cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
618
Views
0
Helpful
1
Replies

ASA SIP Inspect intermittently sending wrong REQUEST address

Sean McQuade
Level 5
Level 5

Hi all,

 

We are having trouble with SIP inspect on our ASA when using NAT.

 

The call flow is

 

IP Phone -> CUCM -> CUBE -> ASA -> ITSP

 

In the majority of cases, this is working correctly, but in some cases (maybe 1 call in 50, but frequency varies), the call is failing with a "Your call cannot be completed as dialled". I have ran CCSIP debugs on the CUBE and can see the provider is sending a "404 Route Not found". I raised a case with them, and they have told me, that in the case of a good call, the TO and REQUEST header are the correct address for the ITSP, but in a failed call, the REQUEST address is showing the address of the external interface of the firewall (instead of our NATed endpoint address).

 

In the case of a good call:

 

192.168.46.18 is our internal CUBE address and 88.215.63.169 is the ITSP signalling address. The NAT works correctly and our source address reaches the ITSP as X.X.99.51.

 

In the case of a failed call:

 

The firewall seems to build a new dynamic translation (our normal PAT for internet traffic) and does not re-write the REQUEST header correctly, and instead, sends it with an address of our external interface X.X.99.50, instead of the ITSP address.

 

From the ITSP point of view, they see the invite as:

 

 

From this, I can see that the SIP invite is being sent with the correct TO, FROM & VIA address, but for some reason, the Request-Line is being sent incorrectly, and the ITSP is sending me back a 404 message.

 

I can't explain why this is happening and why it is only happening intermittently. The firewall is running the latest version 9.3.1.

 

Thanks

Sean

1 Reply 1

Excellium
Level 1
Level 1
Hi,

Did you resolve your issue ? If yes, how ?
I have the same and I'm not able to find if I have a bad configuration or if it's a bug ?

Thanks,
Rom1
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: