Forum Discussion
SimoParis_85044
Altostratus
AltostratusSIP HealthCheck problem
Hello,
We are using F5 boxes to monitor SIP nodes .
1/ F5 box sends sip option request (F5_ip/UDP_5060) to SIP node (SIP_ip/UDP_5060)
2/ The SIP node answers 200 OK but with it own IP (SIP_ip) and a different UDP port (65534 for instance): This behaviour is normal since it is UDP and compliant with RFC.
3/ F5 box seems to not like the SIP node answers and marks the SIP node as down
Here is a trace on the F5 node.
Thanks in advance for any hint.
BR
=====================================================================
No. Time Source Destination Protocol Info
1 23:46:53.275987000 172.22.111.245 172.22.105.133 SIP Request: OPTIONS sip:172.22.105.133:5060
Frame 1 (348 bytes on wire, 348 bytes captured)
Ethernet II, Src: F5Networ_74:7d:0f (00:01:d7:74:7d:0f), Dst: All-HSRP-routers_5c (00:00:0c:07:ac:5c)
Internet Protocol, Src: 172.22.111.245 (172.22.111.245), Dst: 172.22.105.133 (172.22.105.133)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Session Initiation Protocol
No. Time Source Destination Protocol Info
2 23:46:53.288690000 172.22.105.133 172.22.111.245 SIP/SDP Status: 200 OK, with session description
Frame 2 (1288 bytes on wire, 1288 bytes captured)
Ethernet II, Src: Cisco_ce:7f:c0 (00:16:46:ce:7f:c0), Dst: F5Networ_74:7d:0f (00:01:d7:74:7d:0f)
Internet Protocol, Src: 172.22.105.133 (172.22.105.133), Dst: 172.22.111.245 (172.22.111.245)
User Datagram Protocol, Src Port: 65532 (65532), Dst Port: sip (5060)
Session Initiation Protocol
No. Time Source Destination Protocol Info
3 23:46:53.288697000 172.22.111.245 172.22.105.133 ICMP Destination unreachable (Port unreachable)
Frame 3 (70 bytes on wire, 70 bytes captured)
Ethernet II, Src: F5Networ_74:7d:0f (00:01:d7:74:7d:0f), Dst: Cisco_ce:7f:c0 (00:16:46:ce:7f:c0)
Internet Protocol, Src: 172.22.111.245 (172.22.111.245), Dst: 172.22.105.133 (172.22.105.133)
Internet Control Message Protocol
No. Time Source Destination Protocol Info
4 23:46:53.775119000 172.22.111.245 172.22.105.133 SIP Request: OPTIONS sip:172.22.105.133:5060
Frame 4 (348 bytes on wire, 348 bytes captured)
Ethernet II, Src: F5Networ_74:7d:0f (00:01:d7:74:7d:0f), Dst: All-HSRP-routers_5c (00:00:0c:07:ac:5c)
Internet Protocol, Src: 172.22.111.245 (172.22.111.245), Dst: 172.22.105.133 (172.22.105.133)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Session Initiation Protocol
No. Time Source Destination Protocol Info
5 23:46:53.787242000 172.22.105.133 172.22.111.245 SIP/SDP Status: 200 OK, with session description
Frame 5 (1288 bytes on wire, 1288 bytes captured)
Ethernet II, Src: Cisco_ce:7f:c0 (00:16:46:ce:7f:c0), Dst: F5Networ_74:7d:0f (00:01:d7:74:7d:0f)
Internet Protocol, Src: 172.22.105.133 (172.22.105.133), Dst: 172.22.111.245 (172.22.111.245)
User Datagram Protocol, Src Port: 65532 (65532), Dst Port: sip (5060)
Session Initiation Protocol
No. Time Source Destination Protocol Info
6 23:46:53.787248000 172.22.111.245 172.22.105.133 ICMP Destination unreachable (Port unreachable)
Frame 6 (70 bytes on wire, 70 bytes captured)
Ethernet II, Src: F5Networ_74:7d:0f (00:01:d7:74:7d:0f), Dst: Cisco_ce:7f:c0 (00:16:46:ce:7f:c0)
Internet Protocol, Src: 172.22.111.245 (172.22.111.245), Dst: 172.22.105.133 (172.22.105.133)
Internet Control Message Protocol
No. Time Source Destination Protocol Info
7 23:46:54.775161000 172.22.111.245 172.22.105.133 SIP Request: OPTIONS sip:172.22.105.133:5060
Frame 7 (348 bytes on wire, 348 bytes captured)
Ethernet II, Src: F5Networ_74:7d:0f (00:01:d7:74:7d:0f), Dst: All-HSRP-routers_5c (00:00:0c:07:ac:5c)
Internet Protocol, Src: 172.22.111.245 (172.22.111.245), Dst: 172.22.105.133 (172.22.105.133)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Session Initiation Protocol
