SIP Invite ACK through ASA 8.4

Michael Dougherty · ‎06-22-2011

Hello Everyone,

I have a rather interesting issue that I have never encountered. I have a client using a CM (unknown version) that makes a UDP 5060 invite to a 3rd party recording device. The CM is sending traffic through an ASA 5510 running 8.4.

Running wireshark we see the SIP invite with source and destination of 5060 but when the recorder device responds it responds with an ICMP code 3 (destination unreachable. If you look at the packet more deeply I see the source and destination ports of 5060 and the proper source and destination IP addresses. There is no NAT being used only ACL and static routing. I have also trurned off the default SIP, H323 and RTP inspections with the same results. I dont think the ASA is rewriting the packet headers but the client says that if they remove the ASA everything works fine.

If anyone has a suggestion I would appreciate it.

brquinn · ‎06-23-2011

The best thing to do is run simultaneous captures on the inside and outside interfaces on the ASA to see how it's affecting the traffic. These commands will capture bi-directional traffic between the two hosts.

Ex:

capture incap interface inside match ip host a.a.a.a host b.b.b.b

capture outcap interface outside match ip host a.a.a.a host b.b.b.b

Download off the captures in pcap format:

https://

The ASA will prompt you to download files named "pcap". Just rename the files to incap1.pcap and outcap1.pcap, etc. and you can open them with wireshark to see if the ASA is blocking any of the packets or changing them in any way.

Thanks,

Brendan

lusandi · ‎07-13-2011

Michael,

I hope you are doing great,

I would like to confirm if you can post from the ASA the following information:

debug sip

debug sip ha

Regards,

Luis Sandi

Michael Dougherty · ‎07-13-2011

Hello Luis,

I actually worked with TAC and we were able to test and verify that the ASA was not the issue. The problem turned out to be the 3rd party recording device. We used a Asterisk box to put in place of the other unit and we were able to record and play back the conversation.

Thanks for your interest.

lusandi · ‎07-14-2011

Well in that case I am glad everything its working now.