排除CUCM中的IP电话注销问题

已更新: 2023 年 7 月 28 日

文档 ID:220670

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文档介绍如何对未注册或未注册CUCM的IP电话进行故障排除。

要求

Cisco 建议您了解以下主题：

思科IP电话注册流程。
思科统一通信管理器 (CUCM)
域名系统 (DNS)
Cisco 发现协议 (CDP)
动态主机配置协议 (DHCP)
简单文件传输协议 (TFTP)
语音虚拟LAN（语音VLAN）
以太网供电 (PoE)

使用的组件

本文档中的信息基于以下软件和硬件版本：

CUCM 11.5(1)SU9
SIP IP电话8811 sip88xx.14-2-1-0001-14

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

背景信息

在CUCM中注册设备取决于该设备是使用瘦协议(SCCP)还是会话发起协议(SIP)，这二者之间的步骤有所更改，但故障排除步骤相同，重点在于电话注册的步骤。

通过了解设备在正确注册过程中所经历的过程，排除设备注册问题至关重要。

SIP注册流程

SIP Phone Registration Process

SCCP注册流程

SCCP Phone Registration Process

问题

某些事件（如断电、硬件或软件缺陷、连接不稳定、网络中服务质量欠佳等）可能导致一个或多个电话从Call Manager注销。无论是单个事件还是间歇性事件，澄清问题以缩小范围非常重要。

有待澄清的信息

完整CUCM版本
是否仅在特定型号下才发生这种情况？
它是否发生在单个站点或位置？
有多少部电话受到影响？
所有电话是否共享相同的固件版本？
您最近是否升级或降级了固件？
您最近是否重新生成了证书？
你重置了出厂设置吗？
问题是否可随意重现？
记录受影响电话的几个MAC地址，并在问题开始出现时记录时间戳。

要收集的日志

必须拥有电话注册过程中所涉及的每个组件的日志，才能找到问题所在。

从电话：

在IP电话网页上：

电话问题报告(PRT)或控制台日志

在Wireshark上（并非始终需要）：

来自电话的Pcap

从CUCM:

从RTMT（实时监控工具）：

Cisco CallManager跟踪
事件查看器应用程序日志
事件查看器系统日志
Cisco TFTP

从CUCM CLI会话（不总是需要）：

来自主CUCM（电话注册的位置）的PCAP

从交换机：

Span（可选，以防无法收集电话pcap）

注意：请务必使用发生问题的时间戳和电话详细信息。

如何收集日志指南

了解PRT/控制台日志

电话从涉及的其他组件请求特定功能（IP、配置文件和其他功能）的过程可以在PRT或控制台日志中看到。PRT包括控制台日志。

注：为了能够读取PRT中的控制台日志，需要解压缩路径prt-date-time-MACAddress > data > logsave > main中包含的文件夹

******** PRT/控制台日志显示电话如何加载其固件映像：********

1429 NOT Jul 21 18:05:16.217247 (620-869) JAVA-SIPCC-PLAT_API: extract_release_num_from_phone_load_name: load_name:[sip88xx.14-2-1-0001-14.loads] release_num:[14.2.1]

********电话请求证书信任列表(CTL)文件********

2056 NOT Jul 21 18:05:24.839195 (351-928) downd-GETXXTP [GT351][src=CTLSEPD0EC35C1D98E.tlv][dest=/tmp/CTLFile.tlv][serv=][serv6=][sec=0]
2057 NOT Jul 21 18:05:24.839912 (351-928) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml
2058 NOT Jul 21 18:05:24.840023 (351-928) downd-handle_get_file:dst:/tmp/CTLFile.tlv
2059 NOT Jul 21 18:05:24.891683 (351-928) downd-In normal mode, call - > makeXXTPrequest (V6...)
2060 NOT Jul 21 18:05:24.892095 (351-928) downd-EMCC mode is false
2061 NOT Jul 21 18:05:24.893087 (351-928) downd-parseDhcpInfoIntoTftpList(): no valid load server
2062 NOT Jul 21 18:05:24.893555 (351-928) downd-AUTH.SRVR [GT351] look up server - 0 - 198.51.100.30
2063 NOT Jul 21 18:05:24.944833 (351-928) downd-AUTH.SRVR [GT351] authentication retval = 9 
2064 NOT Jul 21 18:05:24.944987 (351-928) downd-XXTP Non secure file requested 
2065 NOT Jul 21 18:05:24.945138 (351-928) downd-tftp.avail file does not exist, so creating it

如果集群处于非安全模式，则TFTP会向请求发送404 Not Found（如果集群处于混合模式，则TFTP应发送200 OK）

2078 NOT Jul 21 18:05:24.947516 (351-931) downd-XXX arg[4] CTLSEPD0EC35C1D98E.tlv
2079 NOT Jul 21 18:05:24.947550 (351-931) downd-XXX arg[5] /tmp/CTLFile.tlv
2080 NOT Jul 21 18:05:24.947584 (351-931) downd-XXX arg[6] (null)
2081 NOT Jul 21 18:05:24.976370 (931-931) GHTTP-LIMIT downdload will be limited to 8192 KB
2082 ERR Jul 21 18:05:24.994707 (931-931) GHTTP-http get [HTTP/1.1 404 Not Found^M

******** Phone请求身份信任列表(ITL)文件********

2088 NOT Jul 21 18:05:25.049240 (351-935) downd-GETXXTP [GT351][src=ITLSEPD0EC35C1D98E.tlv][dest=/tmp/ITLFile.tlv][serv=][serv6=][sec=0]
2089 NOT Jul 21 18:05:25.049419 (351-935) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml
2090 NOT Jul 21 18:05:25.049484 (351-935) downd-handle_get_file:dst:/tmp/ITLFile.tlv
2091 NOT Jul 21 18:05:25.049525 (351-935) downd-handle_get_file:downloading ITLFILE
2092 NOT Jul 21 18:05:25.100110 (351-935) downd-In normal mode, call - > makeXXTPrequest (V6...)

TFTP为ITL文件请求发送200 OK

2110 NOT Jul 21 18:05:25.153781 (351-938) downd-XXX arg[4] ITLSEPD0EC35C1D98E.tlv
2111 NOT Jul 21 18:05:25.153815 (351-938) downd-XXX arg[5] /tmp/ITLFile.tlv
2112 NOT Jul 21 18:05:25.153849 (351-938) downd-XXX arg[6] (null)
2113 NOT Jul 21 18:05:25.166084 (938-938) GHTTP-LIMIT downdload will be limited to 8192 KB
2114 NOT Jul 21 18:05:25.168904 (938-938) GHTTP-hdr->HTTP/1.1 200 OK
2115 NOT Jul 21 18:05:25.169081 (938-938) GHTTP-hdr->Content-length: 11698
2116 NOT Jul 21 18:05:25.169149 (938-938) GHTTP-hdr->Cache-Control: no-store
2117 NOT Jul 21 18:05:25.169211 (938-938) GHTTP-hdr->Content-type: */*
2118 NOT Jul 21 18:05:25.170338 (351-935) downd-PARENT, child process status: 25600
2119 NOT Jul 21 18:05:25.170472 (351-935) downd-NORMAL tftp-exit 100
2120 NOT Jul 21 18:05:25.170724 (351-935) downd-XXTP complete - status = 100 
2121 NOT Jul 21 18:05:25.170755 (351-935) downd-cancel the monitor timer
2122 NOT Jul 21 18:05:25.175638 (355-939) SECUREAPP-validateSignedCTL: new TL matches old, not updating
2123 NOT Jul 21 18:05:25.186516 (351-935) downd-DDGETTFTP.RESULT [_100_ HTTP NO ERROR

********电话向TFTP请求配置文件********

2140 NOT Jul 21 18:05:26.436017 (351-965) downd-GETXXTP [GT351][src=SEPD0EC35C1D98E.cnf.xml][dest=/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036][serv=][serv6=][sec=2]
2141 NOT Jul 21 18:05:26.436216 (351-965) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml
2142 NOT Jul 21 18:05:26.436285 (351-965) downd-handle_get_file:dst:/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036
2143 NOT Jul 21 18:05:26.436346 (351-965) downd-handle_get_file:downloading CNF FILE
2144 NOT Jul 21 18:05:26.487402 (351-965) downd-In normal mode, call - > makeXXTPrequest (V6...)
2145 NOT Jul 21 18:05:26.487841 (351-965) downd-EMCC mode is false
2146 NOT Jul 21 18:05:26.488595 (351-965) downd-parseDhcpInfoIntoTftpList(): no valid load server
2147 NOT Jul 21 18:05:26.488787 (351-965) downd-AUTH.SRVR [GT351] look up server - 0 - 198.51.100.30
2148 NOT Jul 21 18:05:26.539279 (351-965) downd-AUTH.SRVR [GT351] authentication retval = 9 
2149 NOT Jul 21 18:05:26.539419 (351-965) downd-XXTP Secure file requested 
2150 NOT Jul 21 18:05:26.539536 (351-965) downd-XXTP authenticated file approved - add .sgn if necessary -- SEPD0EC35C1D98E.cnf.xml.sgn