No. Time Source Destination Protocol Info
8 23:46:54.787266000 172.22.105.133 172.22.111.245 SIP/SDP Status: 200 OK, with session description
Frame 8 (1288 bytes on wire, 1288 bytes captured)
Ethernet II, Src: Cisco_ce:7f:c0 (00:16:46:ce:7f:c0), Dst: F5Networ_74:7d:0f (00:01:d7:74:7d:0f)
Internet Protocol, Src: 172.22.105.133 (172.22.105.133), Dst: 172.22.111.245 (172.22.111.245)
User Datagram Protocol, Src Port: 65532 (65532), Dst Port: sip (5060)
Session Initiation Protocol
No. Time Source Destination Protocol Info
9 23:46:54.787272000 172.22.111.245 172.22.105.133 ICMP Destination unreachable (Port unreachable)
Frame 9 (70 bytes on wire, 70 bytes captured)
Ethernet II, Src: F5Networ_74:7d:0f (00:01:d7:74:7d:0f), Dst: Cisco_ce:7f:c0 (00:16:46:ce:7f:c0)
Internet Protocol, Src: 172.22.111.245 (172.22.111.245), Dst: 172.22.105.133 (172.22.105.133)
Internet Control Message Protocol
No. Time Source Destination Protocol Info
10 23:46:56.775214000 172.22.111.245 172.22.105.133 SIP Request: OPTIONS sip:172.22.105.133:5060
Frame 10 (348 bytes on wire, 348 bytes captured)
Ethernet II, Src: F5Networ_74:7d:0f (00:01:d7:74:7d:0f), Dst: All-HSRP-routers_5c (00:00:0c:07:ac:5c)
Internet Protocol, Src: 172.22.111.245 (172.22.111.245), Dst: 172.22.105.133 (172.22.105.133)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Session Initiation Protocol
No. Time Source Destination Protocol Info
11 23:46:56.787203000 172.22.105.133 172.22.111.245 SIP/SDP Status: 200 OK, with session description
Frame 11 (1288 bytes on wire, 1288 bytes captured)
Ethernet II, Src: Cisco_ce:7f:c0 (00:16:46:ce:7f:c0), Dst: F5Networ_74:7d:0f (00:01:d7:74:7d:0f)
Internet Protocol, Src: 172.22.105.133 (172.22.105.133), Dst: 172.22.111.245 (172.22.111.245)
User Datagram Protocol, Src Port: 65532 (65532), Dst Port: sip (5060)
Session Initiation Protocol
No. Time Source Destination Protocol Info
12 23:46:56.787210000 172.22.111.245 172.22.105.133 ICMP Destination unreachable (Port unreachable)
Frame 12 (70 bytes on wire, 70 bytes captured)
Ethernet II, Src: F5Networ_74:7d:0f (00:01:d7:74:7d:0f), Dst: Cisco_ce:7f:c0 (00:16:46:ce:7f:c0)
Internet Protocol, Src: 172.22.111.245 (172.22.111.245), Dst: 172.22.105.133 (172.22.105.133)
Internet Control Message Protocol
- I'm fairly certain that the monitor expects a response on the same tuple. Can you please open a case with F5 Support on this question to verify that assumption?
thanks
/deb 
rick_17368Nimbostratus
Was there any resolution on this?
I am having a very similiar problem(except, end responds from different IP)- rick_17368btw, where do you see the debug for monitoring message?
hoolioCirrostratus
I'm not sure about the SIP monitor issue. Your best option might be to open a case with F5 and find out if it's a known issue, been fixed, etc.
You can enable debug on the SIP monitor. The online help shows this for the debug logging:
Debug
Specifies whether the monitor sends error messages and additional information to a log file created and labeled specifically for this monitor. The default is No. You can use the log information to help diagnose and troubleshoot unsuccessful health checks. To view the log entries, see the System >> Logs >> Local Traffic screen.
* No: Specifies that the system does not redirect error messages and additional information related to this monitor.
* Yes: Specifies that the system redirects error messages and additional information to the /var/log/_..log file.
Aaron- rick_17368Thanks Aaron. I opened the case w/ F5 about hour ago and waiting to hear abck from them. I am bit suprised that it's not correlating the sip message on call-id.... I will let you guys know what I find out.
