IP Phone Recording Active/Passive

[jadams]

Guys I have a bit of a problem here.... I'm not sure how familar any of you are with call recording when it comes to IP phones.

Currently we have a customer who has a "passive" solution. What happens in a passive solution is that we setup span ports to get the RTP traffic, which contains the audio over to the recorder. It filters by IP address and is able to peice together calls.

We are currently installing an ACTIVE solution. What happens in this scenario is within the Cisco CUCM we configure the phones to create a duplicate copy of the audio via Built in Bridge, and ACTIVELY send us the RTP stream.

The problem is that the customer needs the passive and active solution to work at the same time.

Heres the dillema....

Since their current recorder is spanning all traffic from the phone; not only is it getting the "normal" call traffic, but at the same time all the Built in Bridge traffic is getting spanned as well.

Their recorder is gettin confused and dropping the employee side of the call. It maintains the customer side of the call because in a passive environment that audio doesnt come from the phone.

Soooo..... Current recorder is getting confused because its seeing TWO copied streams from the same IP address and dropping it.

How to fix? Is it possible to configure Windows firewall to block traffic from only specific portions of this span? How we keep the "Built in Bridge" traffic from reaching their current recorder when its going through the span port?

 

[jjeff1]

Depends on how it's physically setup.

I'd configure an ACL so your active stream is dropped. Just block traffic destined for the IP of the active recorder.

 

[jadams]

Thanks Jeff, I think we might be onto something.

The phone ACTIVELY sends out a stream, with a source of the phone ip address and a destination of our recorder.

Now even though the destination is that of our active recorder, the packets themselves are getting spanned to the passive recorder. Passive recorders run a WinPcap/Wireshark type of program to filter all those packets and make phone calls.

Is it possible to setup a Windows Firewall rule on the Passive Recorder to block by destination IP?
If that is possible, will that also apply to spanned traffic?
Will the spanned traffic still make it to the filtering program attached to the NIC on the passive recorder?

This whole situation is just a cluster....

 

[jjeff1]

You can try that.

If you have a firewall rule that blocks RTP with a destination of the local machine, that might work.

I'd be more tempted to try and do it with your switch though, but I'm more of a network guy.

The windows firewall rule should not apply to the spanned traffic, since the destination IPs on those packets will be other devices.