********电话下载配置文件********

137 NOT Jul 21 18:05:26.432207 (620-840) JAVA-configmgr MQThread|cip.cfg.Config: - Requesting CONFIG file: ram/SEPD0EC35C1D98E.cnf.xml.19036 from TFTP Service(1), encrypt = false,isApplyingConfigFromFlash:false
2138 INF Jul 21 18:05:26.432653 (620-840) JAVA-[[MESSAGE_1.0]]: [CONFIG-MGR] --> tftpRequest(ram/SEPD0EC35C1D98E.cnf.xml.19036) --> [TFTP] : 
2139 NOT Jul 21 18:05:26.435882 (351-965) downd-start the monitor timer
2140 NOT Jul 21 18:05:26.436017 (351-965) downd-GETXXTP [GT351][src=SEPD0EC35C1D98E.cnf.xml][dest=/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036][serv=][serv6=][sec=2]
2141 NOT Jul 21 18:05:26.436216 (351-965) downd-handle_get_file:SEP file is:SEPD0EC35C1D98E.cnf.xml
2142 NOT Jul 21 18:05:26.436285 (351-965) downd-handle_get_file:dst:/tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036
2143 NOT Jul 21 18:05:26.436346 (351-965) downd-handle_get_file:downloading CNF FILE
2144 NOT Jul 21 18:05:26.487402 (351-965) downd-In normal mode, call - > makeXXTPrequest (V6...)
2145 NOT Jul 21 18:05:26.487841 (351-965) downd-EMCC mode is false
2146 NOT Jul 21 18:05:26.488595 (351-965) downd-parseDhcpInfoIntoTftpList(): no valid load server
2147 NOT Jul 21 18:05:26.488787 (351-965) downd-AUTH.SRVR [GT351] look up server - 0 - 198.51.100.30
2148 NOT Jul 21 18:05:26.539279 (351-965) downd-AUTH.SRVR [GT351] authentication retval = 9 
2149 NOT Jul 21 18:05:26.539419 (351-965) downd-XXTP Secure file requested 
2150 NOT Jul 21 18:05:26.539536 (351-965) downd-XXTP authenticated file approved - add .sgn if necessary -- SEPD0EC35C1D98E.cnf.xml.sgn

TFTP向配置文件请求发送200 OK

2163 NOT Jul 21 18:05:26.541364 (351-968) downd-XXX arg[4] SEPD0EC35C1D98E.cnf.xml.sgn
2164 NOT Jul 21 18:05:26.541398 (351-968) downd-XXX arg[5] /tmp/ram/SEPD0EC35C1D98E.cnf.xml.19036
2165 NOT Jul 21 18:05:26.541432 (351-968) downd-XXX arg[6] (null)
2166 NOT Jul 21 18:05:26.552194 (968-968) GHTTP-LIMIT downdload will be limited to 8192 KB
2167 NOT Jul 21 18:05:26.603994 (968-968) GHTTP-hdr->HTTP/1.1 200 OK
2168 NOT Jul 21 18:05:26.604360 (968-968) GHTTP-hdr->Content-length: 14939
2169 NOT Jul 21 18:05:26.604470 (968-968) GHTTP-hdr->Cache-Control: no-store
2170 NOT Jul 21 18:05:26.604523 (968-968) GHTTP-hdr->Content-type: */*
2171 NOT Jul 21 18:05:26.607331 (351-965) downd-PARENT, child process status: 25600
2172 NOT Jul 21 18:05:26.607479 (351-965) downd-NORMAL tftp-exit 100
2173 NOT Jul 21 18:05:26.607504 (351-965) downd-XXTP complete - status = 100

********电话加载新的固件配********

2202 NOT Jul 21 18:05:27.530229 (620-981) JAVA-Seamless Upgrade Thread|UpgradeService: - Got request for (sip88xx.14-2-1-0001-14.loads) when we are already running (sip88xx.14-2-1-0001-14.loads)
2203 NOT Jul 21 18:05:27.530908 (620-981) JAVA-Seamless Upgrade Thread|UpgradeService: - and (sip88xx.14-0-1-0201-171.loads) when we already have (sip88xx.14-0-1-0201-171.loads). Ignoring this request.

