Всем привет.
Вопрос, к специалистам в области маршрутизаторов Juniper серии SRX100
Настроили эту железочку в допофисе, все сервисы, службы - работают просто
замечательно, но возник вопрос с ip-телефонией. При попытке набрать номер
удалённого офиса в трубке тишина и секунд через 5 "занято", на стороне офиса
при попытке позвонить к нам - тоже самое - тишина и через 5 сек "занято".
Телефонную станцию удалённого офиса со своей стороны вижу.
Из удалённого офиса свою телефонную станцию тоже вижу.
Трассы, пинги  - всё хорошо.
На удалённой стороне АТС Коралл, на моей Tadiran, сигнализация идёт по порту 2427.
С приоретизацией и QoS возились, но результат - 5 сек и "занято"
Отключали  фильтры с интерфейса, чтобы просто шёл поток данных, и снова  - 5 сек и "занято".
В других филилах вместо  SRX100 стоят системники с LINUX SUSE - всё изумительно работает.
Ip адрес станции на моей стороне
Signaling:    10.0.0.253
Media:    10.0.0.254
Ip адрес станции на удалённой стороне
Signaling:    10.3.0.253
Media:    10.3.0.254

вот конфигурация SRX100
=============================================================
## Last changed: 2011-07-31 18:02:24 MSD
version 11.1R1.10;
system {
    host-name pyatigorsk;
    time-zone Europe/Moscow;
      }
    name-server {
        10.0.0.2;
    }
    services {
        ssh;
        telnet;
        web-management {
            http {
                interface [ vlan.0 fe-0/0/2.0 fe-0/0/0.0 ];
            }
            https {
                system-generated-certificate;
                interface vlan.0;
            }
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
}
interfaces {
    interface-range interfaces-trust {
        member fe-0/0/3;
        member fe-0/0/4;
        member fe-0/0/5;
        member fe-0/0/6;
        member fe-0/0/7;
        member fe-0/0/0;
        unit 0;
    }
    fe-0/0/0 {
        unit 0 {
            family inet {
                filter {
                    output QoS;
                }
                address 192.168.3.10/30;
            }
        }
    }
    fe-0/0/1 {
        unit 0 {
            family inet {
                address 192.168.103.2/30;
            }
        }
    }
    fe-0/0/2 {
        unit 0 {
            family inet {
                address 10.3.0.1/24;
            }
        }
    }
    st0 {
        disable;
        unit 0 {
            family inet {
                mtu 1400;
                address 10.134.0.1/30;
            }
        }
}
forwarding-options {
    packet-capture {
        file filename testpacketcapture;
        maximum-capture-size 1500;
    }
}
routing-options {
    static {
        route 192.168.103.0/24 next-hop 192.168.103.1;
        route 0.0.0.0/0 next-hop 192.168.3.9;
    }
}
protocols {
    rip {
        group alpha-rip-group {
            export advertise-rip-routes;
            neighbor fe-0/0/2.0;
            neighbor st0.0;
            neighbor fe-0/0/0.0;
        }
    }
}
policy-options {
    policy-statement advertise-rip-routes {
        term 1 {
            from protocol [ direct rip ];
            then accept;
        }
    }
}
class-of-service {
    classifiers {
        dscp VoIp {
            forwarding-class assured-forwarding {
                loss-priority high code-points 101110;
            }
        }
    }
    interfaces {
        fe-0/0/0 {
            unit 0 {
                classifiers {
                    dscp VoIp;
                }
                rewrite-rules {
                    dscp 101110;
                }
            }
        }
    }
    rewrite-rules {
        dscp 101110 {
            forwarding-class assured-forwarding {
                loss-priority high code-point 101110;
            }
        }
    }
}
security {
    ike {
        policy IKE1 {
            mode main;
            proposal-set compatible;
        }
        gateway R1 {
            ike-policy IKE1;
            address 192.168.134.2;
            external-interface fe-0/0/1;
        }
    }
    ipsec {
        proposal P2-AES;
        policy ipsec-policy-1;
        policy IKE2 {
            perfect-forward-secrecy {
                keys group2;
            }
            proposal-set compatible;
        }
        vpn R1_R2 {
            bind-interface st0.0;
            ike {
                gateway R1;
                ipsec-policy IKE2;
            }
            establish-tunnels immediately;
        }
    }
    alg {
        sip disable;
    }
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    policies {
        from-zone trust to-zone trust {
            policy trust-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone untrust {
            policy untrust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone VPN {
            policy head {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone VPN to-zone trust {
            policy 1 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                fe-0/0/0.0;
                fe-0/0/1.0;
                fe-0/0/2.0;
            }
        }
        security-zone untrust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
        }
        security-zone VPN {
            interfaces {
                st0.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
            }
        }
    }
}
firewall {
    policer P_Critical {
        if-exceeding {
            bandwidth-limit 156k;
            burst-size-limit 100k;
        }
        then forwarding-class assured-forwarding;
    }
    policer R_Production {
        if-exceeding {
            bandwidth-limit 150k;
            burst-size-limit 100k;
        }
        then forwarding-class best-effort;
    }
    policer P-Net {
        if-exceeding {
            bandwidth-limit 100k;
            burst-size-limit 50k;
        }
        then forwarding-class best-effort;
    }
    policer VoIP {
        if-exceeding {
            bandwidth-limit 200k;
            burst-size-limit 150k;
        }
        then forwarding-class assured-forwarding;
    }
    filter QoS {
        term R_Production {
            from {
                source-address {
                    10.3.0.1/32;
                    10.3.0.12/32;
                    10.0.0.1/32;
                }
                destination-address {
                    10.3.0.12/32;
                    10.0.0.1/32;
                }
            }
            then policer R_Production;
        }
        term R_Critical {
            from {
                source-address {
                    10.3.0.254/32;
                    10.3.0.252/32;
                    10.3.0.253/32;
                }
                destination-address {
                    10.0.0.253/32;
                    10.0.0.254/32;
                }
            }
            then {
                policer P_Critical;
                loss-priority low;
                forwarding-class assured-forwarding;
            }
        }
        term R_Net {
            from {
                source-address {
                    0.0.0.0/0;
                }
                destination-address {
                    0.0.0.0/0;
                }
            }
            then policer P-Net;
        }
    }
}
====================================================================================
На SRX100 monitor traffic и tcpdump "хождения" трафика между телефонными станциями не показали.
Отсюда и возник вопрос, что не было учтено при настройке SRX100, относительно
ip телефонии, как протолкнуть телефонный трафик, может SRX100 его где-то режет  ?
Заранее спасибо.