Troubleshoot IP Phone Unregistration Issues in CUCM

Introduction

This document describes how to begin troubleshooting an IP phone that goes unregistered or does not register with CUCM.

Requirements

Cisco recommends that you have knowledge of these topics:

• Cisco IP Phone registration process.
• Cisco Unified Communications Manager (CUCM)
• Domain Name System (DNS) 
• Cisco Discovery Protocol (CDP)
• Dynamic Host Configuration Protocol(DHCP)
• Trivial File Transfer Protocol (TFTP)
• Voice Virtual LAN (Voice VLAN)
• Power Over Ethernet (PoE)

Components Used

The information in this document is based on these software and hardware versions:

• CUCM 11.5(1)SU9
• SIP IP Phone 8811 sip88xx.14-2-1-0001-14

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

The registration of a device in CUCM depends on whether it is a device that uses Skinny Protocol (SCCP) or Session Initiation Protocol (SIP), between them a few steps change, however the troubleshoot is the same and focuses on the steps that the phone does to register.

It is essential to troubleshoot device registration issues by understanding the process the device goes through to register correctly.

SIP registration process

SCCP registration process

Problem

Some events such as power outstage, a hardware or software defect, unstable connections, lack of quality of service in the network, and others, can cause one or many phones to be unregistered from Call Manager. Whether it is a single event or something intermittent, it is important to clarify the problem in order to narrow it down.

Information to be clarified 

• Full CUCM version
• Does it happen only with a specific model?
• Does it happen at a single site or location?
• How many phones are affected?
• Do all phones share the same firmware version?
• Have you recently upgraded or downgraded the firmware?
• Have you recently regenerated certificates?
• Have you done a factory reset?
• Is the issue reproducible at will?
• Take note of a few MAC addresses for affected phones and timestamp when issue starts to happen.
  
  
  

Logs to collect

It is necessary to have the logs of each component involved in the phone registration process to find where the issue is.

From Switch:

• Span (optional in case phone pcap can not be collected)

Note: Have the Timestamp when issue occurred is important and phone(s) detail.

How to collect logs guides

• How to collect CUCM logs from RTMT
• How to collect IP Phone pcap
• How to collect CUCM pcap
• How to collect IP Phone PRT
• How to collect phone console logs
• How to collect a SPAN on switch

Understand PRT/console logs

The process that the phone takes to request specific features (IP, Configuration file and others) from the other components involved can be seen in the PRT or in the console logs. The PRT includes the console logs.

Note: To be able to read the console logs within the PRT, it is necessary to uncompress the folders contained in the path prt-date-time-MACAddress > data > logsave > main

******** PRT/Console logs shows how phone loads its firmware image: ********

1429 NOT Jul 21 18:05:16.217247 (620-869) JAVA-SIPCC-PLAT_API: extract_release_num_from_phone_load_name: load_name:[sip88xx.14-2-1-0001-14.loads] release_num:[14.2.1]

******** Phone requests the Certificate Trust List (CTL) file ********

2056 NOT Jul 21 18:05:24.839195 (351-928) downd-GETXXTP [GT351][src=CTLSEPD0EC35C1D98E.tlv][dest=/tmp/CTLFile.tlv][serv=][serv6=][sec=0]
2057 NOT Jul 21 18:05:24.839912 (351-928) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml
2058 NOT Jul 21 18:05:24.840023 (351-928) downd-handle_get_file:dst:/tmp/CTLFile.tlv
2059 NOT Jul 21 18:05:24.891683 (351-928) downd-In normal mode, call - > makeXXTPrequest (V6...)
2060 NOT Jul 21 18:05:24.892095 (351-928) downd-EMCC mode is false
2061 NOT Jul 21 18:05:24.893087 (351-928) downd-parseDhcpInfoIntoTftpList(): no valid load server
2062 NOT Jul 21 18:05:24.893555 (351-928) downd-AUTH.SRVR [GT351] look up server - 0 - 198.51.100.30
2063 NOT Jul 21 18:05:24.944833 (351-928) downd-AUTH.SRVR [GT351] authentication retval = 9 
2064 NOT Jul 21 18:05:24.944987 (351-928) downd-XXTP Non secure file requested 
2065 NOT Jul 21 18:05:24.945138 (351-928) downd-tftp.avail file does not exist, so creating it

If the cluster is in non-secure mode, the TFTP sends 404 Not Found to the request (if cluster is in mixed mode, TFTP should send a 200 OK)

2078 NOT Jul 21 18:05:24.947516 (351-931) downd-XXX arg[4] CTLSEPD0EC35C1D98E.tlv
2079 NOT Jul 21 18:05:24.947550 (351-931) downd-XXX arg[5] /tmp/CTLFile.tlv
2080 NOT Jul 21 18:05:24.947584 (351-931) downd-XXX arg[6] (null)
2081 NOT Jul 21 18:05:24.976370 (931-931) GHTTP-LIMIT downdload will be limited to 8192 KB
2082 ERR Jul 21 18:05:24.994707 (931-931) GHTTP-http get [HTTP/1.1 404 Not Found^M

******** Phone requests Identity Trust List (ITL) file ********

2088 NOT Jul 21 18:05:25.049240 (351-935) downd-GETXXTP [GT351][src=ITLSEPD0EC35C1D98E.tlv][dest=/tmp/ITLFile.tlv][serv=][serv6=][sec=0]
2089 NOT Jul 21 18:05:25.049419 (351-935) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml
2090 NOT Jul 21 18:05:25.049484 (351-935) downd-handle_get_file:dst:/tmp/ITLFile.tlv
2091 NOT Jul 21 18:05:25.049525 (351-935) downd-handle_get_file:downloading ITLFILE
2092 NOT Jul 21 18:05:25.100110 (351-935) downd-In normal mode, call - > makeXXTPrequest (V6...)

TFTP sends 200 OK for the ITL File request

2110 NOT Jul 21 18:05:25.153781 (351-938) downd-XXX arg[4] ITLSEPD0EC35C1D98E.tlv
2111 NOT Jul 21 18:05:25.153815 (351-938) downd-XXX arg[5] /tmp/ITLFile.tlv
2112 NOT Jul 21 18:05:25.153849 (351-938) downd-XXX arg[6] (null)
2113 NOT Jul 21 18:05:25.166084 (938-938) GHTTP-LIMIT downdload will be limited to 8192 KB
2114 NOT Jul 21 18:05:25.168904 (938-938) GHTTP-hdr->HTTP/1.1 200 OK
2115 NOT Jul 21 18:05:25.169081 (938-938) GHTTP-hdr->Content-length: 11698
2116 NOT Jul 21 18:05:25.169149 (938-938) GHTTP-hdr->Cache-Control: no-store
2117 NOT Jul 21 18:05:25.169211 (938-938) GHTTP-hdr->Content-type: */*
2118 NOT Jul 21 18:05:25.170338 (351-935) downd-PARENT, child process status: 25600
2119 NOT Jul 21 18:05:25.170472 (351-935) downd-NORMAL tftp-exit 100
2120 NOT Jul 21 18:05:25.170724 (351-935) downd-XXTP complete - status = 100 
2121 NOT Jul 21 18:05:25.170755 (351-935) downd-cancel the monitor timer
2122 NOT Jul 21 18:05:25.175638 (355-939) SECUREAPP-validateSignedCTL: new TL matches old, not updating
2123 NOT Jul 21 18:05:25.186516 (351-935) downd-DDGETTFTP.RESULT [_100_ HTTP NO ERROR

******** Phone requests to TFTP the configuration file ********

2140 NOT Jul 21 18:05:26.436017 (351-965) downd-GETXXTP [GT351][src=SEPD0EC35C1D98E.cnf.xml][dest=/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036][serv=][serv6=][sec=2]
2141 NOT Jul 21 18:05:26.436216 (351-965) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml
2142 NOT Jul 21 18:05:26.436285 (351-965) downd-handle_get_file:dst:/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036
2143 NOT Jul 21 18:05:26.436346 (351-965) downd-handle_get_file:downloading CNF FILE
2144 NOT Jul 21 18:05:26.487402 (351-965) downd-In normal mode, call - > makeXXTPrequest (V6...)
2145 NOT Jul 21 18:05:26.487841 (351-965) downd-EMCC mode is false
2146 NOT Jul 21 18:05:26.488595 (351-965) downd-parseDhcpInfoIntoTftpList(): no valid load server
2147 NOT Jul 21 18:05:26.488787 (351-965) downd-AUTH.SRVR [GT351] look up server - 0 - 198.51.100.30
2148 NOT Jul 21 18:05:26.539279 (351-965) downd-AUTH.SRVR [GT351] authentication retval = 9 
2149 NOT Jul 21 18:05:26.539419 (351-965) downd-XXTP Secure file requested 
2150 NOT Jul 21 18:05:26.539536 (351-965) downd-XXTP authenticated file approved - add .sgn if necessary -- SEPD0EC35C1D98E.cnf.xml.sgn

******** Phone downloads the configuration file ********

137 NOT Jul 21 18:05:26.432207 (620-840) JAVA-configmgr MQThread|cip.cfg.Config: - Requesting CONFIG file: ram/SEPD0EC35C1D98E.cnf.xml.19036 from TFTP Service(1), encrypt = false,isApplyingConfigFromFlash:false
2138 INF Jul 21 18:05:26.432653 (620-840) JAVA-[[MESSAGE_1.0]]: [CONFIG-MGR] --> tftpRequest(ram/SEPD0EC35C1D98E.cnf.xml.19036) --> [TFTP] : 
2139 NOT Jul 21 18:05:26.435882 (351-965) downd-start the monitor timer
2140 NOT Jul 21 18:05:26.436017 (351-965) downd-GETXXTP [GT351][src=SEPD0EC35C1D98E.cnf.xml][dest=/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036][serv=][serv6=][sec=2]
2141 NOT Jul 21 18:05:26.436216 (351-965) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml
2142 NOT Jul 21 18:05:26.436285 (351-965) downd-handle_get_file:dst:/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036
2143 NOT Jul 21 18:05:26.436346 (351-965) downd-handle_get_file:downloading CNF FILE
2144 NOT Jul 21 18:05:26.487402 (351-965) downd-In normal mode, call - > makeXXTPrequest (V6...)
2145 NOT Jul 21 18:05:26.487841 (351-965) downd-EMCC mode is false
2146 NOT Jul 21 18:05:26.488595 (351-965) downd-parseDhcpInfoIntoTftpList(): no valid load server
2147 NOT Jul 21 18:05:26.488787 (351-965) downd-AUTH.SRVR [GT351] look up server - 0 - 198.51.100.30
2148 NOT Jul 21 18:05:26.539279 (351-965) downd-AUTH.SRVR [GT351] authentication retval = 9 
2149 NOT Jul 21 18:05:26.539419 (351-965) downd-XXTP Secure file requested 
2150 NOT Jul 21 18:05:26.539536 (351-965) downd-XXTP authenticated file approved - add .sgn if necessary -- SEPD0EC35C1D98E.cnf.xml.sgn

TFTP sends 200 OK to the configuration file request

2163 NOT Jul 21 18:05:26.541364 (351-968) downd-XXX arg[4] SEPD0EC35C1D98E.cnf.xml.sgn
2164 NOT Jul 21 18:05:26.541398 (351-968) downd-XXX arg[5] /tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036
2165 NOT Jul 21 18:05:26.541432 (351-968) downd-XXX arg[6] (null)
2166 NOT Jul 21 18:05:26.552194 (968-968) GHTTP-LIMIT downdload will be limited to 8192 KB
2167 NOT Jul 21 18:05:26.603994 (968-968) GHTTP-hdr->HTTP/1.1 200 OK
2168 NOT Jul 21 18:05:26.604360 (968-968) GHTTP-hdr->Content-length: 14939
2169 NOT Jul 21 18:05:26.604470 (968-968) GHTTP-hdr->Cache-Control: no-store
2170 NOT Jul 21 18:05:26.604523 (968-968) GHTTP-hdr->Content-type: */*
2171 NOT Jul 21 18:05:26.607331 (351-965) downd-PARENT, child process status: 25600
2172 NOT Jul 21 18:05:26.607479 (351-965) downd-NORMAL tftp-exit 100
2173 NOT Jul 21 18:05:26.607504 (351-965) downd-XXTP complete - status = 100

******** Phone loads the new firmware  ********

2202 NOT Jul 21 18:05:27.530229 (620-981) JAVA-Seamless Upgrade Thread|UpgradeService: - Got request for (sip88xx.14-2-1-0001-14.loads) when we are already running (sip88xx.14-2-1-0001-14.loads)
2203 NOT Jul 21 18:05:27.530908 (620-981) JAVA-Seamless Upgrade Thread|UpgradeService: - and (sip88xx.14-0-1-0201-171.loads) when we already have (sip88xx.14-0-1-0201-171.loads). Ignoring this request.

******** Phone charges all the parameters written on the configuration file ********

4479 NOT Jul 17 22:29:45.818159 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - HEADSET_DISCOVERY_URL: https://{cucm}:9444/headset/{devicename}
4480 NOT Jul 17 22:29:45.819013 (559-1232) JAVA-configmgr MQThread|cip.cfg.SipConfig: - Entering setProtocolConfigProperties() at 1689650985818 millisecs....<RemoveItLater>
4481 NOT Jul 17 22:29:45.998381 (559-1232) JAVA-configmgr MQThread|cip.cfg.SipConfig:? - embrace feature hack, update line 1, featureId = 9, name = 0236
4482 NOT Jul 17 22:29:46.037905 (559-1232) JAVA-configmgr MQThread|cip.cfg.SipConfig: - Exiting setProtocolConfigProperties() at 1689650986037 millisecs....<RemoveItLater>
4483 NOT Jul 17 22:29:46.106088 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #0 XmlCallAgentObject: IPv4-name=[198.51.100.80] IPv6-name=[] ethernetPhonePort=2000 sipPort=5060 securedSipPort=5061 priority=0
4484 NOT Jul 17 22:29:46.107950 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #1 XmlCallAgentObject: IPv4-name=[198.51.100.46] IPv6-name=[] ethernetPhonePort=2000 sipPort=5060 securedSipPort=5061 priority=1
4485 NOT Jul 17 22:29:46.109415 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #2 XmlCallAgentObject: IPv4-name=[] IPv6-name=[] ethernetPhonePort=0 sipPort=0 securedSipPort=0 priority=32767
4486 NOT Jul 17 22:29:46.111032 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #3 XmlCallAgentObject: IPv4-name=[] IPv6-name=[] ethernetPhonePort=0 sipPort=0 securedSipPort=0 priority=32767
4487 NOT Jul 17 22:29:46.112528 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #4 XmlCallAgentObject: IPv4-name=[] IPv6-name=[] ethernetPhonePort=0 sipPort=0 securedSipPort=0 priority=32767
4488 WRN Jul 17 22:29:46.291408 (345-2829) SECUREAPP-SEC_CAPF_N_IN_USE: CAPF not in use, user cancel ignored
4489 NOT Jul 17 22:29:46.341949 (559-1232) JAVA-configmgr MQThread|cip.sec.CapfProperty:? - CapfProp 96

******** Register message  ********

6260 DEB Jul 17 22:29:50.880584 (610-796) JAVA-SIPCC-SIP_STATE: 201/1, sip_reg_sm_change_state: Registration state change: SIP_REG_STATE_REGISTERED ---> SIP_REG_STATE_IDLE
6261 DEB Jul 17 22:29:50.880638 (610-796) JAVA-SIPCC-SIP_MSG_SEND: ccsip_register_send_msg: cmd=85=SIP_REG_REQ ndx=201
6262 DEB Jul 17 22:29:50.880750 (610-796) JAVA-SIPCC-SIP_STATE: 201/1, sip_reg_sm_change_state: Registration state change: SIP_REG_STATE_IDLE ---> SIP_REG_STATE_IDLE

******** Phone sends a SIP REGISTER message to CUCM ********

76 DEB Jul 17 22:29:50.882403 (610-796) JAVA-sipio-sent---> REGISTER sip:198.51.100.31 SIP/2.0^M
Via: SIP/2.0/TCP 198.51.100.109:50020;branch=z9hG4bK775c97a8^M
From: <sip:***@198.51.100.31>;tag=d0ec35c1d98e2e142ea51ccd-2fdbbe4d^M
To: <sip:***@198.51.100.31>^M
Call-ID: d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109^M
Max-Forwards: 70^M
Session-ID: 0ffda3aa00105000a000d0ec35c1d98e;remote=00000000000000000000000000000000^M
Date: Mon, 17 Jul 2023 22:29:50 GMT^M
CSeq: 11749 REGISTER^M
User-Agent: Cisco-CP8811/14.2.1^M
Contact: <sip:***@198.51.100.109:50020;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217"^M
Supported: replaces,join,sdp-anat,norefersub,resource-priority,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-7.0.0,X-cisco-xsi-8.5.1^M
Content-Length: 0^M
Expires: 3600^M
^M

******** SIP Trying message to the REGISTER received from CUCM ********

6284 DEB Jul 17 22:29:50.884485 (610-796) JAVA-sipio-recv<--- SIP/2.0 100 Trying^M
Via: SIP/2.0/TCP 198.51.100.109:50020;branch=z9hG4bK775c97a8^M
From: <sip:***@198.51.100.31>;tag=d0ec35c1d98e2e142ea51ccd-2fdbbe4d^M
To: <sip:***@198.51.100.31>^M
Date: Mon, 17 Jul 2023 22:29:52 GMT^M
Call-ID: d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109^M
CSeq: 11749 REGISTER^M
Content-Length: 0^M
^M

******** 200 OK in response to the REGISTER message from CUCM ********

6294 DEB Jul 17 22:29:50.885744 (610-796) JAVA-sipio-recv<--- SIP/2.0 200 OK^M
Via: SIP/2.0/TCP 198.51.100.109:50020;branch=z9hG4bK775c97a8^M
From: <sip:***@198.51.100.31>;tag=d0ec35c1d98e2e142ea51ccd-2fdbbe4d^M
To: <sip:***@198.51.100.31>;tag=696179034^M
Date: Mon, 17 Jul 2023 22:29:52 GMT^M
Call-ID: d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109^M
Server: Cisco-CUCM14.0^M
CSeq: 11749 REGISTER^M
Expires: 120^M
Contact: <sip:***@198.51.100.109:50020;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217"^M
Supported: X-cisco-srtp-fallback,X-cisco-sis-10.0.0^M
Content-Length: 0^M
^M

IP Phone PCAP Register process

In pcap is shown the complete process on how device perform the communication with the other components as CUCM, TFTP, DHCP. If you want to see in detail what was not seen in the logs, the pcap would be necessary.

A recommended filter in case SIP devices: (((tcp) || (http)) || (sip)) && (ip.addr == XX.XX.XX.XX)

A recommended filter in case SCCP devices: (((tcp) || (http)) || (skinny)) && (ip.addr == XX.XX.XX.XX)

Where the XX.XX.XX.XX is the IP of the phone.

or another option

In case SIP devices: (((tcp) || (http)) || (sip)) && (eth.addr == YYYYYYYYYYYY)

in case SCCP devices: (((tcp) || (http)) || (skinny)) && (eth.addr == YYYYYYYYYYYY)

Where the YYYYYYYYYYYY is the MAC of the phone.

You can also use the MAC address with the colon: eth.addr == YY:YY:YY:YY:YY:YY

The phone opens a TCP session with the TFTP

Phone request the CTL file and receives and 404 not found from the TFTP

Phone request the ITL file and receives from TFTP the file via TCP packets

TFTP sends 200 OK for ITL file request, the phone ACKs the data it received and closes the TCP session

Note: For each request to TFTP the phone try to establish a new TCP connection

Phone requests the configuration file to TFTP and receives from TFTP the file via TCP packets

TFTP sends 200 OK for ITL file request, the phone ACKs the data it received

Phone requests the configurations from TFTP and receives each file via TCP packets.

SIP Register messages and 200 OK from CUCM.

CUCM Traces

******** REFER to inform CUCM about the last registration status ********


REFER sip:198.51.100.31 SIP/2.0
Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK25771c8e
From: "2001" <sip:2001@198.51.100.109>;tag=d0ec35c1d98e00030abbb40d-0dadaa5e
To: <sip:198.51.100.31>
Call-ID: d0ec35c1-d98e0003-657a07f3-6d626333@198.51.100.109
Session-ID: 92eb5cca00105000a000d0ec35c1d98e;remote=00000000000000000000000000000000
Date: Fri, 21 Jul 2023 18:05:31 GMT
CSeq: 1000 REFER
User-Agent: Cisco-CP8811/14.2.1
Expires: 10
Max-Forwards: 70
Contact: <sip:fa7155fd-ec0d-7b35-c49b-86e9f163bf11@198.51.100.109:50806;transport=tcp>;+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E"
Require: norefersub
Referred-By: "2001" <sip:2001@198.51.100.109>
Refer-To: cid:28820b4e@198.51.100.109
Content-Id: <28820b4e@198.51.100.109>
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
Content-Length: 1693
Content-Type: application/x-cisco-alarm+xml
Content-Disposition: session;handling=required



<?xml version="1.0" encoding="UTF-8"?>
<x-cisco-alarm>
<Alarm Name="LastOutOfServiceInformation">
<ParameterList>
<String name="DeviceName">SEPD0EC35C1D98E</String>
<String name="DeviceIPv4Address">198.51.100.109/24</String>
<String name="IPv4DefaultGateway">198.51.100.1</String>
<String name="DeviceIPv6Address"></String>
<String name="IPv6DefaultGateway"></String>
<String name="ModelNumber">CP-8811</String>
<String name="NeighborIPv4Address">198.51.100.98</String>
<String name="NeighborIPv6Address"></String>
<String name="NeighborDeviceID">jpazjaim_SW</String>
<String name="NeighborPortID">GigabitEthernet0/2</String>
<Enum name="DHCPv4Status">1</Enum>
<Enum name="DHCPv6Status">3</Enum>
<Enum name="TFTPCfgStatus">1</Enum>
<Enum name="DNSStatusUnifiedCM1">0</Enum>
<Enum name="DNSStatusUnifiedCM2">0</Enum>
<Enum name="DNSStatusUnifiedCM3">0</Enum>
<Enum name="DNSv6StatusUnifiedCM1">0</Enum>
<Enum name="DNSv6StatusUnifiedCM2">0</Enum>
<Enum name="DNSv6StatusUnifiedCM3">0</Enum>
<String name="VoiceVLAN">360</String>
<String name="UnifiedCMIPAddress">198.51.100.31</String>
<String name="LocalPort">50020</String>
<String name="TimeStamp">1689962095016</String>
<Enum name="ReasonForOutOfService">25</Enum>
<String name="LastProtocolEventSent">Sent:REGISTER sip:198.51.100.31 SIP/2.0 Cseq:11810 REGISTER CallId:d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109 </String>
<String name="LastProtocolEventReceived">Rcvd:SIP/2.0 202 Accepted Cseq:1000 REFER CallId:d0ec35c1-d98e0002-1e0df6e4-4cae92c9@198.51.100.109 </String>
<String name="ReasonForOutOfServiceText">LastTimeInitialized</String>
<String name="ActiveInterface">Wired</String>
</ParameterList>
</Alarm>
</x-cisco-alarm>

******** 202 Accepted message to the REFER ********

SIP/2.0 202 Accepted
Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK25771c8e
From: "2001" <sip:2001@198.51.100.109>;tag=d0ec35c1d98e00030abbb40d-0dadaa5e
To: <sip:198.51.100.31>;tag=1984400291
Date: Fri, 21 Jul 2023 18:08:58 GMT
Call-ID: d0ec35c1-d98e0003-657a07f3-6d626333@198.51.100.109
CSeq: 1000 REFER
Contact: <sip:198.51.100.31:5060;transport=tcp>
Content-Length: 0

******** REGISTER SIP messages from IP Phone ********

REGISTER sip:198.51.100.31 SIP/2.0
Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK0aeff5a4
From: <sip:2001@198.51.100.31>;tag=d0ec35c1d98e00044e764ab3-2227c9d6
To: <sip:2001@198.51.100.31>
Call-ID: d0ec35c1-d98e0002-71e1f429-052f5580@198.51.100.109
Max-Forwards: 70
Session-ID: 92eb5cca00105000a000d0ec35c1d98e;remote=00000000000000000000000000000000
Date: Fri, 21 Jul 2023 18:05:31 GMT
CSeq: 101 REGISTER
User-Agent: Cisco-CP8811/14.2.1
Contact: <sip:fa7155fd-ec0d-7b35-c49b-86e9f163bf11@198.51.100.109:50806;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217"
Supported: replaces,join,sdp-anat,norefersub,resource-priority,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-7.0.0,X-cisco-xsi-8.5.1
Reason: SIP;cause=200;text="cisco-alarm:25 Name=SEPD0EC35C1D98E ActiveLoad=sip88xx.14-2-1-0001-14.loads InactiveLoad=sip88xx.14-0-1-0201-171.loads Last=initialized"
Expires: 3600
Content-Type: multipart/mixed; boundary=uniqueBoundary
Mime-Version: 1.0
Content-Length: 1313

******** CUCM send the 200 OK to the REGISTER message ********

SIP/2.0 200 OK
Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK0aeff5a4
From: <sip:2001@198.51.100.31>;tag=d0ec35c1d98e00044e764ab3-2227c9d6
To: <sip:2001@198.51.100.31>;tag=757446526
Date: Fri, 21 Jul 2023 18:08:58 GMT
Call-ID: d0ec35c1-d98e0002-71e1f429-052f5580@198.51.100.109
Server: Cisco-CUCM14.0
CSeq: 101 REGISTER
Expires: 120
Contact: <sip:fa7155fd-ec0d-7b35-c49b-86e9f163bf11@198.51.100.109:50806;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217";x-cisco-newreg
Supported: X-cisco-srtp-fallback,X-cisco-sis-10.0.0
Content-Type: application/x-cisco-remotecc-response+xml
Content-Length: 381

Troubleshoot many endpoints unregistration

For this issue, a couple of MAC addresses of some affected phones are needed.

To make easier the process, it is necessary to have a text editor such as Notepad++, Visual Studio or others.

To troubleshoot this issue, the event viewer logs can be verified. In the event viewer logs, events such as the registered and unregistered endpoint, ITL and CTL information, endpoint type, active firmware, phone protocol, reason for non-registration and much more can be found here.

Steps to narrow down the issue:

1. Open logs folder in your text editor
   
   
2. Search in all the folders
   
   
3. Search for endpointunregistered
   
   This shows us all the results from syslog folder and SDL files that contain this word.
   
   

5440: Jul 17 21:45:17 cucmsub local6 6 ccm: 19: xxxxxxx.xxxxxx.xx Jul 18 2023 02:45:17 UTC : %UC_CALLMANAGER-6-EndPointUnregistered: %[DeviceName=SEPXXXXXXXXXXXX][IPAddress=198.51.100.117][Protocol=SIP][DeviceType=622][Description=SEPXXXXXXXXXXXX_CP_7841][Reason=28][IPAddrAttributes=0][AppID=Cisco CallManager][ClusterID=SSPTSite}][NodeID=cucmsub]: An endpoint has unregistered 

EndPointUnregistered System Error message explanation

IPAddress: IP for the affected endpoint.

DeviceName: Mac Address for affected endpoint.

Protocol: Protocol with which the endpoint was registered.
DeviceType: Type of endpoint model.

To know the device type model number and name, run on CLI: run sql select enum,name from typemodel 
Description: Description set in Call Manager when registering the phone.

Reason: Reason of the system error message.

