurs about once a month.
Conditions: After some time, the memory leak symptoms are seen on the gateway, although normal operations are not affected. Eventually all memory is consumed, and the gateway hangs. Only a manual reboot can bring it back to service.
Workaround: There is no workaround.

When phone is onhook, media shouldn't be handled , Fixed CSCsv84605
Symptom Customer is reporting port hang. The symptom is that when the port is blocked, the underlying low layer (VPM, VTSP) is already in clean IDLE state, but STCAPP keeps itself in the REM_ONHOOK_PEND -> CONNECTING -> ACTIVE_PENDING -> ONHOOK_PEND -> REM_ONHOOK_PEND loop.
Conditions Customer (PEMEX) is using STCAPP for its analog phones through CCM control. CCM is 6.1.1. STCAPP version is 12.4(20)YA1. The fix will go into 12.4(22)T.
Workaround There is no workaround. Root cause analysis: In the STCAPP code, when the phone is already onhook'ed, the media should not be handled. But when in Taven stage, in order to handle a very corner case, the door was open. In the ONHOOK_DISCONNECT state, we handle the ORC and SMT (media event) from CCM. The case in PEMEX is like this. When a phone finishes dialing digits, and waiting for the remote side to answer, it hears the alerting tone. Now he wants to hang up for he waits for too long. But, at exactly the same time he hangs up, the remote side goes offhook to answer the call. The window is so tiny that it's very hard to repro in the lab. So when this happens, the CCM receives the remote answer immediately (almost no time difference!) after the local side goes onhook. Hence, CCM will not terminate the media immediately. Instead, CCM will first go ahead to establish the media, and then destroy it immediately after the media is created. At the local side, since it is already hung up, it is in the ONHOOK_DISCONNECT state. If we do not handle media after local onhook, then the ORC and SMT will not be handled. But since the door was open, we handle it, and the local side goes to ACTIVE state. Then the CCM immediately destroys the media, and makes the local side transit its state to REM_ONHOOK_PEND. Since the local side is already onhook'ed, it will never receives the local onhook event. And the current code base will do the cleaning of the lower layers (VPM and VTSP) in this situation. Therefore, the lower layers are clean, but the STCAPP keeps itself in this loop. Fix and unit test: The best solution to this issue is to "close" the door. Now, the handler of the media when the local side is ONHOOK_DISCONNECT is removed. It is so hard to repro this case in the lab. I tried so many times (around 50) just to repro it once. And the fix works.
Further Problem Description

%SYS-6-STACKLOW: Stack for process MGCP Application running low , Fixed CSCsz29320
Symptoms: A Cisco 3845 running Cisco IOS Release 12.4.(20)T2 reloaded due to software-forced crash while experiencing the following error: %SYS-6-STACKLOW: Stack for process MGCP Application running low, 0/12000 %Software-forced reload
Conditions: The crash suggests that the issue is just one of inefficient stack usage.
Workaround: There is no workaround.

%SIP-3-BADPAIR seen on egress gateways. , Open CSCso37968
Symptom: The following messages are seen on the egress gateways %SIP-3-BADPAIR: Unexpected timer 19 (SIP_TIMER_NOTIFY_RECEIVE_DIGIT) in state 9 (STATE_DISCONNECTING) substate 0 (SUBSTATE_NONE) %SYS-3-TIMERNEG: Cannot start timer
Conditions: Occurs when DTMF sip-notify is negotiating, when the other end is in disconnecting state.
Workaround: No workaround

UC500 reloads with call accouting enabled , Open CSCtd04654
Symptom: After customer enabled call accounting on a UC500, the box kept reloading.
Conditions: The error is observed at UC500 with uc500-advipservicesk9-mz.124-22.YB4
Workaround: Disable call accounting feature on the box.

VG224 SCCP port plays reorder before CM routes call-IOS interdigit timer , Fixed CSCsm49011
Symptom: On an FXS port configured for SCCP usage (such as on a VG224), reorder is heard 10 seconds after the last digit dialed when a number is dialed that requires waiting for interdigit timeout on CallManager.
Conditions: Using SCCP controlled FXS port on an IOS box. Dialing a number which requires waiting for interdigit timeout to route (such as a variable length international number).
Workaround: Increase the interdigit timeout setting on each SCCP FXS port to 16 secs (to be greater than CallManager's 15 secs). This is done by configuring "timeouts interdigit 16" under each voice port. OR decrease the CallManager interdigit timeout to 9 seconds (to be less than the VG224 port's 10 secs). This is done by changing the CallManager service parameter T302 Timer value to 9000 msec (9 seconds). If this workaround is chosen the new interdigit timeout setting will apply to all devices attached to the CallManager, not just the IOS SCCP FXS ports.
Further Problem Description: When this problem manifests, the user hears reorder tone 10 seconds after dialing the last digit. 15 seconds after the last digit is dialed (5 secs after beginning to hear reorder), reorder will stop and the call will route, resulting in ringback tone. The reorder tone is a "cosmetic" problem, but will lead most users to (incorrectly) believe there is an actual problem with their call.

Memory corruption while ending a call , Fixed CSCsb72082
Symptoms: A router crashes when a call from the PSTN to a SIP gateway is disconnected.
Conditions: This symptom is observed when the Record-Route header in any message that is received by the gateway is more than 128 bytes long.
Workaround: Reduce the length of the Record-Route header to less than 128 bytes.

Address Error (load or instruction fetch) exception NAT Skinny , CSCsv13099
Symptom: A Cisco router may experience a crash when it receives what is appearing to be a Skinny packet and NAT attempts to process the packet. Address Error (load or instruction fetch) exception, CPU signal 10, PC = 0xXXXXXXXX
Conditions: This has been experienced on multiple IOS platforms running IOS release 12.4(22)T.
Workaround: The workaround is to configure "no ip nat service skinny tcp port 2000".

E1R2 Stuck in up/up state even after call is released , Fixed CSCsd32575
Symptom: E1R2 ports are not being release properly by the router. after the call is disconnects its remaining in an up/up state blocking furture outbound/inbound traffic
Conditions: This is only seen in 12.4 IOS and when the disconnect is Initiated from the router. If the disconnect is initiated from the pbx, this problem is not seen.
Workaround: downgrade to 123(11)T or 123(8)T

Gateway sends g729 rtp packet when OLC said g711 afte empty TCS is recv. , Fixed CSCsb44513
Symptom: Router may send g.729 rtp packet when it send a TCS with g711.
Conditions: After a router get a closed logical channel from the remote end, and a open logical channel to use a new OLC, and a empty terminal capabilites, the router will send an ack for the terminal capabilities acknwolenging the use of g711, but will send g9 @27 packet.
Workaround: Use 12.3 image.

memory corruption in ISDN - display_info shared between isdn and cdapi , Fixed CSCsh94865
Router configured with a voice gateway might crash due to memory corruption in IOS version earlier than 12.4(12).
Workaround: none.

UC520, C880, VG202, VG204, IAD2435-8FXS and C1861 routers vulnerability , Fixed CSCsv62323
Symptoms: The Fast Ethernet driver code may cause several errors. The observed symptoms of this issue include: - Cisco Unified Communications 500 series routers (UC520) may crash with an "Unexpected exception to CPU" error. - Cisco 1861 router may fail to establish L2TPv3 session with an error message: "%L2TP-3-ILLEGAL: _____:________: ERROR: unsupported transport protocol; defaulting to UDP if possible"
Conditions: The symptoms are observed with the following hardware platforms: UC520, Cisco 880 series, Cisco VG202, Cisco VG204, IAD2435-8FXS and Cisco 1861 routers. In addition, the following conditions exist: - The UC520 must be configured with a BVI interface. For example: interface BVI1 ip address 192.168.0.1 255.255.255.0 - The Cisco 1861 router is configured with L2TPv3. For example: pseudowire-class l2tpv3 encapsulation l2tpv3 ip local interface Loopback0 ! interface Loopback0 ip address 192.168.10.1 255.255.255.255 ! interface FastEthernet0 no ip address xconnect 192.168.0.1 1 pw-class l2tpv3
Workaround: There is no workaround.
Further Problem Description: The issue is caused by an underlying driver vulnerability that exists in the UC520, Cisco 880 series, Cisco VG202, Cisco VG204, IAD2435-8FXS and Cisco 1861 routers. No other model of Cisco routers/switches are known to be affected by this issue. The symptoms can be triggered with specific TCP sequences.

Router may crash when shutting down ISDN interface with live traffic , Fixed CSCsh75479
Symptoms: A platform that is configured for ISDN may crash because of a bus error when you shut down an ISDN interface.
Conditions: This symptom is observed on a Cisco platform when traffic is being processed on the interface while you shut down the interface.
Workaround: There is no workaround.

sip rpid shows the post-translated number when using translation profile , Fixed CSCtb39512
Symptom: An IOS SIP gateway that has an inbound voice translation-rule configured on the inbound VOIP dial-peer will populate the Remote-Party-ID (RPID) header in the 183 / 200 OK headers with the post-translation number. Depending on the SIP end that placed the call, it may display this updated number which can confuse end users.
Conditions: This happens only when there is a voice translation-profile attached to the inbound voip dial-peer that translates the called number.
Workaround: On IOS version 12.4(15)T or earlier: Use an outbound voice translation-profile on the outgoing dial-peer to translate the called number back to the original value. On IOS version 12.4(20)T or later: Use a voice class sip profile to modify the Remote-Party-ID header back to the expected value.

AMR dspware build 9.4.811 leads to DSP crash , Open CSCtd29395
Symptom: Cisco IOS VoIP gateway may experience call drops and no audio intermittently. Call disconnects or failures due to the following errors
Conditions: A Cisco IOS VoIP gateway may experience loss of audio and dropped calls intermittently while process voice calls. This occurs when the DSP used in the call fails to respond. When this occurs, the below error messages may be seen. This particular issue documented in this bug ID is impacted only in DSP release 9.4.811 as seen in show voice dsp group all Sep 7 02:09:14.171 PDT: %C5510-1-C5510_CHPI_ERROR: cHPI error for pa_bay 1 pump 1 dsp 9. Sep 7 02:09:15.555 PDT: %C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available on slot 1 dsp 9. Sep 7 02:09:20.555 PDT: %C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available on slot 1 dsp 9.
Workaround: Downgrade either IOS to a release prior to 12.4(15)T10 or load another version of dspware by working with the TAC as documented in the CCO reference below. http://www.cisco.com/en/US/tech/tk652/tk698/technologies_tech_note09186a0080a7af82.shtml

alignment trace in bgp code in a vrf environment , Fixed CSCso76178
Symptom: Alignment is seen when a VRF call is being made.
Conditions: This is shown for every voice call made under VRF environment
Workaround: none, the problem is fixed.
Further Problem Description:

outbound calls fail periodically with disconnect cause=47 , Terminated CSCsd41721
Symptom: Outbound calls fail periodically with disconnect cause=47
Conditions: This call failure happens only for the outbound calls.
Workaround: After rebooting the problem will not be seen for two days.

Memory leak by process 'MGCPAPP timer' , CSCsx80054
Symptom: A router will experience a memory leak in the MGCP Application process. at function mgcpapp_stw_get_timer_event in a 3825
Conditions: Leak is seen on 3845 on running IOS c3825-spservicesk9-mz.124-21
Workaround: None

7200 crash after entering "show isdn history" command , Fixed CSCtb29256
Symptoms: A router crashes after entering the sh isdn history command.
Conditions: This issue is seen in a Cisco 7206VXR (NPE-G2) that is running Cisco IOS Release 12.4(15)T9.
Workaround: Avoid using the sh isdn history command and use the sh isdn active command.

Gateway responds for the CRCX with 510-Wrong state , Fixed CSCef89505
Symptom: Some of the MGCP doesn't work since open_service is called for the 5xxx platform. We need open_service and start_service for all the cases. Work around: None.