******** Phone对写入配置文件的所有参数收费********

4479 NOT Jul 17 22:29:45.818159 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - HEADSET_DISCOVERY_URL: https://{cucm}:9444/headset/{devicename}
4480 NOT Jul 17 22:29:45.819013 (559-1232) JAVA-configmgr MQThread|cip.cfg.SipConfig: - Entering setProtocolConfigProperties() at 1689650985818 millisecs....<RemoveItLater>
4481 NOT Jul 17 22:29:45.998381 (559-1232) JAVA-configmgr MQThread|cip.cfg.SipConfig:? - embrace feature hack, update line 1, featureId = 9, name = 0236
4482 NOT Jul 17 22:29:46.037905 (559-1232) JAVA-configmgr MQThread|cip.cfg.SipConfig: - Exiting setProtocolConfigProperties() at 1689650986037 millisecs....<RemoveItLater>
4483 NOT Jul 17 22:29:46.106088 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #0 XmlCallAgentObject: IPv4-name=[198.51.100.80] IPv6-name=[] ethernetPhonePort=2000 sipPort=5060 securedSipPort=5061 priority=0
4484 NOT Jul 17 22:29:46.107950 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #1 XmlCallAgentObject: IPv4-name=[198.51.100.46] IPv6-name=[] ethernetPhonePort=2000 sipPort=5060 securedSipPort=5061 priority=1
4485 NOT Jul 17 22:29:46.109415 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #2 XmlCallAgentObject: IPv4-name=[] IPv6-name=[] ethernetPhonePort=0 sipPort=0 securedSipPort=0 priority=32767
4486 NOT Jul 17 22:29:46.111032 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #3 XmlCallAgentObject: IPv4-name=[] IPv6-name=[] ethernetPhonePort=0 sipPort=0 securedSipPort=0 priority=32767
4487 NOT Jul 17 22:29:46.112528 (559-1232) JAVA-configmgr MQThread|cip.cfg.Config: - CUCM in config file: #4 XmlCallAgentObject: IPv4-name=[] IPv6-name=[] ethernetPhonePort=0 sipPort=0 securedSipPort=0 priority=32767
4488 WRN Jul 17 22:29:46.291408 (345-2829) SECUREAPP-SEC_CAPF_N_IN_USE: CAPF not in use, user cancel ignored
4489 NOT Jul 17 22:29:46.341949 (559-1232) JAVA-configmgr MQThread|cip.sec.CapfProperty:? - CapfProp 96

********注册消息********

6260 DEB Jul 17 22:29:50.880584 (610-796) JAVA-SIPCC-SIP_STATE: 201/1, sip_reg_sm_change_state: Registration state change: SIP_REG_STATE_REGISTERED ---> SIP_REG_STATE_IDLE
6261 DEB Jul 17 22:29:50.880638 (610-796) JAVA-SIPCC-SIP_MSG_SEND: ccsip_register_send_msg: cmd=85=SIP_REG_REQ ndx=201
6262 DEB Jul 17 22:29:50.880750 (610-796) JAVA-SIPCC-SIP_STATE: 201/1, sip_reg_sm_change_state: Registration state change: SIP_REG_STATE_IDLE ---> SIP_REG_STATE_IDLE

********电话向CUCM服务器发送SIP REGISTER消********

76 DEB Jul 17 22:29:50.882403 (610-796) JAVA-sipio-sent---> REGISTER sip:198.51.100.31 SIP/2.0^M
Via: SIP/2.0/TCP 198.51.100.109:50020;branch=z9hG4bK775c97a8^M
From: <sip:***@198.51.100.31>;tag=d0ec35c1d98e2e142ea51ccd-2fdbbe4d^M
To: <sip:***@198.51.100.31>^M
Call-ID: d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109^M
Max-Forwards: 70^M
Session-ID: 0ffda3aa00105000a000d0ec35c1d98e;remote=00000000000000000000000000000000^M
Date: Mon, 17 Jul 2023 22:29:50 GMT^M
CSeq: 11749 REGISTER^M
User-Agent: Cisco-CP8811/14.2.1^M
Contact: <sip:***@198.51.100.109:50020;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217"^M
Supported: replaces,join,sdp-anat,norefersub,resource-priority,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-7.0.0,X-cisco-xsi-8.5.1^M
Content-Length: 0^M
Expires: 3600^M
^M

********CUCM接收到REGISTER的SIP尝试消********

6284 DEB Jul 17 22:29:50.884485 (610-796) JAVA-sipio-recv<--- SIP/2.0 100 Trying^M
Via: SIP/2.0/TCP 198.51.100.109:50020;branch=z9hG4bK775c97a8^M
From: <sip:***@198.51.100.31>;tag=d0ec35c1d98e2e142ea51ccd-2fdbbe4d^M
To: <sip:***@198.51.100.31>^M
Date: Mon, 17 Jul 2023 22:29:52 GMT^M
Call-ID: d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109^M
CSeq: 11749 REGISTER^M
Content-Length: 0^M
^M

******** 200 OK响应来自CUCM服务器的REGISTER消********

6294 DEB Jul 17 22:29:50.885744 (610-796) JAVA-sipio-recv<--- SIP/2.0 200 OK^M
Via: SIP/2.0/TCP 198.51.100.109:50020;branch=z9hG4bK775c97a8^M
From: <sip:***@198.51.100.31>;tag=d0ec35c1d98e2e142ea51ccd-2fdbbe4d^M
To: <sip:***@198.51.100.31>;tag=696179034^M
Date: Mon, 17 Jul 2023 22:29:52 GMT^M
Call-ID: d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109^M
Server: Cisco-CUCM14.0^M
CSeq: 11749 REGISTER^M
Expires: 120^M
Contact: <sip:***@198.51.100.109:50020;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217"^M
Supported: X-cisco-srtp-fallback,X-cisco-sis-10.0.0^M
Content-Length: 0^M
^M

