Symptom

MS teams direct routing using CUBE with as VRF aware. Without media bypass feature the functionality works. With media bypass feature on teams side there is ICE-lite configuration required on CUBE with STUN client. After an inbound call from MS teams the call is established, but the call is dropped after 10 seconds with reason code "MediaError". As per Microsoft documentation, this is because MS side did not receive response to STUN messages. Through debug voip stun packet we see that the response packet is created and leaves the SBC. But on an incorrect interface. After making packet captures on Internet facing interface Gi 0/0/1, I see inbound STUN traffic, but no outbound. This interface is in VRF INET01. However after making at the same time packet captures on Gi0/0/0, which is in default VRF, I see the outbound STUN messages (our responses) leaving from this interfaces incorrectly, even with the IP address of Gi0/0/1. There is a similar bug CSCvw66424, claimed to be resolved in 17.06.3. We are on version 17.06.03a, ISR4331 device.

Conditions

Hardware Platform: ISR4331 Software version: 17.6 Direct routing with MS teams configured VRF aware CUBE

Workaround

N/A

Further Problem Description