[OpenSIPS-Users] Getting a Cisco 7960 to register behind a PIX

[James Lamanna]

Hi,
I was wondering if anyone had any experience getting a Cisco 7960
phone to register to opensips when the phone is behind a PIX firewall.
I'm having a hell of a time getting it to register.
I see these messages:

U nat.ip:2260 -> opensips.ip:5060
  REGISTER sip:opensips.ip SIP/2.0..Via: SIP/2.0/UDP
10.20.33.22:5060;branch=z9hG4bK48039e3a..From: <
  sip:xxxxxxx at opensips.ip;user=phone>..To:
<sip:xxxxxxxx at opensips.ip;user=phone>..Call-ID: 0003
  6be7-b0aa0007-46220771-115f4fcc at 10.20.33.22..Date: Mon, 06 Dec 2010
18:10:49 GMT..CSeq: 107 REGISTER
  ..User-Agent: CSCO/7..Contact:
<sip:xxxxxxxx at 10.20.33.22:5060>..Content-Length: 0..Expires: 45....
#
U opensips.ip:5060 -> nat.ip:2260
  SIP/2.0 401 Unauthorized..Via: SIP/2.0/UDP
10.20.33.22:5060;branch=z9hG4bK48039e3a;rport=2260;receiv
  ed=208.90.184.123..From: <sip:xxxxxxxxx at opensips.ip;user=phone>..To:
<sip:xxxxxxxx at opensips.ip;
  user=phone>;tag=c5cd5e6c2a1d4c975e04c2ff1b643904.5bf3..Call-ID:
00036be7-b0aa0007-46220771-115f4fcc@
  10.20.33.22..CSeq: 107 REGISTER..WWW-Authenticate: Digest
realm="asterisk", nonce="4cfd27fe0000780d7
  1826527370e7c8b97f663425df75489"..Server: OpenSIPS (1.6.3-notls
(x86_64/linux))..Content-Length: 0..
  ..
#
U nat.ip:2260 -> opensips.ip:5060
  REGISTER sip:opensips.ip SIP/2.0..Via: SIP/2.0/UDP
10.20.33.22:5060;branch=z9hG4bK48039e3a..From: <
  sip:xxxxxxxxx at opensips.ip;user=phone>..To:
<sip:xxxxxxxx at opensips.ip;user=phone>..Call-ID: 0003
  6be7-b0aa0007-46220771-115f4fcc at 10.20.33.22..Date: Mon, 06 Dec 2010
18:10:49 GMT..CSeq: 107 REGISTER
  ..User-Agent: CSCO/7..Contact:
<sip:xxxxxxxxx at 10.20.33.22:5060>..Content-Length: 0..Expires: 45....
#
U opensips.ip:5060 -> nat.ip:2260
  SIP/2.0 401 Unauthorized..Via: SIP/2.0/UDP
10.20.33.22:5060;branch=z9hG4bK48039e3a;rport=2260;receiv
  ed=208.90.184.123..From: <sip:xxxxxxxx at opensips.ip;user=phone>..To:
<sip:xxxxxxxxx at opensips.ip;
  user=phone>;tag=c5cd5e6c2a1d4c975e04c2ff1b643904.5bf3..Call-ID:
00036be7-b0aa0007-46220771-115f4fcc@
  10.20.33.22..CSeq: 107 REGISTER..WWW-Authenticate: Digest
realm="asterisk", nonce="4cfd28000000780e5
  c3381d838a044479357aa6c660df432"..Server: OpenSIPS (1.6.3-notls
(x86_64/linux))..Content-Length: 0..

This suggests the 401 response is not making it back to the
phone....but I'm not sure why the PIX would be blocking it.
All sip fixup is off.

Any configuration suggestions would be much appreciated.
The phone has:
nat_enable: 0
nat_received_processing: 0

That was the only way I could get opensips to send the responses back
to the correct port.

Thanks.

-- James