IP电话PCAP注册过程

在pcap中，显示了设备如何执行与其他组件（如CUCM、TFTP和DHCP）通信的完整过程。如果您想详细了解日志中未发现的内容，则需要使用pcap。

SIP设备情况下的推荐过滤器：((tcp) || (http) || (sip)&(ip.addr == XX.XX.XX.XX)

SCCP设备情况下的推荐过滤器：((tcp) || (http) || （瘦客户端）&(ip.addr == XX.XX.XX.XX)

其中XX.XX.XX.XX是电话的IP。

或其他选项

对于SIP设备:((tcp) || (http) || (sip)&(eth.addr == YYYYYYYYYY)

对于SCCP设备：((tcp) || (http) || （瘦客户端）&&(eth.addr == YYYYYYYYYYYY)

其中YYYYYYYYYYYYYYYY是电话的MAC。

您也可以将MAC地址与冒号： eth.addr == YY:YY:YY:YY:YY:YY配合使用

Phone Registration Filter Blur

电话使用TFTP打开TCP会话

电话请求CTL文件并从TFTP接收，但找不到404

电话请求ITL文件并通过TCP数据包从TFTP接收该文件

TFTP为ITL文件请求发送200 OK， 电话ACK收到数据并关闭TCP会话

注意：对于每个对TFTP的请求，电话尝试建立新的TCP连接

电话向TFTP请求配置文件 并通过TCP数据包从TFTP接收文件

TFTP为ITL文件请求发送200 OK，电话将确认收到的数据

电话从TFTP请求配置，并通过TCP数据包接收每个文件。

来自CUCM的SIP注册消息和200 OK。

Filter Phone Registration 8

CUCM跟踪

********请参阅通知CUCM有关上次注册状态信********

REFER sip:198.51.100.31 SIP/2.0
Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK25771c8e
From: "2001" <sip:2001@198.51.100.109>;tag=d0ec35c1d98e00030abbb40d-0dadaa5e
To: <sip:198.51.100.31>
Call-ID: d0ec35c1-d98e0003-657a07f3-6d626333@198.51.100.109
Session-ID: 92eb5cca00105000a000d0ec35c1d98e;remote=00000000000000000000000000000000
Date: Fri, 21 Jul 2023 18:05:31 GMT
CSeq: 1000 REFER
User-Agent: Cisco-CP8811/14.2.1
Expires: 10
Max-Forwards: 70
Contact: <sip:fa7155fd-ec0d-7b35-c49b-86e9f163bf11@198.51.100.109:50806;transport=tcp>;+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E"
Require: norefersub
Referred-By: "2001" <sip:2001@198.51.100.109>
Refer-To: cid:28820b4e@198.51.100.109
Content-Id: <28820b4e@198.51.100.109>
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
Content-Length: 1693
Content-Type: application/x-cisco-alarm+xml
Content-Disposition: session;handling=required



<?xml version="1.0" encoding="UTF-8"?>
<x-cisco-alarm>
<Alarm Name="LastOutOfServiceInformation">
<ParameterList>
<String name="DeviceName">SEPD0EC35C1D98E</String>
<String name="DeviceIPv4Address">198.51.100.109/24</String>
<String name="IPv4DefaultGateway">198.51.100.1</String>
<String name="DeviceIPv6Address"></String>
<String name="IPv6DefaultGateway"></String>
<String name="ModelNumber">CP-8811</String>
<String name="NeighborIPv4Address">198.51.100.98</String>
<String name="NeighborIPv6Address"></String>
<String name="NeighborDeviceID">jpazjaim_SW</String>
<String name="NeighborPortID">GigabitEthernet0/2</String>
<Enum name="DHCPv4Status">1</Enum>
<Enum name="DHCPv6Status">3</Enum>
<Enum name="TFTPCfgStatus">1</Enum>
<Enum name="DNSStatusUnifiedCM1">0</Enum>
<Enum name="DNSStatusUnifiedCM2">0</Enum>
<Enum name="DNSStatusUnifiedCM3">0</Enum>
<Enum name="DNSv6StatusUnifiedCM1">0</Enum>
<Enum name="DNSv6StatusUnifiedCM2">0</Enum>
<Enum name="DNSv6StatusUnifiedCM3">0</Enum>
<String name="VoiceVLAN">360</String>
<String name="UnifiedCMIPAddress">198.51.100.31</String>
<String name="LocalPort">50020</String>
<String name="TimeStamp">1689962095016</String>
<Enum name="ReasonForOutOfService">25</Enum>
<String name="LastProtocolEventSent">Sent:REGISTER sip:198.51.100.31 SIP/2.0 Cseq:11810 REGISTER CallId:d0ec35c1-d98e0017-3593f645-7a3311ca@198.51.100.109 </String>
<String name="LastProtocolEventReceived">Rcvd:SIP/2.0 202 Accepted Cseq:1000 REFER CallId:d0ec35c1-d98e0002-1e0df6e4-4cae92c9@198.51.100.109 </String>
<String name="ReasonForOutOfServiceText">LastTimeInitialized</String>
<String name="ActiveInterface">Wired</String>
</ParameterList>
</Alarm>
</x-cisco-alarm>

