Registration fails - no attempt at Reliably Transmitting (NAT)

sub0 · November 6, 2014, 11:59pm

A potential customer has phones deployed behind a Sonicwall NSA 3500. The on-site test phones we have deployed are not able to register. Sonicwalls are known to be a pain but customer already has VoIP service working through it with another provider so it should work.

We have phones in our lab registering successfully with this system. The extensions are all configured with NAT=yes. All phones use the same template.

The sip debug output below shows what is happening. Further below is sip debug output for a phone registering successfully from our lab.

What I don’t understand is: Why doesn’t Asterisk attempt to transmit with the "Reliably Transmitting (NAT)” method like it does with extensions registering from other sites?

###################################

Failed registration dialog:
###################################

<--- SIP read from UDP:x.x.x.x:25416 --->
REGISTER sip:provider.net:5060 SIP/2.0
Via: SIP/2.0/UDP 10.0.3.98:5060;branch=z9hG4bK75c58b2b6BD5EEA2
From: "test-office450" <sip:[email protected]>;tag=8FA0FD5E-FCEE60D9
To: <sip:[email protected]>
CSeq: 1 REGISTER
Call-ID: [email protected]
Contact: <sip:[email protected]:5060>;methods="INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER"
User-Agent: PolycomSoundPointIP-SPIP_450-UA/4.0.4.2906
Accept-Language: en
Max-Forwards: 70
Expires: 3600
Content-Length: 0



<------------->
--- (12 headers 0 lines) ---
Sending to x.x.x.x:5060 (no NAT)
Sending to x.x.x.x:5060 (no NAT)



<--- Transmitting (no NAT) to x.x.x.x:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 10.0.3.98:5060;branch=z9hG4bK75c58b2b6BD5EEA2;received=x.x.x.x
From: "test-office450" <sip:[email protected]>;tag=8FA0FD5E-FCEE60D9
To: <sip:[email protected]>;tag=as5ed61db0
Call-ID: [email protected]
CSeq: 1 REGISTER
Server: FPBX-2.11.0(11.5.1)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="2a95f72e"
Content-Length: 0






<------------>
Scheduling destruction of SIP dialog '[email protected]' in 32000 ms (Method: REGISTER)



<--- SIP read from UDP:x.x.x.x:25416 --->
REGISTER sip:provider.net:5060 SIP/2.0
Via: SIP/2.0/UDP 10.0.3.98:5060;branch=z9hG4bK75c58b2b6BD5EEA2
From: "test-office450" <sip:[email protected]>;tag=8FA0FD5E-FCEE60D9
To: <sip:[email protected]>
CSeq: 1 REGISTER
Call-ID: [email protected]
Contact: <sip:[email protected]:5060>;methods="INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER"
User-Agent: PolycomSoundPointIP-SPIP_450-UA/4.0.4.2906
Accept-Language: en
Max-Forwards: 70
Expires: 3600
Content-Length: 0



<------------->
--- (12 headers 0 lines) ---
Sending to x.x.x.x:5060 (no NAT)



<--- Transmitting (no NAT) to x.x.x.x:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 10.0.3.98:5060;branch=z9hG4bK75c58b2b6BD5EEA2;received=x.x.x.x
From: "test-office450" <sip:[email protected]>;tag=8FA0FD5E-FCEE60D9
To: <sip:[email protected]>;tag=as5ed61db0
Call-ID: [email protected]
CSeq: 1 REGISTER
Server: FPBX-2.11.0(11.5.1)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="2a95f72e"
Content-Length: 0

###################################
Successful registration dialog:
###################################



