SIP messages are not coming back through the firewall

[jkmathew77]

I am doing Voice over IP using SIP PINGTEL Xpressa phones. I have a bunch of phone inside the firewall and a bunch of them outside the firewall on the public net.

Call from outside to host inside works fine, call gets set up and torn down correctly. But if call originates from NATed PIX firewall to host outside call fails because it seems that none of the SIP messages can traverse back through the firewall.

I tried changing it to PAT instead of NAT and i still have the same problem, i also tired using the established command and it does not solve our problem either. Any one has any clue why this is happening?

 

[gbiello]

What version of the PIX IOS are you using? The newer versions have a fixup protocol to handle SIP. Do a 'write term' and see if there is a fixup line for SIP. If not, you may need a newer image.
-gbiello

 

[jkmathew77]

Sorry I thought I had mentioned that:

The version that I am running is:
PIX Version 6.2(1)

And there is a fixup like for SIP:
fixup protocol sip 5060

I went to CISCO and downloaded the latest version I believe.

 

[gbiello]

Not knowing anything about SIP except for the existence of the fixup protocol, I can't be of much more help, other than to suggest syslogging to see exactly what's being dropped.
-gbiello

 

[yizhar]

HI.

Does the fixup protocol sip 5060 match the ports that you and remote phones are using?

* I suggest that you open a TAC case.

* There is a "debug sip" command or something similar that can give you some help troubleshooting.
You can issue this command from a telnet session:
debug sip
terminal monitor
(This is to make sure that your telnet session get the messages).

You can stop it using either or both:
no debug sip
term no monitor

* If you manualy set the "reply" ip address at the internal phone, it should be set up to the internal address (same address the computer uses), and NOT to the global address.
This is because the pix "fixup sip" will translate the embedded address also, and if it differs from the header ip address the packet might be dropped.

* You should preffer using NAT over PAT - pix version 6.1 didn't work well with SIP and PAT, version 6.2 is supposed to fix this but I didn't try and I don't know if it is fixed.

* You can try to capture the packets at both sides using some kind of network monitor/sniffer. You should then take a look inside the data payload of the SIP messages for the embedded ip address and port.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar