Do you have qualify=yes set in sip.conf for your phones?
When you check sip show peers, does it give you an OK (X ms) or does it say UNREACHABLE or UNMONITORED?
If you enable qualify=yes or qualify=[some number] then Asterisk will poll the SIP UA every once in a while to make sure it is still reachable. This may or may not work. In some cases, if the UA doesn't support the SIP OPTIONS correctly, it will come back and Asterisk will think it is unreachable until it sends another register command. In other cases, it helps keep the ports open on the firewall.
BTW, we have successfully tested NAT with multiple user agents as you describe with pretty much plug and play with Linksys, SMC, Shorewall/Linux and various other NAT router/fw devices with great success. Thus far, we've only had problems with DrayTek routers mangling the UDP packets. In those cases, the UAs registered successfully and all inbound calls worked, but outbound calls did not as the UDP/RTP streams weren't getting handled correctly by the router. They have an updated firmware that solves this problem, but we haven't finished testing it.
On Wednesday, August 13, 2003, at 09:25 PM, Adams, Gavin wrote:
From: George Lin [mailto:[EMAIL PROTECTED]shutdown
I want to deploy multiple SIPs phone in our office. And we havethe firewall at our office router(with ip 211.x.x.x). we have deployed the asterisk with IP 218.x.x.x.
All SIP phones have 192.x.x.x.
We have something similar George, * sits outside the firewall with a registered IP address, the SIP phones sit behind the firewall with 172.16.x.x addresses.
When the SIP phone is power on, they are registered in the asterisk.wephonescan check at asterisk side by issueing "sip show peers", and all theare associated with 211.x.x.x:port-number.
Sounds familiar. Question, do you hide all the phones behind a single IP
address, or does each phone get a unique address? Also, what type of
firewall?
recievePRoblem: Now some times the sip can receive call, and some time it cannotcall. When we dumping the sip log, and see that asterisk tried toINVITEafter 5the specified SIP phone with the 211.x.x.x:port-number, and was failedtimes. But the call orginated from SIP phone is always OK.
Yup, what we initially found. Basically, we started by attempting to hide all the phones behind a single IP address. In this case, make sure you uniquely assign the control port (by default UDP 5060) to something different for each phone.
We use FireWall-1 (older version) that doesn't play nice with "hide
NAT". Basically, it would timeout UDP connections after 40 seconds of no
activity. Not good unless you reduce the reregister time to something
crazy like 30 seconds. Check to see how your firewall/NAT device handles
[P]NAT translation.
Questions are:
1. Does asterisk remember the mapping between 192.x.x.x AND 211.x.x.x:port-number ?
It shouldn't. It might see the 192.x.x.x address in the SIP conversations, but even if it did, it would not be able to route the packets back.
2. When a call to a sip phone, is it asterisk responsiblility to mapthe211.x.x.x:port-number to the 192.x.x.x, and send to the office router? ORit is the office router to remeber all the mapping between each sipphone192.x.x.x and 211.x.x.x:port-number, and asterisk juts sends the 211.x.x.x:port-number to the office router ??
Asterisk should attempt to contact the phone based upon the IP and port seen during a 'sip show peers'. Network device responsible for any and all translations.
3. If it is the office router's responsiblity, what should weconfigurethe office router even there is no firewall???
Unsure about this, I'd focus more on the NAT device. Can you describe the topology from the SIP phone to *?
Regards,
--- Gavin _______________________________________________ Asterisk-Users mailing list [EMAIL PROTECTED] http://lists.digium.com/mailman/listinfo/asterisk-users
_______________________________________________ Asterisk-Users mailing list [EMAIL PROTECTED] http://lists.digium.com/mailman/listinfo/asterisk-users