V.21 Fax Tone is not detected if the signal level is less than -22 db , Fixed CSCso69794
Symptom: 5510 DSP may not detect V.21 fax tone if the signal level is less the -22 db.
Conditions: This happens only when signal levels are less than -22db. Work-around: Use "input gain" to amplify the signal so that signal level is >= -22 db. (Note that this workaround may affect voice call via POTS port configure "input gain")

FXO ports locking up , Terminated CSCtb90496
Issue: FXO ports intermittently locks up in FXOLS_REMOTE_RELEASE VPM STATE which are MGCP controlled. This causes incoming and outgoing calls to fail. Work Around: The only way to recover them is by doing a shut / no shut. Version: 12.4(15)T7

warm-tranfer related mid call reinvite on IVR leg need to be supported , Fixed CSCsm12716
Symptom: Call drops on warm transfer with queuing
Conditions: If the agent completes the transfer to caller while still in queue, it causes the mid call media change for the voice browser on the VXML gateway, which is not currently supported. Any call flow that encounters the double reinvite sequence to the gateway will encounter this problem. The above example is just one scenario where this occurs. The double reinvite sequence is the media break reinvite SDP inactive followed by the delayed media reinvite.
Workaround: You can mitigate MTP usage by setting the CVP/CUPS SIP Trunk with MTP **unchecked**. Create a second SIP Trunk with MTP checked to the same CVP/CUPS destination, then put the VRU label route pattern on this MTP trunk. This will allow you to only use MTP allocation on the warm transfers with queueing. All the inbound calls will avoid MTP allocation. When a warm transfer with no queuing (ie no vru label + corr id) is performed, there will be no second call from the trunk to CVP. There will only be the SIP reinvite to the caller on the transfer completion. The MTP outbound call is only made when EAPIM VRU label is routed out the trunk to CVP, ie the outbound call. Lastly, it is necessary to create an alternate SIP Trunk Security Profile, apart from the default one "non secure sip security profile". Use all the same settings as the default one, but change the Listen Port to something else, like 5065. Now on the second trunk that has the MTP, apply this security profile, and reset both SIP Trunks. The reason for this is because you cannot create 2 duplicate sip trunks in CUCM with the same host/ip and listen port. Again, you are never using this trunk for inbound calls, so you never need to make a static route from CUPS/CVP to port 5065 for example. Just use 5060 that is associated on the other non-MTP trunk. Also, if you are going to have other DNs for the IP originated callers, not the warm transfer with queuing calls, then use the non-MTP trunk on that route pattern. IOS-based Hardware MTP should be used over CUCM Software MTP for performance considerations.
Further Problem Description:

MGCP media bind is associated but not working , Fixed CSCsd15968
Symptoms: MGCP seems to be sourcing media from a different interface than what is configured under the mgcp bind media source- interface interface-id command.
Conditions: This symptom has been observed when using a Cisco IOS MGCP gateway going to any MGCP call agent and the MGCP traffic bound to an interface that is using the ip address negotiated command - meaning the IP address is learned dynamically via IPCP / BOOTP.
Workaround: Bind the MGCP traffic to an interface that has a static IP address defined on it.

disconnect_done and setup_ind in wrong order causes STCAPP port hang , Fixed CSCsw70566
Symptoms: User is experiencing port block when using STCAPP. Behavior is that when going offhook, no dialtone can be heard. Only performing a shut/no shut on the voice port can bring it back to IDLE and get the dialtone.
Conditions: Customer is using CUCM and VG224 gateway to connect to analog phones. Skinny is the control protocol.
Workaround: There is no workaround. Root Cause Analysis: Before PI9, the VPM layer will never send the disconnect confirmation and the setup_ind at the same time (or within 4 milliseconds). But after PI9, a ddts fix CSCsq97697 changed the behavior. In the case when the user goes onhook. Then, immediately after the hookflash duration is passed, he offhook the phone. Before PI9, this behavior will cause the new call's setup be postponed until the next time the user goes onhook. But now, the setup_ind of the new call will be immediately sent right after the previous call's disconnect confirmation. So, when messages traversed to VTSP layer, because of the nature of the DSMP dsp process, the disconnect_done event has more chance to come later than the new call's setup_ind. In STCAPP, our design is based on the behavior of the time when it was developed (PI2). So we do not handle that sequence. But now, since this is the behavior, we will have to handle that case when disconnect_done comes after the new call's setup_ind. Fix and Unit Test: The fix is to enhance the disconnect_done handler to make it more robust and more fault tolerant to accommodate this situation. Unit test is done and the results are passed.

SIP-3-BADPAIR register timer expiry causes slow memory leak , Fixed CSCse56800
Multiple vulnerabilities exist in the Session Initiation Protocol (SIP) implementation in Cisco IOS that can be exploited remotely to trigger a memory leak or to cause a reload of the IOS device. Cisco has released free software updates that address these vulnerabilities. Fixed Cisco IOS software listed in the Software Versions and Fixes section contains fixes for all vulnerabilities addressed in this advisory. There are no workarounds available to mitigate the effects of any of the vulnerabilities apart from disabling the protocol or feature itself, if administrators do not require the Cisco IOS device to provide voice over IP services. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml

CUBE drops rtp-nte DTMF cap in 183 and 200ok , Open CSCtc82324
Symptom: CUBE drop 101 telephone-event from SDP in the 183 and 200ok call flow is SP--SIP---CUBE--SIP---CUCM---VM here is 183 from cucm m=audio 29116 RTP/AVP 18 101 a=rtpmap:18 G729/8000 a=ptime:20 a=fmtp:18 annexb=no a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 here is 183 from cube to SP m=audio 16438 RTP/AVP 18 c=IN IP4 6.3.0.71 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=ptime:20 a=silenceSupp:off - - - - same for 200ok
Conditions: if cucm reply 180 , 200ok without 183. CUBE will not drop 101.
Workaround:
Further Problem Description:

ipipgw crash %SYS-2-FREEFREE at ccsip_update_srtp_caps , Open CSCtb25563
Symptom: IPIPGW crash with : %SYS-2-FREEFREE: Attempted to free unassigned memory
Conditions: N/A.
Workaround: N/A.
Further Problem Description: N/A.

Watchdog timeout and cpuhogs while generating isdn l2 traps , Terminated CSCek50966
Symptoms: A router running Cisco IOS Release 12.4(7a) IOS release and having ISDN ports active may unexpectedly crash because of a Software Forced Crash triggered by a watchdog timer expiring. The log is showing tracebacks due to cpuhogs.
Conditions: The events are triggered by SNMP trap generation which refers to ISDN switch type 12.
Workaround: Disable the snmp isdn l2 traps command to avoid the crash.

c3845 reports %C5510-1-NO_RING_DESCRIPTORS errors under load , CSCtd23629
c3845 reports %C5510-1-NO_RING_DESCRIPTORS errors under load Symtoms: c3845 reports %C5510-1-NO_RING_DESCRIPTORS errors under load when amount of simultaneous calls reach 180.
Conditions: problem wes reproduced in the lab, the erros intermittents and can be seen with as little as 60 calls on 3845 with 7 E1 PRi trunks. Call agre generated from CallGen. Call rate is no higher then 1 per second.
Workaround: no workaround.

%C5510-1-C5510_CHPI_ERROR:cHPI error for pa_bay 0 pump 0 dsp 2 , CSCsr45957
Symptom: no ring descriptor caused FXO ports to administratively shut down C5510 001 01 {flex} 4.4.21 alloc idle 000145: Jul 1 09:33:29.093 EDT: %C5510-1-C5510_HPI_TIMEOUT: HPI Timeout error for pa_bay 0 pump 0 dsp 2. 000146: Jul 1 09:33:29.093 EDT: %C5510-1-C5510_CHPI_ERROR: cHPI error for pa_bay 0 pump 0 dsp 2. 000147: Jul 1 09:33:31.637 EDT: %C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available on sl ot 0 dsp 2. 000148: Jul 1 09:33:36.637 EDT: %C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available on sl ot 0 dsp 2. 000149: Jul 1 09:33:41.637 EDT: %C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available on sl ot 0 dsp 2. 000150: Jul 1 09:33:46.637 EDT: %C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available on sl ot 0 dsp 2. 000155: Jul 1 09:33:49.698 EDT: %DSPRM-5-UPDOWN: DSP 2 in slot 0, changed state to up 000156: Jul 1 12:10:24.484 EDT: %C5510-1-C5510_HPI_TIMEOUT: HPI Timeout error for pa_bay 0 pump 0 dsp 2. 000157: Jul 1 12:10:24.488 EDT: %C5510-1-C5510_CHPI_ERROR: cHPI error for pa_bay 0 pump 0 dsp 2. 000158: Jul 1 12:10:27.040 EDT: %C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available on sl ot 0 dsp 2.
Conditions: This behaviour has been observed on a Cisco IOS voice gateway with C5510 DSPs, c2800nm-advipservicesk9-mz.124-12.bin Configured as H323 with VIC2-4FXO voice and running IOS 12.4(12) with DSPware 4.4.21. Other IOS releases and DSPware may be affected as well
Workaround: There is no known workaround at this point. PVDM2-64 have been replaced but that did not help.

Memory Corruption Crash @ AFW_SS_FreeTransferSetupInfo() , Fixed CSCse72458
CME may unexpectedly reload due to Memory Corruption,just before the crash the process AFW_application_process is hogging CPU Topology: Agents-----------CME---------SIP Phones Few SIP phones and SCCP agents dial to CME, after few seconds CME crashes.

Voice Gateway may leak memory for DSMP EVENT chu and DSMP DSP REQ chunk , Fixed CSCsw23397
Symptoms: A Cisco Router acting as a voice Gateway may leak memory for DSMP DSP REQ chunk and DSMP DSP REQ chunk
Conditions: The symptom appears to be triggered by calls that disconnect prematurely.
Workaround: There is no workaround.

TCP port information for backhaul link is not set , Fixed CSCsg12116
Symptom: A 3845 router running 12.4(9)T may encounter a bus error.
Conditions: The device must be running 12.4(9)T code.
Workaround: None known at this time

ISDN type/plan is not sent: ISDN->H323 overlap if Called num is empty , Fixed CSCsd66687
Symptoms: 2611xm does not pass ISDN type and ISDN from ISDN to H323.
Conditions: the problem can bee seen for every call then GW get SETUP message in overlap mode with empty Called number - without any digits. And all the number is received in INFO messages. Although all info messages do have type and plan in them.
Workaround: use voice translation rules to assign Type and plan for voip calls.

%SCHED-3-THRASHING: Process thrashing on watched queue 'swmtpmsp_app' , Fixed CSCsv16281
Symptom: Frequent tracebacks seen in the log *Sep 12 12:28:49.515: %SCHED-3-THRASHING: Process thrashing on watched queue 'swmtpmsp_app'. -Process= "swmtp_msp", ipl= 4, pid= 191 -Traceback= 0x61112CC0 0x61F29094 0x61F29178 0x60C30EE4 0x61F183F8 0x61F183DC
Conditions: All times, frequency, about 2-3 times a day.
Workaround: none
Further Problem Description: No visible failures/issues seen on the GW, but we need to try and see what is generating these tracebacks.

cptone KR mapping for RING_BACK has wrong cadence , Fixed CSCsy34088
Symptom: KR CP tone mapping for RING_BACK has wrong cadence as below. SIP-CISCO-11#test voice tone KR show Code: KR Country: Korea Republic DTMF freq.(Hz) Row / col: 697, 770, 852, 941 / 1209, 1336, 1477, 1633 Pulse dial: normal, Percent make: 35%, DTMF low Amp. = 65424, high Amp. = 65446, Pcm: u-Law Tone NF FOF FOS AOF_FXS AOF_FXO AOF_EM AOS_FXS AOS_FXO AOS_EM ONTF OFTF ONTS OFTS ONTT OFTT ONT4 OFT4 BUSY 2 480 620 -200 -200 -240 -240 -240 -240 500 500 0 0 0 0 0 0 RING_BACK 2 440 480 -190 -190 -190 -190 -190 -190 1000 4000 0 0 0 0 0 0
Conditions: N/A
Workaround: Define the following in EXEC CLI mode: "test voice tone KR RING_BACK 2 440 480 -190 -190 -190 -190 -190 -190 1000 2000 0 0 0 0 0 0" You will basically use the "test voice tone" command to overwrite the current RINGBACK definition for "cptone KR", and then you can use the EEM feature to make sure the setting persists after a reload.

TDM network clock does NOT come back to GOOD after controller comes up. , Fixed CSCsj08617
Symptoms: E1 interface that is used for providing TDM network clock sometimes gets stuck in SHUTDOWN state after a controller failure, even after the controller is up and functioning.
Conditions: Occurs when E1s are used for T-CCS to connect together two PBX circuits across a WAN. The problem is intermittent. Sometimes the TDM clock is able to recover, but other times the network clock state from the show network-clocks command shows SHUTDOWN for an E1 controller that is up and working. The following shows the output when this happens: router#show network Network Clock Configuration --------------------------- Priority Clock Source Clock State Clock Type 1 E1 2/0/0 SHUTDOWN E1 2 E1 2/0/1 GOOD E1 3 E1 2/0 SHUTDOWN E1 4 E1 1/0 GOOD E1 5 E1 1/1 GOOD E1 11 Backplane GOOD PLL Current Primary Clock Source --------------------------- Priority Clock Source Clock State Clock Type 2 E1 2/0/1 GOOD E1 E1 2/0/0 is up. Applique type is Channelized E1 - balanced Description: No alarms detected. alarm-trigger is set to Blue Alarm is not triggered Version info Firmware: 20060711, FPGA: 13, spm_count = 0 Framing is NO-CRC4, Line Code is HDB3, Clock Source is Line. Current port master clock:recovered from backplane Data in current interval (792 seconds elapsed): 0 Line Code Violations, 0 Path Code Violations 0 Slip Secs, 0 Fr Loss Secs, 0 Line Err Secs, 0 Degraded Mins 0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 0 Unavail Secs
Workaround: Remove then reapply the network-clock-select command for the TDM clock in SHUTDOWN state. Use the following commands: config t no network-clock-select X E1 x/y network-clock-select X E1 x/y

Chunk leak in SNMP engine . , Fixed CSCsj23240
Description: A router may experience a memory leak in the process SNMP ENGINE. The cause of the leak is ISDN, but the process holding the memory is SNMP. Symptoms: When looking at the output from show process memory, each time the command is run the process SNMP ENGINE will increase the amount of memory being held.
Conditions: This occurs when the router is configured for ISDN and SNMP.
Workaround: None known

DTMF Digits not properly detected , Fixed CSCso92891
Symptom: DSPs improperly detect DTMF Digits that contain leakage.
Conditions: Using DSPware 9.4.3 or later on 5510 DSPs. Leakages of 18msec either are not detected or are detected as duplicate digits.
Workaround: Problem does not exist in the 4.4.x dspware. Use an IOS Version that contains this train of DSPware.

IOS doesn't send the required T.38 parameters when using SIP , Open CSCtc79831
Symptom: An IOS SIP gateway using T.38 may fail to return the required SDP parameters as outlined in Annex D of the T.38 specification. IOS may omit these required parameters: T38FaxVersion T38FaxRateManagement Also, it may fail to respond with "T38FaxUdpEC" even if T.38 redundancy is enabled. If the remote T.38 capabilities in the SIP offer match the local T.38 capabilities, the SIP answer to the offer is observed as: m=image udptl t38
Conditions: This occurs on IOS SIP gateways when the offered T.38 capabilities match the local T.38 capabilities.
Workaround: None.

H320 one-way video when H.239 enabled on endpoint , Fixed CSCta11416
Symptom: Video endpoint -[h323]- H320 GW -[ISDN]- Video Endpoint A call through a H.320 gateway results to two-way audio and one-way video.
Conditions: This is seen when the H.239 capability is enabled on the Video endpoint.
Workaround: Disable H.239 capability.

C2801: no audio on VoIP calls - C5510-1-NO_RING_DESCRIPTORS error logged , Fixed CSCsr56105
Symptoms: A Cisco IOS VoIP gateway may experience audio issues such as dead- air or one-way audio for VoIP call present on the gateway. When this occurs, the following error message will be displayed on the gateway: %C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available
Conditions: The symptom is observed on a Cisco 2801 VoIP gateway that is running Cisco IOS Release 12.4(20)T or Release 12.4(15)XZ1.
Workaround: There is no known workaround to prevent this issue while using Cisco IOS Release 12.4(20)T or 12.4(15)XZ1 while using the Cisco 2801 router. Use an earlier release to avoid this issue.

show isdn active displays disconnected calls , Fixed CSCsg75978
Symptom: After a call is disconnected, it remains in output of "show isdn active" command. This is a cosmetic issue and there is no service impact.
Workaround: There is no workaround for this issue. Even if "clear interface" or "shutdown/no shutdown" command is issued for the affected BRI interface, the symptom does not go away. Rebooting the router resolves the symptom.

unnecessary tcp ports opened in default router config , Fixed CSCsb25337
Cisco devices running IOS which support voice and are not configured for Session Initiated Protocol (SIP) are vulnerable to a crash under yet to be determined conditions, but isolated to traffic destined to User Datagram Protocol (UDP) 5060. SIP is enabled by default on all Advanced images which support voice and do not contain the fix for CSCsb25337. Devices which are properly configured for SIP processing are not vulnerable to this issue.
Workarounds exist to mitigate the effects of this problem. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070131-sip.shtml

IOS crashes on CPU hog when mini-logger enabled , Fixed CSCta31622
Symptom: gateway automatically reloads when minilogger is enabled and DSP crash occurs
Conditions: #voice dsp crash-dump destination tftp://10.2.3.4/dspcrashfile.xyz #voice dsp crash-dump file-limit 2 #voice dsp 0 command history buffer periodic 13600 #voice dsp 0 command history buffer control 13600 #voice dsp 0 command history max-logger-print 1000 #voice dsp 0 command history enable
Workaround: none

Inbound SIP calls generating mid-call reINVITES , Open CSCtd03892
Symptom: Inbound SIP calls generating mid-call reINVITES, causing high load
Conditions: Simple inbound call SP --(SIP)--> C2851 --(H323)--> CUCM --> IP Phone CUCM 7.1.2.20000-2 Tried IOS 12.4(24)T1 and 12.4(22)T3
Workaround: None
Further Problem Description: n/a

MGCP gateway requires CLI to disable es-cci capability on LI images , CSCsv79819
Symptom: MGCP gateways on lawful intercept images (ivs_li) fail to register with CUCM.
Conditions: In the 200 response to CUCM's AUEP, the es-cci capability is advertised. In CUCM there is a parse error, and the communication fails. The gateway sends RSIPs and the process repeats.
Workaround: Change the IOS image to a non Lawful Intercept image.

3845 memory leak at managed_chunk_process , Fixed CSCsw39041
Symptom: 3845 gets Memory leak on DSMP DSP REQ Chunk Manager, and finally lead to crash since short of memory.
Condition: Seen only on versions having the fix of CSCsj32246. The chunk leak happens only for DSMP DSP REQ c and not for DSMP EVENT chunk. Also, it happens under error scenarios for stress calls. It is mostly seen when transcoding calls are present in the system.
Workaround: None.

echo on incoming calls after upgrade to 12.4(15)T9 , Fixed CSCta25152
Symptom: After IOS upgrade to 12.4(15)T9 echo started to appear on incoming calls from PSTN to IP phones at customers' branches. Only IP phone hears the echo, the PSTN end is OK.
Conditions: DSPWARE used is 9.4.809. There were no issues prior to upgrade while running 124-15.T7.
Workaround: None.
Further Problem Description:

C5510 dsp transcoding causes garbled audio , Fixed CSCeg87592
Symptoms: Garbled audio may be heard when a c5510 is used to transcode audio
Conditions: This symptom is observed on a platform that is configured with a module that uses a 5510 DSP such as an NM-HDV2 network module. When remote IP phone users dial into the CCC (which supports only the G.711 codec), the transcoder is invoked because of a capability mismatch. The 5510 DSP intermittently generates garbled audio when it attempts to transcode the initial announcement that is played from the CCC. This is observed with CCC, IPCC Express, and Unity.
Workaround: Configure the G.711 codec across the WAN. Alternate Workaround: Configure the platform with a module that uses a 549 DSP as a transcoding resource.

Dsp crsh seen with VIC2-2FXS= on soporno , CSCsx39697
Symptom: Dsp crash seen with 2FXS on Soporno
Conditions: Dsp crash seen with 2FXS on Soporno on 3845 router.
Workaround: Not known

AS5400XM having random issue on bear channels not being fully used , Open CSCtd17884
Symptom ============= Customer is having random occurrences of bear channels or CICs not being fully used on an AS5400XM router, when they show that they are free.
Conditions ============= Customer is using the following topology: (VoIP Network)---->SBC---->H.323---->AS5400XM---->ISDN----.PGW(Nailed mode)---->SS7---->(PSTN Network) With the following versions. - AS5400Xm running "c5400-jk9su2_ivs-mz.124-15.T9.bin" image - PGW version 9.7(3) with S26P26
Workaround ============= There is no workaround available at the moment. Sometimes the issue is solved when reloading the GW and other times has cleared by itself.
Further Problem Description ======================== Please consider the following facts from latest occurence of the problem: - Last occurrence of the issue happened on AS5400Xm named "INLKO-MGW-I"; which the following information is attached when the issue was happening: sh tech-support sh logging sh processes cpu history sh isdn status sh isdn service sh isdn service detail sh isdn active sh isdn history sh isdn nfas group 0 sh isdn nfas group 1 sh isdn nfas group 2 sh rlm group sh rlm group status debug isdn standard debug isdn q931 debug isdn q931 asn1 debug isdn event detail debug isdn tgrm debug isdn cc detail debug rlm group debug rlm group 0 event debug rlm group 1 event - After checked all disconnects sent/received contained in the debug output collected, we were able to elaborate table; after that we noticed that there is no unique pattern of the failed calls, which makes it harder to figure out the real reason behind the failure; however the calls being disconnected with "Cause i = 0x8090 - Normal call clearing" as user generated information, have been the highest amount among them; and as customer mentioned, they have seen lots of calls being released using this cause code when the problem happens. - This is the first time that we have been able to collect some complete debug output when the problem has been happening. In there, we have noticed several calls (like the ones with callref = 0x2E50, 0x2E52 and callref = 0x2E53) on which the AS5400XM released the call with Cause Code 16 in few milliseconds, which seems to be not normal. - In addition, there has been a small amount of calls with "Cause i = 0x80AF - Resource unavailable, unspecified"; please see callref = 0x2E7E and callref = 0x2EE5 for an example; on which we sent out the SETUP message, and in less than 100ms we sent out the DISCONNECT message; which seems to be a bit strange as well. - I have also seen on other occurrences of the problem, that the AS5400XM was having on the logging buffer messages like the following: %C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available on slot dsp

Upon recieving reinvite CUBE copies the remote-party-ip , Terminated CSCtd09007
Symptom: Call transfer using sip trunk results in calling number matching called number
Conditions: Transfer involving a reinvite to CUBE running sip
Workaround: Refer instead of reinvite
Further Problem Description:

"codec sub-sample" unavailable on 5510 based AS5x00xm platforms , Open CSCtc87888
Symptom: The "codec sub-sample" command is not available on AS5xx0XM platforms using 5510 DSPs.
Conditions: This is seen only on AS5xx0XM platforms using 5510 DSPs.
Workaround: None.

B-channel Interface down but receives traffic , Fixed CSCse98767
B>Symptom: With continuous traffic flowing do a "shutdown" of the controller (PRI - T1) on both routers, once all the counters of all B-channels are reset to "0" then do "no shutdown" on the controller of both the routers. One of the B-channel remains DOWN but still receives input traffic.
Conditions: This occurs only when controller (PRI) is shutdown and no shutdown.
Workaround: No workaround.

mgcp rtrcac & mgcp voice-quality-stat cause problem with CCM , Fixed CSCeh19711

when 'mgcp rtrcac' and 'mgcp voice-quality-stat" is configured on a MGCP gateway for CCM environment, it causes different symptom. Some time calls can not be completed, sometimes more than 4 incoming calls causes to reset the controller. These commands only for PGW. And there is no warning message while configuring these commands for CCM.

Memory leak in ivr and AFW_application_process , Terminated CSCta31147

Symptom: Slow memory leak in CCSIP_SPI_CONTRO while running 12.4(20)T3 using TCL and e-phone
Conditions: Leak occurs in normal operation.
Workaround: None known

Memory Leak in AFW application , Open CSCtc94040

Symptom: Memery leak in the router.memory is decreasing day by day.
Conditions: Cu upgraded the ios to 12.4(15)T9 because of was hitting the bug CSCso12749.Now cu has memory leak in AFW application.
Workaround: Relaod the router.

Fax T.38 fails on H323-SIP calls due to ack timeouts on SIP side , Fixed CSCsx32061

Symptoms: The fax T38 call setup on an H323-SIP leg fails due to incorrect 200 OK message generation on the SIP side. This causes ACK timeouts on the SIP side.
Conditions: The symptom is observed after a midcall reinvite for T38. The SIP leg responds with a 100 trying and a 200 OK right away without waiting for H323 negotiation to complete.
Workaround: Using SIP-SIP instead of H323-SIP.

