Troubleshoot One-Way Audio Problems in FXO Ports on IOS-XE Routers when ZBF is Configured

Available Languages

Updated:August 13, 2018

Document ID:213550

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Problem: Troubleshoot One-Way Audio Problems In FXO Ports On IOS-XE Routers When Zone Based Policy Firewall Is Configured

Introduction

This document describes a one-way audio problem seen in IOS-XE routers when the Zone-based Firewall (ZBF) is used, this problem affects the inbound and outbound calls for the Foreign eXchange Office (FXO) router ports as soon as the ZBF is in place.

The main intention of this document is to explain why this problem happens and provide you with the solution required to force the ZBF to allow the voice calls to work properly and with bi-directional audio communication for the FXO router ports.

Prerequisites

Requirements

Cisco recommends that you have knowledge of Cisco ZBF configuration in IOS-XE routers.

Components Used

The information in this document is based on these software and hardware versions:

Integrated Services Routers (ISR G2)
IOS-XE 3S

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Problem: Troubleshoot One-Way Audio Problems In FXO Ports On IOS-XE Routers When Zone Based Policy Firewall Is Configured

One-way audio is experienced on inbound and outbound calls in routers with FXO ports as soon as the ZBF is configured in the router. Once you remove the ZBF zones from all of the router interfaces, then the one-way audio issue disappears.

Unfortunately, every time this issue happens, the ZBF does not display any syslog message that indicates or confirms why the voice traffic is dropped by the ZBF. Even though you try to force the ZBF to log whatever packet drop with any of these options, you don't see any syslog drop message:

Step 1. You can enable the drop log at the end of each ZBF policy-map within the last class class-default:

policy-map type inspect POLICY_INSIDE_TO_SELF
class type inspect CMAP_ZBFW_RFC_1918
  pass
class type inspect CMAP_ZBFW_ALL_PROTOCOLS
  inspect
class class-default
  drop log

Step 2. You can enable the log dropped-packets within the global ZBF parameter map:

parameter-map type inspect global
 log dropped-packets

You can try to resolve this one-way audio communication problem if applies the next ZBF configuration changes, but unfortunately, it won't work at all:

By configure inspect and pass action rules that allows the voice traffic from the inside to the outside zone.
By configure inspect and pass action rules that allows the voice traffic from the outside to the inside zone.
By configure inspect and pass action rules that allows the voice traffic from the outside to the self-zone and vice versa.
By configure inspect and pass action rules that allows the voice traffic from the inside to the self-zone and vice versa.
By configure inspect and pass action rules that allows the voice traffic from the inside to the inside zone.

Solution

In order to avoid the ZBF to drop the voice traffic related to the FXO router ports, you need to assign all of the service-engine router interfaces that are in the Status/Protocol UP state, to the INSIDE ZBF zone:

interface Service-Engine0/1/0
 zone-member security INSIDE

interface Service-Engine0/2/0
 zone-member security INSIDE

Once the router service-engine interfaces in UP status/protocol state are assigned to the INSIDE zone, then the one-way audio problem through the ZBF is finally resolved.

Example 1

In this IOS-XE ZBF implementation, confirmed one-way audio issues for the Inbound and outbound phone calls from the LAN network to the PSTN, after assigned the service-engine interfaces in UP state to the ZONE_INSIDE zone, the one-way audio issue was finally resolved:

R1#sh ip int br
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0/0   64.100.0.10     YES NVRAM  up                    up
GigabitEthernet0/0/1   unassigned      YES NVRAM  up                    up
Gi0/0/1                192.168.10.1    YES NVRAM  up                    up
GigabitEthernet0/0/2   unassigned      YES NVRAM  administratively down down
Service-Engine0/1/0    unassigned      YES NVRAM  up                    up
Service-Engine0/2/0    unassigned      YES unset  up                    up
Vlan1                  unassigned      YES unset  administratively down down

interface Service-Engine0/1/0
 zone-member security ZONE_INSIDE

interface Service-Engine0/2/0
 zone-member security ZONE_INSIDE

R1# show zone security
zone self
  Description: System defined zone

zone ZONE_INSIDE
  Member Interfaces:
    GigabitEthernet0/0/1
    Service-Engine0/1/0
    Service-Engine0/2/0

zone ZONE_OUTSIDE
  Member Interfaces:
    GigabitEthernet0/0/0

Example 2

In this IOS-XE ZBF implementation, confirmed one-way audio issues for the Inbound and outbound phone calls from the LAN network to the PSTN, after assigned the service-engine interfaces in UP state to the Trusted zone, the one-way audio issue was finally resolved:

R2# show ip int brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0/0   172.16.1.1      YES NVRAM  up                    up
Gi0/0/1                64.100.0.10     YES NVRAM  up                    up
Service-Engine0/1/0    unassigned      YES unset  up                    up
Service-Engine0/4/0    unassigned      YES unset  up                    up
GigabitEthernet0       unassigned      YES NVRAM  administratively down down
Loopback0              unassigned      YES unset  up                    up
Vlan1                  unassigned      YES unset  administratively down down

interface Service-Engine0/1/0
zone-member security Trusted

interface Service-Engine0/4/0
zone-member security Trusted

R2#show zone security
zone self
  Description: System defined zone

zone Trusted
 Member Interfaces:
   GigabitEthernet0/0/0
   Service-Engine0/1/0
   Service-Engine0/4/0

zone Untrusted
   Member Interfaces:
     Gi0/0/1