SIP not register from second network in vpn

General Help
1

Hi,
i’ve many pbx with freepbx 4.211.64-6. I use firewall USG 20 with site to site vpn and l2tp vpn.
In all installation i haven’t problem with phone that are in different network class connected in vpn.
In the last installation i can’t register the hardware and software phone:
site A where there is freepbx virtualized with vmware 4: 172.17.1.0/24
site B : 172.17.10.0/24
remote from l2tp: 192.168.86.15 - 192.168.86.20
Vpn are created with an zyxel USG 50.
I can ping from any site to pbx 172.17.1.209
I can ping from pbx any ip in any site and l2tp.
The local site A phone can register and call and receive.
The remote hardware and software phone can’t register.
Asterisk received the SIP request, but i think the response is not send to telephone. Can be a vpn issue?
This is the debug:

<— SIP read from UDP:172.17.1.200:5060 —>
REGISTER sip:172.17.1.209:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.86.15:5060;branch=z9hG4bK-d8754z-fb3b8b49a3706635-1—d8754z-;rport
Max-Forwards: 70
Contact: sip:[email protected]:5060;rinstance=c29e08a6ddc37aaa
To: "209"sip:[email protected]:5060
From: "209"sip:[email protected]:5060;tag=75243d2f
Call-ID: MWRmZDc4NmIyNDhiOGMzZGI0MWVlMWE4NTcwYWNmMzg.
CSeq: 1 REGISTER
Expires: 120
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE
Supported: replaces
User-Agent: 3CXPhone 6.0.26523.0
Content-Length: 0

<------------->
[2013-09-12 21:06:17] VERBOSE[2089] chan_sip.c: — (13 headers 0 lines) —
[2013-09-12 21:06:17] VERBOSE[2089] chan_sip.c: Sending to 172.17.1.200:5060 (no NAT)
[2013-09-12 21:06:17] VERBOSE[2089] chan_sip.c:
<— Transmitting (no NAT) to 172.17.1.200:5060 —>
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.86.15:5060;branch=z9hG4bK-d8754z-fb3b8b49a3706635-1—d8754z-;received=172.17.1.200;rport=5060
From: "209"sip:[email protected]:5060;tag=75243d2f
To: "209"sip:[email protected]:5060;tag=as326e4a66
Call-ID: MWRmZDc4NmIyNDhiOGMzZGI0MWVlMWE4NTcwYWNmMzg.
CSeq: 1 REGISTER
Server: FPBX-2.11.0(11.4.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="0ff863ab"
Content-Length: 0

Can you help me?

2

Did you add that network to localnet table in sip settings module?

3

yes. I’ve add the network localnet in sip settings of freepbx.
The firewall have alg disable.
Now have increase udp time-out in firewall settings.
But the problem not change. PBX receive the invite but the phone not receive the response.

Thank you.

4

Do you have NAT turned on in the tunnel? What happens if you traceroute from the Asterisk box to the remote SIP endpoint?