CUBE doesnt pass ptime transparently in SIP to h323 call flows , Open CSCtc73851

Problem description-CUBE doesnt pass ptime in codec transparent transparently.Cube defaults to 20 msec
Workaround none

Fix for CSCsv36769 not integrated in 12.4(22)T1 and 12.4(22)YB4 IOS , Fixed CSCtc76889

Symptom: CUBE/GK is not able to handle multiple BRQ/BCF requests/responses in 12.4(22)T1 and 12.4(22)YB4 IOS. The fix for CSCsv36769 was supposed to be integrated in these releases but per DE this integration with the above IOS did not take place.
Condition: Video over CUBE/GK, CUBE/GK is not able to handle multip BRQ/BCF request/responses...resulting in one-way video.
Workaround: Do not use gatekeeper. Direct HD call across the CUBE with dial peers work

Multiple %ISDN-6-CONNECT messages printed for a single call , Fixed CSCsk97745

Symptom: Multiple %ISDN-6-CONNECT may be printed when a single call is connected on an ISDN circuit. For example: *Mar 1 00:14:18.361: %ISDN-6-CONNECT: Interface Serial1/0:0 is now connected to 1001 N/A *Mar 1 00:14:18.361: %ISDN-6-CONNECT: Interface Serial1/0:0 is now connected to 1001 N/A *Mar 1 00:14:18.365: %ISDN-6-CONNECT: Interface Serial1/0:0 is now connected to 1001 N/A *Mar 1 00:14:24.367: %ISDN-6-CONNECT: Interface Serial1/0:0 is now connected to 1001 N/A
Workaround: None.

line-power should be removed from 1861 on-board BRI interface CLI , Fixed CSCtc79789

Customer needs the support of the line-power command under the BRI interface (to provide phantom power to the Terminal Equipment (TE) on a Cisco 1861 but will see the following message: 1861(config)#interface BRI0/1/0 1861(config-if)#line-power This command is not supported cause this hardware does not support it. This bug fix is a request to have this error message either changed to "this command is not supported on 18xx series on-board BRI ports" OR to remove it from the CLI of all 1861 images so as to not cause any confusion among the users. This is not a bug.

CUBE fails to PRACK 2nd 1xx w/ SDP in Slow start to delayed offer media , Fixed CSCsu50869

Symptoms: Calls do not complete because Cisco Unified Border Element (CUBE) does not sent PRACKs to all 1xx messages.
Conditions: Occurs with h.323 slow start to SIP delayed media call flow.
Workaround: Enable fast start h.323 with an MTP in CUCM, which allows for SIP early offer. Reliable 1xx messaging can also be disabled to prevent the requirement of provisional acknowledgments.

buffer leak in Onboard DSPRM Pool and middle buffers , Fixed CSCsf95938

Symptoms: A memory leak occurs in the middle buffers after all onboard DSPRM pools are depleted.
Conditions: This symptom is observed on a Cisco 3800 series router that runs Cisco IOS Release 12.4(7b) with support for CVP survivability.
Workaround: There is no workaround.

Layer 2 is not coming up in BRI interfaces , Fixed CSCsg25693

Symptom: Layer2 of BRI interfaces is not coming up, and it is in "NOT Activated" state
Conditions: This issue is seen in 12.4(11.1)T image
Workaround: No workaround

T1-CAS MF * is reconized as D and # is recognized as * , Open CSCtd18294

Symptom: Customer has T1 CAS configured as MF on the H323 gateway that trunk to Call manager. When the PSTN user press the DTMF "*", gateway will recognize as "D" . And "#" will be recoginzed as "*" The DSP PCM Trace indicates the telco send the correct Frequency for "*" and "#". However, the gateway interpreted as "D" and "*".
Conditions: IOS: 12.4.24T2 DSP firmware: Release 24.3.2
Workaround: None Additional ========= The same issue has been observed on the following IOS: 124-22.T3.bin 124-15.T11.bin 124-20.T4.bin

memory allocated at vtsp_event_pool_init was leaked , Fixed CSCej53240

Symptoms: The system can run out of memory with voice calls over a period of time. With the system handling a large number of voice calls (greater than 50), running the show memory summary command periodically will indicate memory in use is increasing. Under these conditions, the show memory debug leak chunks command shows that there is a memory leak. A sample output of this command when the problem is seen is shown below: Chunk Elements: Address Size Parent Name 45ACC8C8 2052 45786824 (VTSP EVENT poo) 45ACD0D0 2052 45786824 (VTSP EVENT poo) 45ACD8D8 2052 45786824 (VTSP EVENT poo)
Conditions: This issue is likely to be seen when the system is handling a large number of voice calls (greater than 50). This issue is present in Cisco IOS Release 12.4(5).
Workaround: Reload the system to recover from this condition.

watchdog timeout at process VTSP , Fixed CSCee01844

Symptoms: A Cisco 3660 may crash and report a software forced crash/watchdog timeout at the VTSP process.
Conditions: This symptom is observed on a Cisco 3660 that runs Cisco IOS Release 12.3(6) or 12.3(9).
Workaround: There is no workaround.

C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors , CSCsz39700

1. Customer seen by CSCsz39700: AS5400XM running 124-15.T8 and firemware 9.4.7 might experience "C5510-1-NO_RING_DESCRIPTORS: No more ring descriptors available on slot" causing the DSP to crash and it sometimes it crashes continuesly shutdown the affected DSP 2. History of the root problem documented in internal found ddts CSCsw39413: The original problem has been noticed on Cisco C1861 with the following sequence of steps used to reset the two DSPs on a Cisco C1861 Voice GateWay, DSP 1 WILL NOT recover itself properly and all analog voice ports tied to that DSP for signaling channels will be forced into a shutdown state: (A) Invoke "test voiceport driver" for slot 0, (B) Choose the "2 - 5510 DSP test" option, (C) Select "1 - Reset ALL DSPs". The following alternatives for reseting the DSPs does seem to correctly bounce and recover both of the DSPs and all analog voice ports tied to DSP 1: Alternative 1: ============== (A) Invoke "test voiceport driver" for slot 0, (B) Choose the "2 - 5510 DSP test" option, (C) Select "2 - Reset 1 DSP" twice and each time specify DSP ID 1 or 2. Alternative 2: ============== (A) Invoke "test voiceport driver" for slot 0, (B) Choose the "2 - 5510 DSP test" option, (C) Select "14 - faked dsp crash" twice and each time specify DSP ID 1 or 2. Alternative 3: ============== (A) At the EXEC prompt issue a "test dsp device all all reset". We need to ensure that the "1 - Reset ALL DSPs" option reliably resets AND recovers both of the DSPs and any voice ports tied to DSP 1. This feature works reliably on other C5510 DSP-based voice platforms, and strangely enough this also works just fine on the UC500 platforms even though both the UC500 and the C1861 are Freddo boxes.