<--- SIP read from UDP:y.y.y.y:5060 --->
REGISTER sip:provider.net:5060 SIP/2.0
Via: SIP/2.0/UDP 172.16.200.113:5060;branch=z9hG4bK6a287d70CD455F51
From: "test-offsite" <sip:[email protected]>;tag=B8ABDC3A-A673E963
To: <sip:[email protected]>
CSeq: 25 REGISTER
Call-ID: [email protected]
Contact: <sip:[email protected]:5060>;methods="INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER"
User-Agent: PolycomSoundPointIP-SPIP_331-UA/4.0.2.11307
Accept-Language: en
Authorization: Digest username="204", realm="asterisk", nonce="6d9b59ba", uri="sip:provider.net:5060", response="c92d8f0e01672f1714e60532d78e6e6b", algorithm=MD5
Max-Forwards: 70
Expires: 60
Content-Length: 0


<------------->
--- (13 headers 0 lines) ---
Sending to y.y.y.y:5060 (no NAT)
[2014-11-06 12:54:29] NOTICE[1950]: chan_sip.c:16417 check_auth: Correct auth, but based on stale nonce received from '"test-offsite" <sip:[email protected]>;tag=B8ABDC3A-A673E963'


<--- Transmitting (no NAT) to y.y.y.y:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 172.16.200.113:5060;branch=z9hG4bK6a287d70CD455F51;received=y.y.y.y
From: "test-offsite" <sip:[email protected]>;tag=B8ABDC3A-A673E963
To: <sip:[email protected]>;tag=as0364bf42
Call-ID: [email protected]
CSeq: 25 REGISTER
Server: FPBX-2.11.0(11.5.1)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="095c2aca", stale=true
Content-Length: 0




<------------>
Scheduling destruction of SIP dialog '[email protected]' in 32000 ms (Method: REGISTER)


<--- SIP read from UDP:y.y.y.y:5060 --->
REGISTER sip:provider.net:5060 SIP/2.0
Via: SIP/2.0/UDP 172.16.200.113:5060;branch=z9hG4bK9ca62d86A326759F
From: "test-offsite" <sip:[email protected]>;tag=B8ABDC3A-A673E963
To: <sip:[email protected]>
CSeq: 26 REGISTER
Call-ID: [email protected]
Contact: <sip:[email protected]:5060>;methods="INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER"
User-Agent: PolycomSoundPointIP-SPIP_331-UA/4.0.2.11307
Accept-Language: en
Authorization: Digest username="204", realm="asterisk", nonce="095c2aca", uri="sip:provider.net:5060", response="4a266e91fd2297441661de7ae1719fd2", algorithm=MD5
Max-Forwards: 70
Expires: 60
Content-Length: 0


<------------->
--- (13 headers 0 lines) ---
Sending to y.y.y.y:5060 (no NAT)
Reliably Transmitting (NAT) to y.y.y.y:5060:
OPTIONS sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 174.140.227.99:5060;branch=z9hG4bK38d57175;rport
Max-Forwards: 70
From: "Unknown" <sip:[email protected]>;tag=as7b8d7907
To: <sip:[email protected]:5060>
Contact: <sip:[email protected]:5060>
Call-ID: [email protected]:5060
CSeq: 102 OPTIONS
User-Agent: FPBX-2.11.0(11.5.1)
Date: Thu, 06 Nov 2014 20:54:29 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

dicko · November 7, 2014, 3:40am

There is your possible problem,

I think they mangle SIP/SDP traffic so much that the pain can only increase if you try and add another service from/to another provider through their SIP “helper”

sub0 · December 12, 2014, 9:08pm

This problem was “solved” by connecting the phones to a non-sonicwall router.

rchase · December 12, 2014, 9:23pm

Did you check to see if SIP ALG was enabled on the sonicwall and if it is, disable it.

If it is already disabled, check Asterisk SIP settings:

Make sure external IP is set with Dynamic or Static and local networks defined.

If still not working, post the phone config.

There are 3 places that can cause failure in this situation

Phone config - not set to NAT
FreePBX - Asterisk SIP settings not set for external IP, local networks, and nat enabled. Also NAT enabled on extension settings
Router/firewall is causing problems with SIP ALG enabled