Remote SIP Registration - 3rd Party IP Endpoint - 606 Not Acceptable 4

[jhengel]

Trying to register a video intercom device that also handles access control systems to an IP Office remotely for the first time. Have used these local to IPO with no issues in the past but am running into an odd issue when the intercom unit is remote to the IPO (traversing internet and NAT). I have this device setup at a site with VPN connectivity to the IP Office and when registering to the FQDN of the IPO over VPN, it registers with the IPO instantly. However, when I change DNS on the device to use public DNS to have it utilize internet/nat connectivity to the IP Office I am getting a 606 Not Acceptable error. The IP Office is behind a Cisco ASA with NAT and ACLs in place for the public IP but something is amiss. SIP trunk on the IPO utilizing the same interface works without issues. SIP registrar is enabled and SIP Remote Extn is enabled. I "dumbed it down" to use the extension for all fields (username, password, etc) to ensure it wasn't something simple but again - connecting "local" over VPN without the NAT in place had no issues.

I looked at sys mon and I see a 401 Unauthorized error for some reason but even after a test of disabling "force authorization" on the SIP extension I still get the 606. Sanitized sys mon logs below.

15:07:04 3601208980mS SIP Rx: UDP remotephonepublicip:1133 -> 10.0.2.50:5060
REGISTER sip:ipo.domain.com SIP/2.0
Via: SIP/2.0/UDP remotephonepublicip:1134;rport;branch=z9hG4bKPjKdQemrex6xtldCnl31thMxDv2ylJT.DA
Max-Forwards: 70
From: "8679" <sip:8679@ipo.domain.com>;tag=LxzlAkY3QQs4Vn.XtZNH5RpXnGH4BN9Z
To: "8679" <sip:8679@ipo.domain.com>
Call-ID: .fL5G7sEBb.f675gxXdZvWzVl50RlF9Y
CSeq: 54707 REGISTER
User-Agent: AXIS A8105-E Network Video Door Station
Contact: "8679" <sip:8679@remotephonepublicip:1134;ob>
Expires: 300
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Content-Length: 0

15:07:04 3601208985mS SIP Tx: UDP 10.0.2.50:5060 -> remotephonepublicip:1134
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP remotephonepublicip:1134;rport;branch=z9hG4bKPjKdQemrex6xtldCnl31thMxDv2ylJT.DA
From: "8679" <sip:8679@ipo.domain.com>;tag=LxzlAkY3QQs4Vn.XtZNH5RpXnGH4BN9Z
Call-ID: .fL5G7sEBb.f675gxXdZvWzVl50RlF9Y
CSeq: 54707 REGISTER
User-Agent: IP Office 9.1.10.0 build 192
Allow: INVITE,ACK,CANCEL,OPTIONS,BYE,REFER,NOTIFY,INFO,SUBSCRIBE,REGISTER,PUBLISH

http://WWW-Authenticate:

Digest nonce="a57c30c91eeb21611c35",realm="ipoffice",algorithm=MD5
Supported: timer
Server: IP Office 9.1.10.0 build 192
To: "8679" <sip:8679@ipo.domain.com>;tag=1d13e07c69763e11
Content-Length: 0

15:07:05 3601209011mS SIP Rx: UDP remotephonepublicip:1133 -> 10.0.2.50:5060
REGISTER sip:ipo.domain.com SIP/2.0
Via: SIP/2.0/UDP remotephonepublicip:1134;rport;branch=z9hG4bKPj.mk-iTghHbBt2tkfmHR6sO7L140iXljH
Max-Forwards: 70
From: "8679" <sip:8679@ipo.domain.com>;tag=LxzlAkY3QQs4Vn.XtZNH5RpXnGH4BN9Z
To: "8679" <sip:8679@ipo.domain.com>
Call-ID: .fL5G7sEBb.f675gxXdZvWzVl50RlF9Y
CSeq: 54708 REGISTER
User-Agent: AXIS A8105-E Network Video Door Station
Contact: "8679" <sip:8679@remotephonepublicip:1134;ob>
Expires: 300
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Authorization: Digest username="8679", realm="ipoffice", nonce="a57c30c91eeb21611c35", uri="sip:ipo.domain.com", response="921c388e59268b873e1883e4c8cceb7c", algorithm=MD5
Content-Length: 0

15:07:05 3601209017mS SIP Tx: UDP 10.0.2.50:5060 -> remotephonepublicip:1134
SIP/2.0 606 Not Acceptable
Via: SIP/2.0/UDP remotephonepublicip:1134;rport;branch=z9hG4bKPj.mk-iTghHbBt2tkfmHR6sO7L140iXljH
From: "8679" <sip:8679@ipo.domain.com>;tag=LxzlAkY3QQs4Vn.XtZNH5RpXnGH4BN9Z
Call-ID: .fL5G7sEBb.f675gxXdZvWzVl50RlF9Y
CSeq: 54708 REGISTER
User-Agent: IP Office 9.1.10.0 build 192
Allow: INVITE,ACK,CANCEL,OPTIONS,BYE,REFER,NOTIFY,INFO,SUBSCRIBE,REGISTER,PUBLISH
Supported: timer
Server: IP Office 9.1.10.0 build 192
To: "8679" <sip:8679@ipo.domain.com>;tag=0fcb71cffca7dc08
Content-Length: 0

 

[holdmusic34]

1) Select Remote Worker for user within IP Office Manager User>User settings.
2) Enable remote worker in the IP Office Manager System>Lan (1 or 2)>VOIP settings.
3) In monitor> Trace Options> SIP> Tab set all.

In your trace you may see something like this before you complete setps 1 and 2:
2017-03-29T14:05:30 415476240mS Sip: SIP FindUserFromAuthentication, <2247> cfg_user f5d71dc0 from_unregister 0 is_ipo_behind_nat 0 [highlight #FCE94F]is_phone_behind_nat 1
[/highlight]2017-03-29T14:05:30 415476240mS Sip: authenicateChallengeRtn 1 cfg_user f5d71dc0
2017-03-29T14:05:30 415476240mS Sip: SIP REG: Remote worker. No remote worker license for user yomama.
2017-03-29T14:05:30 415476240mS Sip: (f29a34e8) SendSIPResponse: REGISTER code 606 SENT TO yomamasipoffice 52740
2017-03-29T14:05:30 415476240mS SIP Reg/Opt Tx: phone
[highlight #FCE94F]SIP/2.0 606 Not Acceptable[/highlight]


Depending on the URI configuration the ICR can be completely ignored.

If your URI is configured to use internal data then the IP Office will look into the user's SIP tab and if you have *'s it will look into ICR.

A madman with a taste for speed.

 

[holdmusic34]

On non-Server Edition systems, up to 4 Basic users are supported as remote extensions without needing to be licensed.

Depending on the URI configuration the ICR can be completely ignored.

If your URI is configured to use internal data then the IP Office will look into the user's SIP tab and if you have *'s it will look into ICR.

A madman with a taste for speed.

 

[jhengel]

I'm thinking it was some combination of one of those. I toggled each setting off and back on, re-pasted in each field, and then power cycled the device and the system and voila. Assuming something was crabby/out of whack. Working now. Cheers!

 

[holdmusic34]

No problem.

Depending on the URI configuration the ICR can be completely ignored.

If your URI is configured to use internal data then the IP Office will look into the user's SIP tab and if you have *'s it will look into ICR.

A madman with a taste for speed.