Find all the reasons for system error messages here.
IPAddrAttributes: Describe the use of the IP.
AppID: Type of unified server.
NodeID: Node name.

You must focus on the reason number of the error message, mac address and timestamp to match the alert with your occurrence and then navigate to the page where reasons are found. 

Note: The page for system error message contains all alarms available on RTMT, the explanation and description of reasons why the alarm was triggered.

Once you open the page:

1. Press CTRL + F (on windows) or Command + F (on MacOs)

2. Search for EndPointUnregistered

3. Scroll down until you find Enum Definitions - Reason

4. Search the number(s) of the reasons on the system error message

In case more information is needed, the pcap on the phone is the best option to view the phone registration process step by step.

Device Type Model List

To know the device types associated with the DeviceType field that appear in the alert, you can run a query in the CLI of the CUCM where the phones are registered.

Query: run sql select enum,name from typemodel 

enum name 
===== ================================================== 
1 Cisco 30 SP+ 
2 Cisco 12 SP+ 
3 Cisco 12 SP 
4 Cisco 12 S 
5 Cisco 30 VIP 
6 Cisco 7910 
7 Cisco 7960 
8 Cisco 7940 
9 Cisco 7935 
10 Cisco VGC Phone 
11 Cisco VGC Virtual Phone 
12 Cisco ATA 186 
15 EMCC Base Phone 
20 SCCP Phone 
30 Analog Access 
40 Digital Access 
42 Digital Access+ 
43 Digital Access WS-X6608 
47 Analog Access WS-X6624 
48 VGC Gateway 
50 Conference Bridge 
51 Conference Bridge WS-X6608 
52 Cisco IOS Conference Bridge (HDV2) 
53 Cisco Conference Bridge (WS-SVC-CMM) 
61 H.323 Phone 
62 H.323 Gateway 
70 Music On Hold 
71 Device Pilot 
72 CTI Port 
73 CTI Route Point 
80 Voice Mail Port 
83 Cisco IOS Software Media Termination Point (HDV2) 
84 Cisco Media Server (WS-SVC-CMM-MS) 
85 Cisco Video Conference Bridge (IPVC-35xx) 
86 Cisco IOS Heterogeneous Video Conference Bridge 
87 Cisco IOS Guaranteed Audio Video Conference Bridge 
88 Cisco IOS Homogeneous Video Conference Bridge 
90 Route List 
100 Load Simulator 
110 Media Termination Point 
111 Media Termination Point Hardware 
112 Cisco IOS Media Termination Point (HDV2) 
113 Cisco Media Termination Point (WS-SVC-CMM) 
115 Cisco 7941 
119 Cisco 7971 
120 MGCP Station 
121 MGCP Trunk 
122 GateKeeper 
124 7914 14-Button Line Expansion Module 
125 Trunk 
126 Tone Announcement Player 
131 SIP Trunk 
132 SIP Gateway 
133 WSM Trunk 
134 Remote Destination Profile 
227 7915 12-Button Line Expansion Module 
228 7915 24-Button Line Expansion Module 
229 7916 12-Button Line Expansion Module 
230 7916 24-Button Line Expansion Module 
232 CKEM 36-Button Line Expansion Module 
253 SPA8800 
254 Unknown MGCP Gateway 
255 Unknown 
302 Cisco 7985 
307 Cisco 7911 
308 Cisco 7961G-GE 
309 Cisco 7941G-GE 
335 Motorola CN622 
336 Third-party SIP Device (Basic) 
348 Cisco 7931 
358 Cisco Unified Personal Communicator 
365 Cisco 7921 
369 Cisco 7906 
374 Third-party SIP Device (Advanced) 
375 Cisco TelePresence 
376 Nokia S60 
404 Cisco 7962 
412 Cisco 3951 
431 Cisco 7937 
434 Cisco 7942 
435 Cisco 7945 
436 Cisco 7965 
437 Cisco 7975 
446 Cisco 3911 
468 Cisco Unified Mobile Communicator 
478 Cisco TelePresence 1000 
479 Cisco TelePresence 3000 
480 Cisco TelePresence 3200 
481 Cisco TelePresence 500-37 
484 Cisco 7925 
493 Cisco 9971 
495 Cisco 6921 
496 Cisco 6941 
497 Cisco 6961 
503 Cisco Unified Client Services Framework 
505 Cisco TelePresence 1300-65 
520 Cisco TelePresence 1100 
521 Transnova S3 
522 BlackBerry MVS VoWifi 
537 Cisco 9951 
540 Cisco 8961 
547 Cisco 6901 
548 Cisco 6911 
550 Cisco ATA 187 
557 Cisco TelePresence 200 
558 Cisco TelePresence 400 
562 Cisco Dual Mode for iPhone 
564 Cisco 6945 
575 Cisco Dual Mode for Android 
577 Cisco 7926 
580 Cisco E20 
582 Generic Single Screen Room System 
583 Generic Multiple Screen Room System 
584 Cisco TelePresence EX90 
585 Cisco 8945 
586 Cisco 8941 
588 Generic Desktop Video Endpoint 
590 Cisco TelePresence 500-32 
591 Cisco TelePresence 1300-47 
592 Cisco 3905 
593 Cisco Cius 
594 VKEM 36-Button Line Expansion Module 
596 Cisco TelePresence TX1310-65 
597 Cisco TelePresence MCU 
598 Ascom IP-DECT Device 
599 Cisco TelePresence Exchange System 
604 Cisco TelePresence EX60 
606 Cisco TelePresence Codec C90 
607 Cisco TelePresence Codec C60 
608 Cisco TelePresence Codec C40 
609 Cisco TelePresence Quick Set C20 
610 Cisco TelePresence Profile 42 (C20) 
611 Cisco TelePresence Profile 42 (C60) 
612 Cisco TelePresence Profile 52 (C40) 
613 Cisco TelePresence Profile 52 (C60) 
614 Cisco TelePresence Profile 52 Dual (C60) 
615 Cisco TelePresence Profile 65 (C60) 
616 Cisco TelePresence Profile 65 Dual (C90) 
617 Cisco TelePresence MX200 
619 Cisco TelePresence TX9000 
620 Cisco TelePresence TX9200 
621 Cisco 7821 
622 Cisco 7841 
623 Cisco 7861 
626 Cisco TelePresence SX20 
627 Cisco TelePresence MX300 
628 IMS-integrated Mobile (Basic) 
631 Third-party AS-SIP Endpoint 
632 Cisco Cius SP 
633 Cisco TelePresence Profile 42 (C40) 
634 Cisco VXC 6215 
635 CTI Remote Device 
640 Usage Profile 
642 Carrier-integrated Mobile 
645 Universal Device Template 
647 Cisco DX650 
648 Cisco Unified Communications for RTX 
652 Cisco Jabber for Tablet 
659 Cisco 8831 
681 Cisco ATA 190 
682 Cisco TelePresence SX10 
683 Cisco 8841 
684 Cisco 8851 
685 Cisco 8861 
688 Cisco TelePresence SX80 
689 Cisco TelePresence MX200 G2 
690 Cisco TelePresence MX300 G2 
20000 Cisco 7905 
30002 Cisco 7920 
30006 Cisco 7970 
30007 Cisco 7912 
30008 Cisco 7902 
30016 Cisco IP Communicator 
30018 Cisco 7961 
30019 Cisco 7936 
30027 Analog Phone 
30028 ISDN BRI Phone 
30032 SCCP gateway virtual phone 
30035 IP-STE 
36041 Cisco TelePresence Conductor 
36042 Cisco DX80 
36043 Cisco DX70 
36049 BEKEM 36-Button Line Expansion Module 
36207 Cisco TelePresence MX700 
36208 Cisco TelePresence MX800 
36210 Cisco TelePresence IX5000 
36213 Cisco 7811 
36216 Cisco 8821 
36217 Cisco 8811 
36219 Interactive Voice Response 
36224 Cisco 8845 
36225 Cisco 8865 
36227 Cisco TelePresence MX800 Dual 
36232 Cisco 8851NR 
36235 Cisco Spark Remote Device 
36239 Cisco Webex DX80 
36241 Cisco TelePresence DX70 
36247 Cisco 7832 
36248 Cisco 8865NR 
36250 Cisco Meeting Server 
36251 Cisco Webex Room Kit 
36254 Cisco Webex Room 55 
36255 Cisco Webex Room Kit Plus 
36256 CP-8800-Video 28-Button Key Expansion Module 
36257 CP-8800-Audio 28-Button Key Expansion Module 
36258 Cisco 8832 
36259 Cisco Webex Room 70 Single 
36260 Cisco 8832NR 
36262 Cisco ATA 191 
36265 Cisco Webex Room 70 Dual 
36292 Cisco Webex Room Kit Pro 
36295 Cisco Webex Room 55 Dual 
36296 Cisco Webex Room 70 Single G2 
36297 Cisco Webex Room 70 Dual G2 
36299 Cisco Webex Room Kit Mini 
36304 Cisco Webex Board 55 
36305 Cisco Webex Board 70 
36306 Cisco Webex Board 85 
36307 Cisco Webex Desk Pro 
36308 Cisco Webex Room Panorama 
36309 Cisco Webex Room 70 Panorama 
36312 Cisco Webex Room Phone

Note: The result of the query can change based on the CUCM version.

Related Information

• Cisco Technical Support & Downloads