******** 202 Accepted message to the REFER ********

SIP/2.0 202 Accepted
Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK25771c8e
From: "2001" <sip:2001@198.51.100.109>;tag=d0ec35c1d98e00030abbb40d-0dadaa5e
To: <sip:198.51.100.31>;tag=1984400291
Date: Fri, 21 Jul 2023 18:08:58 GMT
Call-ID: d0ec35c1-d98e0003-657a07f3-6d626333@198.51.100.109
CSeq: 1000 REFER
Contact: <sip:198.51.100.31:5060;transport=tcp>
Content-Length: 0

********注册来自IP电话服务器的SIP消********

REGISTER sip:198.51.100.31 SIP/2.0
Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK0aeff5a4
From: <sip:2001@198.51.100.31>;tag=d0ec35c1d98e00044e764ab3-2227c9d6
To: <sip:2001@198.51.100.31>
Call-ID: d0ec35c1-d98e0002-71e1f429-052f5580@198.51.100.109
Max-Forwards: 70
Session-ID: 92eb5cca00105000a000d0ec35c1d98e;remote=00000000000000000000000000000000
Date: Fri, 21 Jul 2023 18:05:31 GMT
CSeq: 101 REGISTER
User-Agent: Cisco-CP8811/14.2.1
Contact: <sip:fa7155fd-ec0d-7b35-c49b-86e9f163bf11@198.51.100.109:50806;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217"
Supported: replaces,join,sdp-anat,norefersub,resource-priority,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-7.0.0,X-cisco-xsi-8.5.1
Reason: SIP;cause=200;text="cisco-alarm:25 Name=SEPD0EC35C1D98E ActiveLoad=sip88xx.14-2-1-0001-14.loads InactiveLoad=sip88xx.14-0-1-0201-171.loads Last=initialized"
Expires: 3600
Content-Type: multipart/mixed; boundary=uniqueBoundary
Mime-Version: 1.0
Content-Length: 1313

******** CUCM将200 OK发送到REGISTER消息********

SIP/2.0 200 OK
Via: SIP/2.0/TCP 198.51.100.109:50806;branch=z9hG4bK0aeff5a4
From: <sip:2001@198.51.100.31>;tag=d0ec35c1d98e00044e764ab3-2227c9d6
To: <sip:2001@198.51.100.31>;tag=757446526
Date: Fri, 21 Jul 2023 18:08:58 GMT
Call-ID: d0ec35c1-d98e0002-71e1f429-052f5580@198.51.100.109
Server: Cisco-CUCM14.0
CSeq: 101 REGISTER
Expires: 120
Contact: <sip:fa7155fd-ec0d-7b35-c49b-86e9f163bf11@198.51.100.109:50806;transport=tcp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-d0ec35c1d98e>";+u.sip!devicename.ccm.cisco.com="SEPD0EC35C1D98E";+u.sip!model.ccm.cisco.com="36217";x-cisco-newreg
Supported: X-cisco-srtp-fallback,X-cisco-sis-10.0.0
Content-Type: application/x-cisco-remotecc-response+xml
Content-Length: 381

排除许多终端注销故障

对于此问题，需要一些受影响电话的几个MAC地址。

为了简化流程，需要有一个文本编辑器，如Notepad++、Visual Studio或其他。

要解决此问题，可验证事件查看器日志。在事件查看器日志中，可在此处找到注册和未注册终端、ITL和CTL信息、终端类型、活动固件、电话协议、未注册原因等事件。

缩小问题的步骤：

在文本编辑器中打开日志文件夹
在所有文件夹中搜索
搜索 endpointunregistered

这向我们显示了包含此词的syslog文件夹和SDL文件的所有结果。

5440: Jul 17 21:45:17 cucmsub local6 6 ccm: 19: xxxxxxx.xxxxxx.xx Jul 18 2023 02:45:17 UTC : %UC_CALLMANAGER-6-EndPointUnregistered: %[DeviceName=SEPXXXXXXXXXXXX][IPAddress=198.51.100.117][Protocol=SIP][DeviceType=622][Description=SEPXXXXXXXXXXXX_CP_7841][Reason=28][IPAddrAttributes=0][AppID=Cisco CallManager][ClusterID=SSPTSite}][NodeID=cucmsub]: An endpoint has unregistered

EndPointUnregistered系统错误消息说明

IP地址：受影响终端的IP。

DeviceName：受影响的终端的Mac地址。

协议：终端注册所使用的协议。
DeviceType：终端模型的类型。

要了解设备类型型号和名称，请在CLI上运行：运行sql select enum，从typemodel获取名称
Description：注册电话时在Call Manager中设置的说明。

原因：系统错误消息的原因。

在此处查找系统错误消息的所有原因。
IPAddrAttributes：描述IP的使用。
AppID：统一服务器的类型。
NodeID：节点名称。

您必须关注错误消息的原因编号、mac地址和时间戳，以使警报与您的事件匹配，然后导航到找到原因的页。

注：系统错误消息页面包含RTMT上可用的所有警报，以及触发警报的原因说明和说明。

打开页面后：

1.按CTRL + F（在Windows上）或Command + F（在MacOs上）

2.搜索EndPointUnregistered

Endpointunregistered Error Message Explanation

3.向下滚动，直至找到Enum Definitions - Reason

4.在系统错误消息中搜索原因编号

Reason of Endpointunregistered Error Message

如果需要更多信息，电话上的pcap是逐步查看电话注册过程的最佳选项。

设备类型型号列表

要了解与警报中显示的DeviceType字段关联的设备类型，可以在注册电话的CUCM的CLI中运行查询。

查询：运行sql select enum，name from typemodel

enum name 
===== ================================================== 
1 Cisco 30 SP+ 
2 Cisco 12 SP+ 
3 Cisco 12 SP 
4 Cisco 12 S 
5 Cisco 30 VIP 
6 Cisco 7910 
7 Cisco 7960 
8 Cisco 7940 
9 Cisco 7935 
10 Cisco VGC Phone 
11 Cisco VGC Virtual Phone 
12 Cisco ATA 186 
15 EMCC Base Phone 
20 SCCP Phone 
30 Analog Access 
40 Digital Access 
42 Digital Access+ 
43 Digital Access WS-X6608 
47 Analog Access WS-X6624 
48 VGC Gateway 
50 Conference Bridge 
51 Conference Bridge WS-X6608 
52 Cisco IOS Conference Bridge (HDV2) 
53 Cisco Conference Bridge (WS-SVC-CMM) 
61 H.323 Phone 
62 H.323 Gateway 
70 Music On Hold 
71 Device Pilot 
72 CTI Port 
73 CTI Route Point 
80 Voice Mail Port 
83 Cisco IOS Software Media Termination Point (HDV2) 
84 Cisco Media Server (WS-SVC-CMM-MS) 
85 Cisco Video Conference Bridge (IPVC-35xx) 
86 Cisco IOS Heterogeneous Video Conference Bridge 
87 Cisco IOS Guaranteed Audio Video Conference Bridge 
88 Cisco IOS Homogeneous Video Conference Bridge 
90 Route List 
100 Load Simulator 
110 Media Termination Point 
111 Media Termination Point Hardware 
112 Cisco IOS Media Termination Point (HDV2) 
113 Cisco Media Termination Point (WS-SVC-CMM) 
115 Cisco 7941 
119 Cisco 7971 
120 MGCP Station 
121 MGCP Trunk 
122 GateKeeper 
124 7914 14-Button Line Expansion Module 
125 Trunk 
126 Tone Announcement Player 
131 SIP Trunk 
132 SIP Gateway 
133 WSM Trunk 
134 Remote Destination Profile 
227 7915 12-Button Line Expansion Module 
228 7915 24-Button Line Expansion Module 
229 7916 12-Button Line Expansion Module 
230 7916 24-Button Line Expansion Module 
232 CKEM 36-Button Line Expansion Module 
253 SPA8800 
254 Unknown MGCP Gateway 
255 Unknown 
302 Cisco 7985 
307 Cisco 7911 
308 Cisco 7961G-GE 
309 Cisco 7941G-GE 
335 Motorola CN622 
336 Third-party SIP Device (Basic) 
348 Cisco 7931 
358 Cisco Unified Personal Communicator 
365 Cisco 7921 
369 Cisco 7906 
374 Third-party SIP Device (Advanced) 
375 Cisco TelePresence 
376 Nokia S60 
404 Cisco 7962 
412 Cisco 3951 
431 Cisco 7937 
434 Cisco 7942 
435 Cisco 7945 
436 Cisco 7965 
437 Cisco 7975 
446 Cisco 3911 
468 Cisco Unified Mobile Communicator 
478 Cisco TelePresence 1000 
479 Cisco TelePresence 3000 
480 Cisco TelePresence 3200 
481 Cisco TelePresence 500-37 
484 Cisco 7925 
493 Cisco 9971 
495 Cisco 6921 
496 Cisco 6941 
497 Cisco 6961 
503 Cisco Unified Client Services Framework 
505 Cisco TelePresence 1300-65 
520 Cisco TelePresence 1100 
521 Transnova S3 
522 BlackBerry MVS VoWifi 
537 Cisco 9951 
540 Cisco 8961 
547 Cisco 6901 
548 Cisco 6911 
550 Cisco ATA 187 
557 Cisco TelePresence 200 
558 Cisco TelePresence 400 
562 Cisco Dual Mode for iPhone 
564 Cisco 6945 
575 Cisco Dual Mode for Android 
577 Cisco 7926 
580 Cisco E20 
582 Generic Single Screen Room System 
583 Generic Multiple Screen Room System 
584 Cisco TelePresence EX90 
585 Cisco 8945 
586 Cisco 8941 
588 Generic Desktop Video Endpoint 
590 Cisco TelePresence 500-32 
591 Cisco TelePresence 1300-47 
592 Cisco 3905 
593 Cisco Cius 
594 VKEM 36-Button Line Expansion Module 
596 Cisco TelePresence TX1310-65 
597 Cisco TelePresence MCU 
598 Ascom IP-DECT Device 
599 Cisco TelePresence Exchange System 
604 Cisco TelePresence EX60 
606 Cisco TelePresence Codec C90 
607 Cisco TelePresence Codec C60 
608 Cisco TelePresence Codec C40 
609 Cisco TelePresence Quick Set C20 
610 Cisco TelePresence Profile 42 (C20) 
611 Cisco TelePresence Profile 42 (C60) 
612 Cisco TelePresence Profile 52 (C40) 
613 Cisco TelePresence Profile 52 (C60) 
614 Cisco TelePresence Profile 52 Dual (C60) 
615 Cisco TelePresence Profile 65 (C60) 
616 Cisco TelePresence Profile 65 Dual (C90) 
617 Cisco TelePresence MX200 
619 Cisco TelePresence TX9000 
620 Cisco TelePresence TX9200 
621 Cisco 7821 
622 Cisco 7841 
623 Cisco 7861 
626 Cisco TelePresence SX20 
627 Cisco TelePresence MX300 
628 IMS-integrated Mobile (Basic) 
631 Third-party AS-SIP Endpoint 
632 Cisco Cius SP 
633 Cisco TelePresence Profile 42 (C40) 
634 Cisco VXC 6215 
635 CTI Remote Device 
640 Usage Profile 
642 Carrier-integrated Mobile 
645 Universal Device Template 
647 Cisco DX650 
648 Cisco Unified Communications for RTX 
652 Cisco Jabber for Tablet 
659 Cisco 8831 
681 Cisco ATA 190 
682 Cisco TelePresence SX10 
683 Cisco 8841 
684 Cisco 8851 
685 Cisco 8861 
688 Cisco TelePresence SX80 
689 Cisco TelePresence MX200 G2 
690 Cisco TelePresence MX300 G2 
20000 Cisco 7905 
30002 Cisco 7920 
30006 Cisco 7970 
30007 Cisco 7912 
30008 Cisco 7902 
30016 Cisco IP Communicator 
30018 Cisco 7961 
30019 Cisco 7936 
30027 Analog Phone 
30028 ISDN BRI Phone 
30032 SCCP gateway virtual phone 
30035 IP-STE 
36041 Cisco TelePresence Conductor 
36042 Cisco DX80 
36043 Cisco DX70 
36049 BEKEM 36-Button Line Expansion Module 
36207 Cisco TelePresence MX700 
36208 Cisco TelePresence MX800 
36210 Cisco TelePresence IX5000 
36213 Cisco 7811 
36216 Cisco 8821 
36217 Cisco 8811 
36219 Interactive Voice Response 
36224 Cisco 8845 
36225 Cisco 8865 
36227 Cisco TelePresence MX800 Dual 
36232 Cisco 8851NR 
36235 Cisco Spark Remote Device 
36239 Cisco Webex DX80 
36241 Cisco TelePresence DX70 
36247 Cisco 7832 
36248 Cisco 8865NR 
36250 Cisco Meeting Server 
36251 Cisco Webex Room Kit 
36254 Cisco Webex Room 55 
36255 Cisco Webex Room Kit Plus 
36256 CP-8800-Video 28-Button Key Expansion Module 
36257 CP-8800-Audio 28-Button Key Expansion Module 
36258 Cisco 8832 
36259 Cisco Webex Room 70 Single 
36260 Cisco 8832NR 
36262 Cisco ATA 191 
36265 Cisco Webex Room 70 Dual 
36292 Cisco Webex Room Kit Pro 
36295 Cisco Webex Room 55 Dual 
36296 Cisco Webex Room 70 Single G2 
36297 Cisco Webex Room 70 Dual G2 
36299 Cisco Webex Room Kit Mini 
36304 Cisco Webex Board 55 
36305 Cisco Webex Board 70 
36306 Cisco Webex Board 85 
36307 Cisco Webex Desk Pro 
36308 Cisco Webex Room Panorama 
36309 Cisco Webex Room 70 Panorama 
36312 Cisco Webex Room Phone

注：查询结果可以根据CUCM版本进行更改。