I’ve come across a strange issue with a Cisco RVS4000 router, firmware V2.0.2.7
First of all, the settings in sip_nat.conf are correct! ALG is turned off in the router!
A PBX sitting behind NAT with ports forwarded establishes a given incoming call with a SIP trunk provider. Packet sniffs have shown the PBX and Trunk agree on given IP’s and port numbers in Session Description Protocol for the conversation. The PBX behaves as you would expect, sending the audio from the agreed ports: PBX PrivateIP/Port(10202) --> Trunk PublicIP/Port(53544).
The strangeness sets in when the packets come out of the WAN side of the router. The call setup is identical however, the first 10 RTP packets are changed to appear to come from a different port: PBX PublicIP/Port(51062) --> Trunk PublicIP/Port(53544).
The remaining RTP packets after the first 10 come from the correct port: PBX PublicIP/Port(10202) --> Trunk PublicIP/Port(53544).
The result is that the SIP trunk provider ignore all RTP packets after the first 10 because their system accepted the first 10 from the “wrong” port and therefore ignores the remaining packets coming from the “right” port.
To make things even stranger, the router behaves properly on subsequent calls. The issue usually only appears after a long period without incoming calls (> 30 min.)
Arg!