IP Corp > News > news > Cisco SBC CSR 1000v cannot handle REFER Message from Microsoft Teams
  • George Goglidze
  • 4 Comments

(To bug or not to bug, that is the question)

by George Goglidze, CCIE #19926

1. Lab information

To find out more about the actual integration of CUCM with Microsoft Teams, we explain this in detail on the following link:

https://ipcorp.co.uk/microsoft-teams-direct-routing-cisco-cucm-integration/

As a note and the important/relevant part of the configuration, the sip refer supplementary service has been disabled on the SBC with the following command:

voice service voip
 no supplementary-service sip refer 

1.1. Auto Attendant Setup

I will not explain in this post, how to setup Auto Attendant and the Queues on Microsoft Teams, but if this is something anyone needs, please commend and I will get into that detail too.

I’ve setup a simple AutoAttendant on the DR number: +442010000003

With just a simple welcome to “CCIE CLUB” message and a simple transfer to the Queue with agents.

2. Call scenario

Jabber User on CUCM, is calling +442010000003.

Results:

Jabber user can hear the welcome message, “Welcome to CCIE CLUB, we will not transfer your call”.

After a few seconds the call drops.

And the below error is received from Microsoft Teams:

SIP/2.0 400 Bad Request

REASON: Q.850;cause=95;text=”8aead7d4-10cb-4d9f-9ed6-5171b263005a;Invalid ReferredBy header: mismatched token found: “

How do we go about troubleshooting something like this? There can be various issues, but in this case I’ve nailed it down to be some kind of bug on the Cisco CSR 1000v.

Let’s have a look at some SIP traces on the SBC.

3. Troubleshooting

I have enabled the “debug ccsip messages” on the SBC and have collected the output to the file.

I’ll provide here all the relevant traces to show how I have analysed the problem.

The below is the first INVITE received incoming to SBC from the CUCM:

Mar 14 18:33:49.475: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
INVITE sip:+442010000003@sbc1.ccie.club:5061 SIP/2.0
Via: SIP/2.0/TLS 192.168.65.10:5061;branch=z9hG4bK6e3e4579ba
From: <sip:+442050001001@192.168.65.10>;tag=331~21e03cd6-4580-490d-bcf6-63c781c2f8fd-20421114
To: <sip:+442010000003@sbc1.ccie.club>
Date: Sun, 14 Mar 2021 18:33:49 GMT
Call-ID: cf95d380-4e1570c-52-a41a8c0@192.168.65.10
Supported: timer,resource-priority,replaces
Min-SE: 1800
User-Agent: Cisco-CUCM11.5
Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY
CSeq: 101 INVITE
Expires: 180
Allow-Events: presence, kpml
Supported: X-cisco-srtp-fallback,X-cisco-original-called
Call-Info: <sip:192.168.65.10:5061>;method=”NOTIFY;Event=telephone-event;Duration=500″
Call-Info: <urn:x-cisco-remotecc:callinfo>;x-cisco-video-traffic-class=DESKTOP
Session-ID: 0000336400105000a0002cea7f1a2ebb;remote=00000000000000000000000000000000
Cisco-Guid: 3482702720-0000065536-0000000005-0172075200
Session-Expires: 1800
P-Asserted-Identity: <sip:+442050001001@192.168.65.10>
Remote-Party-ID: <sip:+442050001001@192.168.65.10>;party=calling;screen=yes;privacy=off
Contact: <sip:+442050001001@192.168.65.10:5061;transport=tls>;video;audio;+u.sip!devicename.ccm.cisco.com=”CSFGeorge1″;bfcp
Max-Forwards: 69
Content-Type: application/sdp
Content-Length: 3732

