MS Teams Calling Issue

[piasterloo]

Hello Folks,

We have a client team working from our office, utilizing Cisco AnyConnect VPN on our guest VLAN.

The issue is that during both inbound and outbound calls, the call rings and can be answered; however, there is no audio. Approximately 8 seconds later, the call disconnects as a failure. The client VPN uses split tunneling, where SIP signaling is routed via the VPN, but once the call is established, media is transmitted through the local router and onto the internet.

Initially, there were numerous retransmissions observed in the pcap targeting the team's destinations. After whitelisting one client, these retransmissions disappeared, but the issue persists. Any advice or suggestions on resolving this would be greatly appreciated.

[alemabrahao]

Do you have an MX on your network? It’s not clear, we need more information. Here are a few things you can try.

Make sure your split tunnel configuration is set up correctly. Verify that SIP signaling traffic is routed through the VPN and media traffic is routed through the local network.

Make sure your firewall is not blocking RTP traffic. Disable any inspection of voice protocols such as SIP, SCCP, or H323.

Perform detailed packet capture analysis to identify any anomalies or dropped packets.

Try whitelisting the client to see if that improves the situation.

[piasterloo]

Yes there is an MX in the Network facing the Internet...We did a whitelist on the client and nothing helped

[Mloraditch]

So I could be wrong vis-a-vis teams but I think your split routing of signal and media traffic is the likely issue unless you have transforms setup somewhere on the sip path.

SIP media streams are setup in the signaling traffic and they use the ip info in those packets to setup the media path. By default that’s going to tell the media to come back to the client via the same IP (natted or not) of the signal traffic. You can manipulate that somewhat with sip header modifications but what you are describing seems very strange. 
Teams may have special magic built in, but Id not do what you've done without documentation saying it will work.

Id see if it works without splitting the traffic path up and go from there.

[PhilipDAth]

Is it possible to get their admin to change it so that either all or none of the teams traffic goes via AnyConnect?

Does this config actually work anywhere else?  Like if they go home and connect to WiFi does it work?

[piasterloo]

yes ...it works when connected via a hotspot or home Wi-Fi.

[PhilipDAth]

I wonder if the subnet they use in their company is the same as the subnet you use in your company.

[piasterloo]

It's different, but does that necessarily make a difference? As I pointed out, it works well when they're connected to a hotspot or home Wi-Fi, so we should assume that the hotspot or home Wi-Fi shares the same IP as their VPN subnet.