External Phone goes immediately to UNREACHABLE within 4 seconds

I have installed FreePBX with Asterisk 1.8. I had been running TrixBox and have used several external Polycoms with the system in the past without any issues.

I have correctly configured port forwarding on the Firewall and to do some even more extensive testing, I have a Polycom IP 670 outside of the firewall on an IP and have allowed all traffic between that IP and the external IP of the VoIP Server.

The VoIP Server can reach the Internet and all communication seems to work between the VoIP Server and the Polycom. I can format the file system on the Polycom and the Polycom will register with the VoIP server and download the BootROM and Application just fine.

The phone also shows as registered with the configured extension.
I can make a call from the Polycom to my cell phone and hear Bi-Directional Communication.

However, when I use my cell phone to call the Polycom, I get a fast Busy and this appears in the logs of the FreePBX Server:

[2013-04-10 12:21:10] WARNING[2093]: app_dial.c:2345 dial_exec_full: Unable to create channel of type ‘SIP’ (cause 20 - Subscriber absent)

All Internal Calls work between Polycom phones.

I have shut down iptables and disabled Intrusion Detection.

All Outbound and Inbound calls work on all Polycoms inside the system.

The reg.cfg for the phone contains (along with the other standard config:


  reg.1.outboundProxy.address="<EXTERNAL VOIP IP>"


I am very confused at this point and cannot find any relevant information specific to this problem. Everything I find relates to problems with the setup that I have setup correctly.

Any insight or help would be appreciated.

I can even ping the phone from the VoIP server and see bidirectional communication (even AFTER it says its unreachable which happens 4 seconds after it registers):

12:28:01.155165 IP FreePBX1.sip > Polycom.sip: SIP, length: 554
12:28:01.171385 IP Polycom.sip > FreePBX1.sip: SIP, length: 700
12:28:02.154807 IP FreePBX1.sip > Polycom.sip: SIP, length: 554
12:28:02.171250 IP Polycom.sip > FreePBX1.sip: SIP, length: 700
12:28:03.155249 IP FreePBX1.sip > Polycom.sip: SIP, length: 554
12:28:03.180127 IP Polycom.sip > FreePBX1.sip: SIP, length: 700
12:28:04.155391 IP FreePBX1.sip > Polycom.sip: SIP, length: 554
12:28:04.168466 IP Polycom.sip > FreePBX1.sip: SIP, length: 700
12:28:05.154277 IP FreePBX1.sip > Polycom.sip: SIP, length: 554
12:28:05.171197 IP Polycom.sip > FreePBX1.sip: SIP, length: 700

Pings are ICMP and SIP is UDP, totally different type of translation in your firewall. My guess is you have some type of SIP helper turned on in the router that is interfering with the connection.

Very helpful. I removed inspect sip from the global policy map and that worked. It had also works if instead I remove the “nat=yes, externip=xxx.xxx.xxx.xxx” statements.

I am beginning to believe these do something similar to each other.

Now I will need to test the polycom behind NAT. I seem to be able to make calls and receive them without the inspect sip on the ASA. Do you recommend it be left off? Are there any advantages that you know of?

Thanks for your help SkyKing!

You are close, they actually do the same thing so you can’t have two devices doing NAT-T.

It’s best to let Asterisk take care of it and make the ASA as dumb as possible. Asterisk has full control of the RTP (media) and the SIP (signalling) along with the call state. The Cisco has to figure this all out by examining packets and rewriting them on the fly. While it sounds good in practice I have never had great results with any SIP ALG (Application Layer Gateway).