"mgcp voice-quality-stats all" is not working on 12.4(20)T4, 12.4(22)T3 , Open CSCtc80876

Symptom: K-Factory doesn't send within MGCP 250 response. Gateway always send default information.
Conditions: Use 12.4(20)T4 and 12.4(22)T3
Workaround: Use 12.4(22)T2
Further Problem Description:

One way Robotic and Metallic voice towards PSTN through 2800 , Fixed CSCsd90851

Symptom: Voice calls through a 2800 gateway starts experiencing Robotic and Metallic voice after a few days of operation. When the problem does occur, it happens on all the calls through the gateway.
Condition: Observed on a 2851 running IOS release 12.4(3a)
Workaround: A reset of the DSP or a router reload resolves the problem.

Calls through PRI / BRI show mbrd_e1t1_vic_connect: setup failed errors , Fixed CSCse34097

Symptoms: When a voice call is made to one of the busy channels of BRI/PRI port, the call gets rejected and then another call is made to the available port. The call gets connected, and the user hears an annoying hissing sound.
Conditions: The procedure to recreate this scenario is the following: Phone a & b ---OGW --VoIP --TGW(2611) --BRI/PRI --PBX -- phone c & d Phone a calls phone c; Phone b calls phone c; Phone b calls phone d; Phone d picks up and hears a hissing noise.
Workaround: There is no workaround.

Memory Leak in AFW_application (CDAPI-RawS ) , Fixed CSCsw47543

Symptoms: A router may loses all its free memory and crash.
Conditions: The symptom is observed when the voice mail system sends a notification to the gateway regarding the availablity of any voice messages. The memory leaks occurs in CDAPI_RawS.
Workaround: Use the command signalling forward none under the global configuration "voice service voip".

Crash in AFW_DataList_GetNext - AS5400 Gateway crashes. , Fixed CSCso56293

Symptom: There is large amount of spurious access seen on the AS 5400 XM voice gateways. These may be resulting in the gateways crashing after some time of operation. Use the "Show Align" CLI to check for spurious memory access.
Conditions: Spurious memory access seen in the AS 5400 XM voice gateways (Ingress) handling high volume of calls.
Workaround: See the the bug details to see the ES applied to fix the issue.

Call disconnected due to DSP detects fxols_rvs_battery , Fixed CSCsw79696

Symptoms: A call over the FXO loop-start cannot be established as the gateway's DSP detects a reverse-battery signal.
Conditions: The symptom is observed when the far-end is able to generate a reverse-battery signal when the called side is ringing. In addition, it is seen when "supervisory disconnect" is configured to either anytone or dualtone.
Workaround: There is no workaround.

DSP: Persistent echo heard on c5510 DSPs with 4.4.13 DSPware or higher , Fixed CSCsd54344

Symptoms: Under certain circumstances, continual echo may be heard. The echo is persistent and the DSP echo canceller does not converge.
Conditions: This behaviour may be observed on IOS voice gateways meeting the following criteria (use show voice dsp and show voice dsp group all to determine the DSP firmware (DSPware) version and DSP architecture type): (1) C5510 DSPs are used. This means voice routers employing the NM-HD-1V, NM-HD-2V, NM-HD-2VE, NM-HDV2 series of Network Modules, Integrated Services Router (ISR) platforms such as the Cisco 2801/2811/2821/2851/3825/3845 with PVDM2 DSP cards installed on the chassis mainboard, and the IAD2430 and VG224 platforms which have C5510 DSPs hard-soldered onto the mainboard. (2) The DSPware in the following DSPware release trains is installed: * DSPware 4.4.13 through 4.4.17 in the DSPware 4.4.x family. The problem is fixed in DSPware 4.4.18. * DSPware 4.4.7(08) in the 4.4.7(x) family. The problem is fixed in DSPware 4.4.7(09). * DSPware 5.4.3 and 5.4.4 in the 5.4.x family. This problem is NOT fixed in this DSPware family as it is no longer under active engineering maintenance. * DSPware 6.3.3 and 6.3.4 in the DSPware 6.3.x family. The problem is fixed in DSPware 6.3.5. * DSPware 7.4.0 and 7.4.1 in the DSPware 7.4.x family. The problem is fixed in DSPware 7.4.2. * DSPware 8.1.0 through 8.3.0 in the DSPware 8.x.0 family. The problem is fixed in DSPware 8.4.0. * DSPware 9.1.0 in the DSPware 9.x.x family. The problem is fixed in DSPware 9.2.0.
Workaround: Use a version of C5510 DSPware which is unaffected by this defect. Please contact Cisco TAC for guidance and refer to this defect ID. If it is not possible to change IOS to obtain a version of DSPware which is unaffected by this defect, it is oftentimes possible to have TAC provide a raw DSPware binary file which can be installed on the flash: filesystem of your voice router to supersede the DSPware which is bundled along with the IOS.

G.729 call fails from MGCP controlled VG2XX to SIP trunk-side VG2XX , Fixed CSCta35496

Symptoms: G.729b variant calls fail from MGCP controlled VG2XX to SIP trunk-side VG2XX.
Conditions: The symptom is observed when sRTP is enabled on MGCP and SIP gateways. It is seen when the gateways are registered to CUCM and inter-region codec is set to G.729b.
Workaround: Set to "TRUE" the CUCM Service parameter "Strip G.729 Annex B (Silence Suppression) from Capabilities Required Field".

Called no display showing Junk characters-n!0l`al`ed , Fixed CSCsm64477

Symptom: Called number shows junk characters on the CME registered SCCP phones when the call is made from CME phones to CCM registered phones.
Conditions: