MGCP Bind L3 Issues

Sometimes , when you defined your mgcp config and before to activate it with the CUCM config. You can experience issue where you can not send or receive calls on this gateway only because your link is not up.

This is caused because the binding between the MGCP gateway and the CUCM is not properly set up. So in order to fix this issue under your serial interface , remove the command isdn bind-l3 ccm-manager and put it again just after. The result is direct and your PSTN will go up .

The Minimum MGCP configuration

Here is a basic stuff to implement the mgcp config

!
ccm-manager fallback-mgcp
ccm-manager redundant-host 172.17.123.201
ccm-manager mgcp

ccm-manager music-on-hold
ccm-manager config server 172.17.123.200
!
mgcp
mgcp call-agent 172.17.123.200 service-type mgcp version 0.1
mgcp bind control source-interface GigabitEthernet0/0.102
mgcp bind media source-interface GigabitEthernet0/0.102

!
mgcp profile default
!

Protecting Voice Media and Signaling Traffic

There is two types of security that you can enable with Call Manager

  • Mixed mode : In this mode, depending the security configured on each phone, you can have secure calls when both devices are security-enabled and when one of the phones is missing security, your call will be nonsecure.
  • Nonsecure mode : As all phones are not set up with security (default configuration), all calls are nonsecure.

When you device to put security on phones , they can support the three following levels:

  • Nonsecure mode : secure calls are not supported
  • Authenticated mode : the phone will be able to authenticate calls
  • Encrypted mode : the phone will be able to support encrypted calls

If you enable the authentication and the encrytion on your network , you are then able to secure the media traffic as well the voice signaling.

If you want to have security on the media flow, it is then mandatory to secure also the signaling as the keys which are used to secure the media traffic are exchanged during the signaling phase.

SCCP messages sent by IP Phones and Call Manager can be secured using TLS, it is the signaling part. Then for the protection of the media traffic so the RTP packets , you will use the Secure RTP which is providing a framework for encryption and authentications of your stream.

SRTP will be also use between your MGCP gateway and your IP Phone but you need to know that your SRTP keys are exchanged in cleartext session between the MGCP gateway and the Call Manager.

SRST on MGCP gateway

If we want to have SRST on MGCP gateways, ensure that you have the two following commands:

!
service alternate
call-manager fallback-mgcp
!

This will ensure that the MGCP gateway can provide Call Processing with SRST. Don’t forget also to have an H323 config to take over in SRST as MGCP hasn’t any Call Control.

Page 1 of 212