[OpenSIPS-Users] Getting a Cisco 7960 to register behind a PIX

[James Lamanna]

Hi Mario,


On Mon, Dec 6, 2010 at 11:08 AM, Advantia VoIP Systems <info at advantia.ca> wrote:
> James,
> On your TFTP server, add this line to either SIPDefault.cnf or
> SIP<macaddress>.cnf:
> nat_enable : 1
> Then reboot your phone.

Adding that results in a problem where OpenSIPS does not send the
reply back to the correct port:

U nat.ip:2370 -> opensips.ip:5060 REGISTER sip:opensips.ip
SIP/2.0..Via: SIP/2.0/UDP nat.ip:8427;branch=z9hG4bK79682dfb..
From: <sip:9515013401 at opensips.ip;user=phone>..To:
<sip:9515013401 at opensips.ip;user=phone>..Call-ID:
00036be7-b0aa0007-736f1483-25859b27 at nat.ip..Date: Mon, 06 Dec 2010
21:28:11 GMT..CSeq: 200 REGISTER..User-Agent
  : CSCO/7..Contact: <sip:9515013401 at nat.ip:8427>..Content-Length:
0..Expires: 45....
#
U opensips.ip:5060 -> nat.ip:8427
  SIP/2.0 401 Unauthorized..Via: SIP/2.0/UDP
nat.ip:8427;branch=z9hG4bK79682dfb..From:
<sip:9515013401 at opensips.ip;user=phone>..To:
<sip:9515013401 at opensips.ip;user=phone>;tag=c5cd5e6c2a1d4c975e04c2ff1b643904.b4fc..Call-ID:
00036be7-b0aa0007-736f1483-25859b27 at nat.ip..CSeq: 200
REGISTER..WWW-Authenticate: Digest realm="asterisk",
nonce="4cfd563d00007e883d77627517b1b7e55ed334da11e6d088"..Server:
OpenSIPS (1.6.3-notls (x86_64/linux))..Content-Length: 0....

-- James

> Mario


> http://advantia.ca
>
> On Mon, Dec 6, 2010 at 10:17 AM, James Lamanna <jlamanna at gmail.com> wrote:
>>
>> Hi,
>> I was wondering if anyone had any experience getting a Cisco 7960
>> phone to register to opensips when the phone is behind a PIX firewall.
>> I'm having a hell of a time getting it to register.
>> I see these messages:
>>
>> U nat.ip:2260 -> opensips.ip:5060
>>  REGISTER sip:opensips.ip SIP/2.0..Via: SIP/2.0/UDP
>> 10.20.33.22:5060;branch=z9hG4bK48039e3a..From: <
>>  sip:xxxxxxx at opensips.ip;user=phone>..To:
>> <sip:xxxxxxxx at opensips.ip;user=phone>..Call-ID: 0003
>>  6be7-b0aa0007-46220771-115f4fcc at 10.20.33.22..Date: Mon, 06 Dec 2010
>> 18:10:49 GMT..CSeq: 107 REGISTER
>>  ..User-Agent: CSCO/7..Contact:
>> <sip:xxxxxxxx at 10.20.33.22:5060>..Content-Length: 0..Expires: 45....
>> #
>> U opensips.ip:5060 -> nat.ip:2260
>>  SIP/2.0 401 Unauthorized..Via: SIP/2.0/UDP
>> 10.20.33.22:5060;branch=z9hG4bK48039e3a;rport=2260;receiv
>>  ed=208.90.184.123..From: <sip:xxxxxxxxx at opensips.ip;user=phone>..To:
>> <sip:xxxxxxxx at opensips.ip;
>>  user=phone>;tag=c5cd5e6c2a1d4c975e04c2ff1b643904.5bf3..Call-ID:
>> 00036be7-b0aa0007-46220771-115f4fcc@
>>  10.20.33.22..CSeq: 107 REGISTER..WWW-Authenticate: Digest
>> realm="asterisk", nonce="4cfd27fe0000780d7
>>  1826527370e7c8b97f663425df75489"..Server: OpenSIPS (1.6.3-notls
>> (x86_64/linux))..Content-Length: 0..
>>  ..
>> #
>> U nat.ip:2260 -> opensips.ip:5060
>>  REGISTER sip:opensips.ip SIP/2.0..Via: SIP/2.0/UDP
>> 10.20.33.22:5060;branch=z9hG4bK48039e3a..From: <
>>  sip:xxxxxxxxx at opensips.ip;user=phone>..To:
>> <sip:xxxxxxxx at opensips.ip;user=phone>..Call-ID: 0003
>>  6be7-b0aa0007-46220771-115f4fcc at 10.20.33.22..Date: Mon, 06 Dec 2010
>> 18:10:49 GMT..CSeq: 107 REGISTER
>>  ..User-Agent: CSCO/7..Contact:
>> <sip:xxxxxxxxx at 10.20.33.22:5060>..Content-Length: 0..Expires: 45....
>> #
>> U opensips.ip:5060 -> nat.ip:2260
>>  SIP/2.0 401 Unauthorized..Via: SIP/2.0/UDP
>> 10.20.33.22:5060;branch=z9hG4bK48039e3a;rport=2260;receiv
>>  ed=208.90.184.123..From: <sip:xxxxxxxx at opensips.ip;user=phone>..To:
>> <sip:xxxxxxxxx at opensips.ip;
>>  user=phone>;tag=c5cd5e6c2a1d4c975e04c2ff1b643904.5bf3..Call-ID:
>> 00036be7-b0aa0007-46220771-115f4fcc@
>>  10.20.33.22..CSeq: 107 REGISTER..WWW-Authenticate: Digest
>> realm="asterisk", nonce="4cfd28000000780e5
>>  c3381d838a044479357aa6c660df432"..Server: OpenSIPS (1.6.3-notls
>> (x86_64/linux))..Content-Length: 0..
>>
>> This suggests the 401 response is not making it back to the
>> phone....but I'm not sure why the PIX would be blocking it.
>> All sip fixup is off.
>>
>> Any configuration suggestions would be much appreciated.
>> The phone has:
>> nat_enable: 0
>> nat_received_processing: 0
>>
>> That was the only way I could get opensips to send the responses back
>> to the correct port.
>>
>> Thanks.
>>
>> -- James
>>
>> _______________________________________________
>> Users mailing list
>> Users at lists.opensips.org
>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>
>
> _______________________________________________
> Users mailing list
> Users at lists.opensips.org
> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>
>