v=0
o=CiscoSystemsCCM-SIP 331 1 IN IP4 192.168.65.10
s=SIP Call
c=IN IP4 192.168.65.20
b=TIAS:384000
b=AS:384
t=0 0
a=cisco-mari:v1
a=cisco-mari-rate
m=audio 23060 RTP/SAVP 114 9 104 105 0 8 18 111 101
a=crypto:1 AEAD_AES_256_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:2 AEAD_AES_128_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:3 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:4 AES_CM_128_HMAC_SHA1_32 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:5 AEAD_AES_256_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:6 AEAD_AES_128_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:7 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:8 AES_CM_128_HMAC_SHA1_32 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=extmap:14/sendrecv http://protocols.cisco.com/timestamp#100us
a=rtpmap:114 opus/48000/2
a=rtpmap:9 G722/8000
a=rtpmap:104 G7221/16000
a=fmtp:104 bitrate=32000
a=rtpmap:105 G7221/16000
a=fmtp:105 bitrate=24000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:111 X-ULPFECUC/8000
a=fmtp:111 max_esel=1420;m=8;max_n=32;FEC_ORDER=FEC_SRTP
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
m=video 27020 RTP/SAVP 126 97 111
b=TIAS:384000
a=crypto:1 AEAD_AES_256_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:2 AEAD_AES_128_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:3 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:4 AES_CM_128_HMAC_SHA1_32 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:5 AEAD_AES_256_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:6 AEAD_AES_128_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:7 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:8 AES_CM_128_HMAC_SHA1_32 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=label:11
a=extmap:14/sendrecv http://protocols.cisco.com/timestamp#100us
a=rtpmap:126 H264/90000
a=fmtp:126 profile-level-id=42801F;packetization-mode=1;max-mbps=244800;max-fs=8161;max-rcmd-nalu-size=32000;level-asymmetry-allowed=1
a=imageattr:126 recv [x=[32:1:1920],y=[18:1:1080],par=1.7778,q=1.00]
a=rtpmap:97 H264/90000
a=fmtp:97 profile-level-id=42801F;packetization-mode=0;max-mbps=244800;max-fs=8161;level-asymmetry-allowed=1
a=imageattr:97 recv [x=[32:1:1920],y=[18:1:1080],par=1.7778,q=1.00]
a=rtpmap:111 X-ULPFECUC/90000
a=fmtp:111 max_esel=1420;m=8;max_n=32;FEC_ORDER=FEC_SRTP
a=content:main
a=rtcp-fb:* ccm fir
a=rtcp-fb:* ccm tmmbr
a=rtcp-fb:* nack pli
m=application 35928 RTP/SAVP 125
a=crypto:1 AEAD_AES_256_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:2 AEAD_AES_128_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:3 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:4 AES_CM_128_HMAC_SHA1_32 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:5 AEAD_AES_256_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:6 AEAD_AES_128_GCM inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:7 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=crypto:8 AES_CM_128_HMAC_SHA1_32 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=rtpmap:125 H224/4800
a=rtcp:35929

Then we send out Trying to CUCM to let it know that we are doing something with this message:

Mar 14 18:33:49.992: //811/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 100 Trying
Via: SIP/2.0/TLS 192.168.65.10:5061;branch=z9hG4bK6e3e4579ba
From: <sip:+442050001001@192.168.65.10>;tag=331~21e03cd6-4580-490d-bcf6-63c781c2f8fd-20421114
To: <sip:+442010000003@sbc1.ccie.club>
Date: Sun, 14 Mar 2021 18:33:49 GMT
Call-ID: cf95d380-4e1570c-52-a41a8c0@192.168.65.10
CSeq: 101 INVITE
Allow-Events: telephone-event
Server: Cisco-SIPGateway/IOS-16.12.5
Session-ID: 00000000000000000000000000000000;remote=0000336400105000a0002cea7f1a2ebb
Content-Length: 0

Next message is the INVITE sent to Microsoft Teams.

Mar 14 18:33:50.424: //814/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Sent:
INVITE sip:+442010000003@sip.pstnhub.microsoft.com:5061;user=phone SIP/2.0
Via: SIP/2.0/TLS 192.168.5.100:5061;branch=z9hG4bK1F71635
From: <sip:+442050001001@sbc1.ccie.club>;tag=4D3200-2302
To: <sip:+442010000003@sip.pstnhub.microsoft.com>
Date: Sun, 14 Mar 2021 18:33:50 GMT
Call-ID: A78C10D9-842A11EB-831CCBFD-9896332@sbc1.ccie.club
Supported: timer,resource-priority,replaces,sdp-anat
Min-SE: 1800
Cisco-Guid: 3482702720-0000065536-0000000005-0172075200
User-Agent: Cisco-SIPGateway/IOS-16.12.5
X-MS-SBC: Cisco UBE/CSR1000/IOS-16.12.5
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
CSeq: 101 INVITE
Timestamp: 1615746830
Contact: <sip:+442050001001@sbc1.ccie.club:5061;transport=tls>
Expires: 180
Allow-Events: telephone-event
Max-Forwards: 68
Session-ID: 0000336400105000a0002cea7f1a2ebb;remote=00000000000000000000000000000000
Session-Expires: 1800
Content-Type: application/sdp
Content-Disposition: session;handling=required
Content-Length: 1530

v=0
o=CiscoSystemsSIP-GW-UserAgent 5951 2571 IN IP4 192.168.5.100
s=SIP Call
c=IN IP4 5.68.80.111
t=0 0
a=ice-lite
m=audio 8054 RTP/SAVP 8 101
c=IN IP4 5.68.80.111
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=candidate:1 1 UDP 2130706431 5.68.80.111 8054 typ host
a=candidate:1 2 UDP 2130706430 5.68.80.111 8055 typ host
a=rtcp:8055 IN IP4 5.68.80.111
a=ice-ufrag:pgwZ
a=ice-pwd:kzAHK4Elq75BIOgwlxDgK3
m=video 8050 RTP/SAVP 119 98
c=IN IP4 192.168.5.100
b=TIAS:384000
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=rtpmap:119 H264/90000
a=fmtp:119 profile-level-id=42801F;packetization-mode=1;max-mbps=245000;max-fs=8192
a=rtpmap:98 H264/90000
a=fmtp:98 profile-level-id=42801F;packetization-mode=0;max-mbps=245000;max-fs=8192
a=candidate:1 1 UDP 2130706431 192.168.5.100 8050 typ host
a=candidate:1 2 UDP 2130706430 192.168.5.100 8051 typ host
a=rtcp:8051 IN IP4 192.168.5.100
a=ice-ufrag:R8gp
a=ice-pwd:79UAM8nmRFUMsWzykNs0CC
a=label:11
a=content:main
m=application 8052 RTP/SAVP 125
c=IN IP4 192.168.5.100
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=rtpmap:125 H224/4800
a=candidate:1 1 UDP 2130706431 192.168.5.100 8052 typ host
a=candidate:1 2 UDP 2130706430 192.168.5.100 8053 typ host
a=rtcp:8053 IN IP4 192.168.5.100
a=ice-ufrag:yVmS
a=ice-pwd:4ZbJeL7IdnQRnFVFTSWU6l

We get trying from Microsoft Teams:

Mar 14 18:33:50.482: //814/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Received:
SIP/2.0 100 Trying
FROM: <sip:+442050001001@sbc1.ccie.club>;tag=4D3200-2302
TO: <sip:+442010000003@sip.pstnhub.microsoft.com>
CSEQ: 101 INVITE
CALL-ID: A78C10D9-842A11EB-831CCBFD-9896332@sbc1.ccie.club
VIA: SIP/2.0/TLS 192.168.5.100:5061;branch=z9hG4bK1F71635
CONTENT-LENGTH: 0
ALLOW: INVITE,ACK,OPTIONS,CANCEL,BYE,NOTIFY
SERVER: Microsoft.PSTNHub.SIPProxy v.2021.3.10.9 i.EUWE.6
TIMESTAMP: 1615746830

And now we get Ringing form Microsoft Teams.

Mar 14 18:33:50.579: //814/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Received:
SIP/2.0 180 Ringing
FROM: <sip:+442050001001@sbc1.ccie.club>;tag=4D3200-2302
TO: <sip:+442010000003@sip.pstnhub.microsoft.com>;tag=eccd54e9d9fe4bb0a93394e74ef3604d
CSEQ: 101 INVITE
CALL-ID: A78C10D9-842A11EB-831CCBFD-9896332@sbc1.ccie.club
VIA: SIP/2.0/TLS 192.168.5.100:5061;branch=z9hG4bK1F71635
RECORD-ROUTE: <sip:sip-du-a-eu.pstnhub.microsoft.com:5061;transport=tls;lr>
CONTACT: <sip:api-du-b-euwe.pstnhub.microsoft.com:443;x-i=25cbb015-82e2-45b9-b55d-13ebc092a082;x-c=cc1c720c42775f4d9b74a16c76af6d65/s/1/a225c61ca3ce4050b648445c1e0b1e64>
CONTENT-LENGTH: 0
ALLOW: INVITE,ACK,OPTIONS,CANCEL,BYE,NOTIFY
SERVER: Microsoft.PSTNHub.SIPProxy v.2021.3.10.9 i.EUWE.6

We send the ringing to CUCM. At this point Jabber will generate a ringing tone:

Mar 14 18:33:50.740: //811/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 180 Ringing
Via: SIP/2.0/TLS 192.168.65.10:5061;branch=z9hG4bK6e3e4579ba
From: <sip:+442050001001@192.168.65.10>;tag=331~21e03cd6-4580-490d-bcf6-63c781c2f8fd-20421114
To: <sip:+442010000003@sbc1.ccie.club>;tag=4D3406-109E
Date: Sun, 14 Mar 2021 18:33:49 GMT
Call-ID: cf95d380-4e1570c-52-a41a8c0@192.168.65.10
CSeq: 101 INVITE
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
Allow-Events: telephone-event
Contact: <sip:+442010000003@192.168.65.100:5061;transport=tls>
Server: Cisco-SIPGateway/IOS-16.12.5
Session-ID: f1d0e26895c9556d9b309237777da7c6;remote=0000336400105000a0002cea7f1a2ebb
Content-Length: 0

We get 200 OK from Microsoft Teams, which means the call was accepted.

Mar 14 18:33:54.613: //814/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Received:
SIP/2.0 200 OK
FROM: <sip:+442050001001@sbc1.ccie.club>;tag=4D3200-2302
TO: <sip:+442010000003@sip.pstnhub.microsoft.com>;tag=7af3e5871d9a462796603279e9f213aa
CSEQ: 101 INVITE
CALL-ID: A78C10D9-842A11EB-831CCBFD-9896332@sbc1.ccie.club
VIA: SIP/2.0/TLS 192.168.5.100:5061;branch=z9hG4bK1F71635
RECORD-ROUTE: <sip:sip-du-a-eu.pstnhub.microsoft.com:5061;transport=tls;lr>
CONTACT: <sip:api-du-b-euwe.pstnhub.microsoft.com:443;x-i=25cbb015-82e2-45b9-b55d-13ebc092a082;x-c=cc1c720c42775f4d9b74a16c76af6d65/s/1/a225c61ca3ce4050b648445c1e0b1e64>
CONTENT-LENGTH: 850
CONTENT-TYPE: application/sdp
ALLOW: INVITE,ACK,OPTIONS,CANCEL,BYE,NOTIFY
SERVER: Microsoft.PSTNHub.SIPProxy v.2021.3.10.9 i.EUWE.6

v=0
o=- 826523 0 IN IP4 127.0.0.1
s=session
c=IN IP4 52.113.228.178
b=CT:10000000
t=0 0
m=audio 51988 RTP/SAVP 8 101
c=IN IP4 52.113.228.178
a=rtcp:51989
a=ice-ufrag:JGZM
a=ice-pwd:Kj5PXf7B0+AMsuZ8Rd9z+KY9
a=candidate:1 1 UDP 2130706431 52.113.228.178 51988 typ srflx raddr 10.0.37.236 rport 51988
a=candidate:1 2 UDP 2130705918 52.113.228.178 51989 typ srflx raddr 10.0.37.236 rport 51989
a=candidate:2 1 tcp-act 2121006078 52.113.228.178 49152 typ srflx raddr 10.0.37.236 rport 49152
a=candidate:2 2 tcp-act 2121006078 52.113.228.178 49152 typ srflx raddr 10.0.37.236 rport 49152
a=mid:1
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=sendrecv
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
m=video 0 RTP/SAVP 119 98
m=application 0 RTP/SAVP 125

Mar 14 18:33:54.711: //814/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Sent:
ACK sip:api-du-b-euwe.pstnhub.microsoft.com:443;x-i=25cbb015-82e2-45b9-b55d-13ebc092a082;x-c=cc1c720c42775f4d9b74a16c76af6d65/s/1/a225c61ca3ce4050b648445c1e0b1e64 SIP/2.0
Via: SIP/2.0/TLS 192.168.5.100:5061;branch=z9hG4bK1F81E4C
From: <sip:+442050001001@sbc1.ccie.club>;tag=4D3200-2302
To: <sip:+442010000003@sip.pstnhub.microsoft.com>;tag=7af3e5871d9a462796603279e9f213aa
Date: Sun, 14 Mar 2021 18:33:50 GMT
Call-ID: A78C10D9-842A11EB-831CCBFD-9896332@sbc1.ccie.club
Route: <sip:sip-du-a-eu.pstnhub.microsoft.com:5061;transport=tls;lr>
Max-Forwards: 70
CSeq: 101 ACK
Allow-Events: telephone-event
Session-ID: 0000336400105000a0002cea7f1a2ebb;remote=b05f87c467ac53d28d4734b1b26e33f6
Content-Length: 0

We send ACK to the 200 OK to Microsoft Teams, to achnowledge that we are happy with the call and now this call leg is established.

Mar 14 18:33:54.993: //811/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 200 OK
Via: SIP/2.0/TLS 192.168.65.10:5061;branch=z9hG4bK6e3e4579ba
From: <sip:+442050001001@192.168.65.10>;tag=331~21e03cd6-4580-490d-bcf6-63c781c2f8fd-20421114
To: <sip:+442010000003@sbc1.ccie.club>;tag=4D3406-109E
Date: Sun, 14 Mar 2021 18:33:49 GMT
Call-ID: cf95d380-4e1570c-52-a41a8c0@192.168.65.10
CSeq: 101 INVITE
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
Allow-Events: telephone-event
Contact: <sip:+442010000003@192.168.65.100:5061;transport=tls>
Supported: replaces
Supported: sdp-anat
Server: Cisco-SIPGateway/IOS-16.12.5
Session-ID: b05f87c467ac53d28d4734b1b26e33f6;remote=0000336400105000a0002cea7f1a2ebb
Session-Expires: 1800;refresher=uac
Require: timer
Supported: timer
Content-Type: application/sdp
Content-Disposition: session;handling=required
Content-Length: 420

v=0
o=CiscoSystemsSIP-GW-UserAgent 3056 347 IN IP4 192.168.65.100
s=SIP Call
c=IN IP4 192.168.65.100
t=0 0
a=ice-lite
m=audio 8046 RTP/SAVP 8
c=IN IP4 192.168.65.100
a=rtpmap:8 PCMA/8000
a=ptime:20
a=crypto:3 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
m=video 0 RTP/SAVP 126
c=IN IP4 192.168.65.100
m=application 0 RTP/SAVP 125
c=IN IP4 192.168.65.100
a=rtpmap:125 H224/4800

Next we resend the 200 OK to CUCM.

Mar 14 18:33:55.490: //811/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 200 OK
Via: SIP/2.0/TLS 192.168.65.10:5061;branch=z9hG4bK6e3e4579ba
From: <sip:+442050001001@192.168.65.10>;tag=331~21e03cd6-4580-490d-bcf6-63c781c2f8fd-20421114
To: <sip:+442010000003@sbc1.ccie.club>;tag=4D3406-109E
Date: Sun, 14 Mar 2021 18:33:49 GMT
Call-ID: cf95d380-4e1570c-52-a41a8c0@192.168.65.10
CSeq: 101 INVITE
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
Allow-Events: telephone-event
Contact: <sip:+442010000003@192.168.65.100:5061;transport=tls>
Supported: replaces
Supported: sdp-anat
Server: Cisco-SIPGateway/IOS-16.12.5
Session-ID: b05f87c467ac53d28d4734b1b26e33f6;remote=0000336400105000a0002cea7f1a2ebb
Session-Expires: 1800;refresher=uac
Require: timer
Supported: timer
Content-Type: application/sdp
Content-Disposition: session;handling=required
Content-Length: 420

v=0
o=CiscoSystemsSIP-GW-UserAgent 3056 347 IN IP4 192.168.65.100
s=SIP Call
c=IN IP4 192.168.65.100
t=0 0
a=ice-lite
m=audio 8046 RTP/SAVP 8
c=IN IP4 192.168.65.100
a=rtpmap:8 PCMA/8000
a=ptime:20
a=crypto:3 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
m=video 0 RTP/SAVP 126
c=IN IP4 192.168.65.100
m=application 0 RTP/SAVP 125
c=IN IP4 192.168.65.100
a=rtpmap:125 H224/4800

Now we receive an ACK from CUCM, and the call is fully established.  At this point we can hear the Welcome message of the Auto Attendant.

Mar 14 18:33:55.497: //811/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Received:
ACK sip:+442010000003@192.168.65.100:5061;transport=tls SIP/2.0
Via: SIP/2.0/TLS 192.168.65.10:5061;branch=z9hG4bK6fe3de392
From: <sip:+442050001001@192.168.65.10>;tag=331~21e03cd6-4580-490d-bcf6-63c781c2f8fd-20421114
To: <sip:+442010000003@sbc1.ccie.club>;tag=4D3406-109E
Date: Sun, 14 Mar 2021 18:33:49 GMT
Call-ID: cf95d380-4e1570c-52-a41a8c0@192.168.65.10
User-Agent: Cisco-CUCM11.5
Max-Forwards: 70
CSeq: 101 ACK
Allow-Events: presence, kpml
Content-Length: 0

Now from this point on, Auto Attendant has queued us to the agent, and is sending us REFER message to transfer the call. Things go wrong from this point on. So the intreating part starts 🙂

Mar 14 18:34:03.041: //814/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Received:
REFER sip:+442050001001@sbc1.ccie.club:5061;transport=tls SIP/2.0
FROM: <sip:+442010000003@sip.pstnhub.microsoft.com>;tag=7af3e5871d9a462796603279e9f213aa
TO: <sip:+442050001001@sbc1.ccie.club>;tag=4D3200-2302
CSEQ: 1 REFER
CALL-ID: A78C10D9-842A11EB-831CCBFD-9896332@sbc1.ccie.club
MAX-FORWARDS: 70
VIA: SIP/2.0/TLS 52.114.75.24:5061;branch=z9hG4bK9c3086da
CONTACT: <sip:api-du-b-euwe.pstnhub.microsoft.com:443;x-i=25cbb015-82e2-45b9-b55d-13ebc092a082;x-c=cc1c720c42775f4d9b74a16c76af6d65/s/1/a225c61ca3ce4050b648445c1e0b1e64>
CONTENT-LENGTH: 0
REFER-TO: <sip:sip.pstnhub.microsoft.com:5061;transport=tls;x-m=28:orgid:0daee734-117e-4833-afc8-7470e2431f68;x-t=de6c105c-078a-408e-91c4-7dcba04684c8>
REFERRED-BY: <sip:sip.pstnhub.microsoft.com:5061;x-m=28:orgid:8befa294-d839-451b-b83f-5ed105cad187;x-t=de6c105c-078a-408e-91c4-7dcba04684c8;x-ti=25cbb015-82e2-45b9-b55d-13ebc092a082;x-tt=aHR0cHM6Ly9hcGktZHUtYi1ldXdlLnBzdG5odWIubWljcm9zb2Z0LmNvbS92MS9uZ2MvY2FsbG5vdGlmaWNhdGlvbj9kY2k9MTVjNThhNWJkZGYyNGJkMGFjNjU4ODg3YjU5MzhmNjM%3D>
USER-AGENT: Microsoft.PSTNHub.SIPProxy v.2021.3.10.9 i.EUWE.2
ALLOW: INVITE,ACK,OPTIONS,CANCEL,BYE,NOTIFY

The next message is just SBC accepting the REFER.

Mar 14 18:34:03.214: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 202 Accepted
Via: SIP/2.0/TLS 52.114.75.24:5061;branch=z9hG4bK9c3086da
From: <sip:+442010000003@sip.pstnhub.microsoft.com>;tag=7af3e5871d9a462796603279e9f213aa
To: <sip:+442050001001@sbc1.ccie.club>;tag=4D3200-2302
Date: Sun, 14 Mar 2021 18:34:03 GMT
Call-ID: A78C10D9-842A11EB-831CCBFD-9896332@sbc1.ccie.club
Server: Cisco-SIPGateway/IOS-16.12.5
X-MS-SBC: Cisco UBE/CSR1000/IOS-16.12.5
CSeq: 1 REFER
Content-Length: 0
Contact: <sip:+442050001001@sbc1.ccie.club:5061;transport=tls>

Next we send an Notification to Microsoft Teams, indicating that we are Trying this call:

Mar 14 18:34:03.288: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Sent:
NOTIFY sip:api-du-b-euwe.pstnhub.microsoft.com:443;x-i=25cbb015-82e2-45b9-b55d-13ebc092a082;x-c=cc1c720c42775f4d9b74a16c76af6d65/s/1/a225c61ca3ce4050b648445c1e0b1e64 SIP/2.0
Via: SIP/2.0/TLS 192.168.5.100:5061;branch=z9hG4bK1FA1447
From: <sip:+442050001001@sbc1.ccie.club>;tag=4D3200-2302
To: <sip:+442010000003@sip.pstnhub.microsoft.com>;tag=7af3e5871d9a462796603279e9f213aa
Call-ID: A78C10D9-842A11EB-831CCBFD-9896332@sbc1.ccie.club
CSeq: 102 NOTIFY
Max-Forwards: 70
Date: Sun, 14 Mar 2021 18:34:03 GMT
User-Agent: Cisco-SIPGateway/IOS-16.12.5
X-MS-SBC: Cisco UBE/CSR1000/IOS-16.12.5
Event: refer
Subscription-State: pending;expires=180
Route: <sip:sip-du-a-eu.pstnhub.microsoft.com:5061;transport=tls;lr>
Contact: <sip:+442050001001@sbc1.ccie.club:5061;transport=tls>
Content-Type: message/sipfrag
Content-Length: 22

SIP/2.0 100 Trying

Now we receive 200 OK for the Notification:

Mar 14 18:34:03.337: //0/000000000000/SIP/Msg/ccsipDisplayMsg:
Received:
SIP/2.0 200 OK
FROM: <sip:+442050001001@sbc1.ccie.club>;tag=4D3200-2302
TO: <sip:+442010000003@sip.pstnhub.microsoft.com>;tag=7af3e5871d9a462796603279e9f213aa
CSEQ: 102 NOTIFY
CALL-ID: A78C10D9-842A11EB-831CCBFD-9896332@sbc1.ccie.club
VIA: SIP/2.0/TLS 192.168.5.100:5061;branch=z9hG4bK1FA1447
CONTENT-LENGTH: 0
ALLOW: INVITE,ACK,OPTIONS,CANCEL,BYE,NOTIFY
SERVER: Microsoft.PSTNHub.SIPProxy v.2021.3.10.9 i.EUWE.6

Now we send an Invite back to Microsoft Teams, with the new destination:

Mar 14 18:34:03.434: //823/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Sent:
INVITE sip:sip.pstnhub.microsoft.com:5061;transport=tls;x-m=28:orgid:0daee734-117e-4833-afc8-7470e2431f68;x-t=de6c105c-078a-408e-91c4-7dcba04684c8 SIP/2.0
Via: SIP/2.0/TLS 5.68.80.111:5061;branch=z9hG4bK1FBC8D
From: <sip:+442050001001@sbc1.ccie.club>;tag=4D65A5-1A60
To: <sip:sip.pstnhub.microsoft.com:5061;transport=tls;x-m=28:orgid:0daee734-117e-4833-afc8-7470e2431f68;x-t=de6c105c-078a-408e-91c4-7dcba04684c8>
Date: Sun, 14 Mar 2021 18:34:03 GMT
Call-ID: AF8F2827-842A11EB-8320CBFD-9896332@sbc1.ccie.club
Supported: timer,resource-priority,replaces,sdp-anat
Min-SE: 1800
Cisco-Guid: 3482702720-0000065536-0000000005-0172075200
User-Agent: Cisco-SIPGateway/IOS-16.12.5
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
CSeq: 101 INVITE
Timestamp: 1615746843
Contact: <sip:+442050001001@sbc1.ccie.club:5061;transport=tls>
Expires: 180
Referred-By: <sip:sip.pstnhub.microsoft.com:5061;x-m=28:orgid:8befa294-d839-451b-b83f-5ed105cad187;x-t=de6c105c-078a-408e-91c4-7dcba04684c8;x-ti=25cbb015-82e2-45b9-b55d-13ebc092a082;x-tt=aHR0cHM6Ly9hcGktZHUtYi1ldXdlLnBzdG5odWIubWljcm9zb2Z0LmNvbS92MS9uZ2MvY2FsbG5vdGlm
Allow-Events: telephone-event
Max-Forwards: 68
Session-ID: 0000336400105000a0002cea7f1a2ebb;remote=00000000000000000000000000000000
Session-Expires: 1800
Content-Type: application/sdp
Content-Disposition: session;handling=required
Content-Length: 543

v=0
o=CiscoSystemsSIP-GW-UserAgent 427 7284 IN IP4 5.68.80.111
s=SIP Call
c=IN IP4 5.68.80.111
t=0 0
a=ice-lite
m=audio 8056 RTP/SAVP 8 101
c=IN IP4 5.68.80.111
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
a=candidate:1 1 UDP 2130706431 5.68.80.111 8056 typ host
a=candidate:1 2 UDP 2130706430 5.68.80.111 8057 typ host
a=rtcp:8057 IN IP4 5.68.80.111
a=ice-ufrag:M03p
a=ice-pwd:KUa4WmxAiRGOO5TZa6HaYa

Now we receive Trying from Microsoft Teams:

Mar 14 18:34:03.477: //823/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Received:
SIP/2.0 100 Trying
FROM: <sip:+442050001001@sbc1.ccie.club>;tag=4D65A5-1A60
TO: <sip:sip.pstnhub.microsoft.com:5061;transport=tls;x-m=28:orgid:0daee734-117e-4833-afc8-7470e2431f68;x-t=de6c105c-078a-408e-91c4-7dcba04684c8>
CSEQ: 101 INVITE
CALL-ID: AF8F2827-842A11EB-8320CBFD-9896332@sbc1.ccie.club
VIA: SIP/2.0/TLS 5.68.80.111:5061;branch=z9hG4bK1FBC8D
CONTENT-LENGTH: 0
ALLOW: INVITE,ACK,OPTIONS,CANCEL,BYE,NOTIFY
SERVER: Microsoft.PSTNHub.SIPProxy v.2021.3.10.9 i.EUWE.6
TIMESTAMP: 1615746843

And finally here is the error message from Microsoft Teams:

Mar 14 18:34:03.485: //823/CF95D3800000/SIP/Msg/ccsipDisplayMsg:
Received:
SIP/2.0 400 Bad Request
FROM: <sip:+442050001001@sbc1.ccie.club>;tag=4D65A5-1A60
TO: <sip:sip.pstnhub.microsoft.com:5061;transport=tls;x-m=28:orgid:0daee734-117e-4833-afc8-7470e2431f68;x-t=de6c105c-078a-408e-91c4-7dcba04684c8>
CSEQ: 101 INVITE
CALL-ID: AF8F2827-842A11EB-8320CBFD-9896332@sbc1.ccie.club
VIA: SIP/2.0/TLS 5.68.80.111:5061;branch=z9hG4bK1FBC8D
REASON: Q.850;cause=95;text=”8aead7d4-10cb-4d9f-9ed6-5171b263005a;Invalid ReferredBy header: mismatched token found: “
CONTENT-LENGTH: 0
ALLOW: INVITE,ACK,OPTIONS,CANCEL,BYE,NOTIFY
SERVER: Microsoft.PSTNHub.SIPProxy v.2021.3.10.9 i.EUWE.6

Let’s analyse this.

First let’s have a look at the error message that we receive in the final message from Microsoft.

REASON: Q.850;cause=95;text=”8aead7d4-10cb-4d9f-9ed6-5171b263005a;Invalid ReferredBy header: mismatched token found: “

Ok. This is giving us a clue, that Microsoft did not like something in the RefferedBy was not right.

Let’s have a look what we sent to Microsoft in the ReferredBy field. Let’s find our Invite above, and here is what we sent them:

Referred-By: <sip:sip.pstnhub.microsoft.com:5061;x-m=28:orgid:8befa294-d839-451b-b83f-5ed105cad187;x-t=de6c105c-078a-408e-91c4-7dcba04684c8;x-ti=25cbb015-82e2-45b9-b55d-13ebc092a082;x-tt=aHR0cHM6Ly9hcGktZHUtYi1ldXdlLnBzdG5odWIubWljcm9zb2Z0LmNvbS92MS9uZ2MvY2FsbG5vdGlm

Ok, so looks legit. Why did this not work? Have you ever asked yourself where do the fields come from? Well the RFC’s define all that, but it’s too boring and long, so I’ll just get to the point.

Referred-by will be copied from the original ‘REFER’ message received from the Microsoft Teams.

Lets see what that looks like:

REFERRED-BY: sip:sip.pstnhub.microsoft.com:5061;x-m=28:orgid:8befa294-d839-451b-b83f-5ed105cad187;x-t=de6c105c-078a-408e-91c4-7dcba04684c8;x-ti=25cbb015-82e2-45b9-b55d-13ebc092a082;x-tt=aHR0cHM6Ly9hcGktZHUtYi1ldXdlLnBzdG5odWIubWljcm9zb2Z0LmNvbS92MS9uZ2MvY2FsbG5vdGlmaWNhdGlvbj9kY2k9MTVjNThhNWJkZGYyNGJkMGFjNjU4ODg3YjU5MzhmNjM%3D

Can you spot the problem now?

If we put the two Referred-By fields side by side, it’s clear that the one that was received from Microsoft is longer. Almost like Cisco SBC has cut it short…

sip:sip.pstnhub.microsoft.com:5061;x-m=28:orgid:8befa294-d839-451b-b83f-5ed105cad187;x-t=de6c105c-078a-408e-91c4-7dcba04684c8;x-ti=25cbb015-82e2-45b9-b55d-13ebc092a082;x-tt=aHR0cHM6Ly9hcGktZHUtYi1ldXdlLnBzdG5odWIubWljcm9zb2Z0LmNvbS92MS9uZ2MvY2FsbG5vdGlm

sip:sip.pstnhub.microsoft.com:5061;x-m=28:orgid:8befa294-d839-451b-b83f-5ed105cad187;x-t=de6c105c-078a-408e-91c4-7dcba04684c8;x-ti=25cbb015-82e2-45b9-b55d-13ebc092a082;x-tt=aHR0cHM6Ly9hcGktZHUtYi1ldXdlLnBzdG5odWIubWljcm9zb2Z0LmNvbS92MS9uZ2MvY2FsbG5vdGlmaWNhdGlvbj9kY2k9MTVjNThhNWJkZGYyNGJkMGFjNjU4ODg3YjU5MzhmNjM%3D

But hold on, why? This is not how it should work. Surely. Cisco are good at this, they’ve been doing voice equipment for a very long time, would they mess up something this basic?

Ok, I have tried different versions of code, to see if I would run into the same issue…

The ones I have tried on the Cisco CSR 1000v are:

  • Cisco IOS XE Software Version Gibraltar-16.12.5 MD
  • Cisco IOS XE Software Version Amsterdam-17.3.3 ED

They both have the same issue.

Unfortunately I do not currently have this in a production environment and do not have access to TAC, but would be good to see if this is resolved in any of the future versions.

Leave a Reply

4 Comments

  • Suresh Varatharajan

    Contact: ;video;audio;+u.sip!devicename.ccm.cisco.com=”CSFGeorge1″;bfcp

    Can remove the additional below information on contact header on initial invite and that should fix the call transfer issue.

    “video;audio;+u.sip!devicename.ccm.cisco.com=”CSFGeorge1″;bfcp”

    As the contact header should look like .
    Contact:

    I have noticed this issues before and this solved it .