Problem with Cisco IP Phone 7942 on proxy

santosigor · ‎08-02-2012

I am a c/c++ programmer on Aker Security Solutions.

We have a SIP proxy and we are having some trouble with a Cisco IP Phone 7942 and I dont know what is wrong with the proxy.
The proxy edits "via", "from", "to" and "call-id" fields of the SIP packet in order to pass through a NAT, but it doesn't work with the Cisco IP Phone 7940.
When the phone sends the  REGISTER packet, the proxy edits it and sends to the server.
The server responds the Trying and the 401 Unauthorized packets, then the phone should send the REGISTER packet with the authorization field, but it sends the REGISTER packet with no authorization as it didn't accept the server response, as far as I know.

Bellow a dump with and without proxy,
packets from the server without proxy:
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 187.86.228.2:5060;branch=z9hG4bK217f4aa3;received=187.86.228.2
From: <sip:262679*100@200.160.1.27>;tag=64ae0cf6aae900024c9b445c-133ef245
To: <sip:262679*100@200.160.1.27>Call-ID: 64ae0cf6-aae90002-e8cdd232-096719c7@187.86.228.2CSeq: 101 REGISTER
User-Agent: Asterisk PBX
Supported: replaces
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Content-Length: 0

SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 187.86.228.2:5060;branch=z9hG4bK217f4aa3;received=187.86.228.2
From: <sip:262679*100@200.160.1.27>;tag=64ae0cf6aae900024c9b445c-133ef245
To: <sip:262679*100@200.160.1.27>;tag=as31973fab
Call-ID: 64ae0cf6-aae90002-e8cdd232-096719c7@187.86.228.2CSeq: 101 REGISTER
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="37cd71d7"
User-Agent: Asterisk PBX
Supported: replaces
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Content-Length: 0

packets from the server with proxy:
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 10.5.7.160:5060;branch=z9hG4bK43b019e2;received=10.5.7.160
From: <sip:262679*100@200.160.1.27>;tag=64ae0cf6aae92a1ae71cc532-90b4ee42
To: <sip:262679*100@200.160.1.27>Call-ID: 64ae0cf6-aae90002-1408f640-4f07a646@10.5.7.160CSeq: 10877 REGISTER
User-agent: Asterisk PBX
Supported: replaces
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Content-Length: 0

SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 10.5.7.160:5060;branch=z9hG4bK43b019e2;received=10.5.7.160
From: <sip:262679*100@200.160.1.27>;tag=64ae0cf6aae92a1ae71cc532-90b4ee42
To: <sip:262679*100@200.160.1.27>;tag=as61971fe1
Call-ID: 64ae0cf6-aae90002-1408f640-4f07a646@10.5.7.160CSeq: 10877 REGISTER
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="6b98b61d"
User-agent: Asterisk PBX
Supported: replaces
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Content-Length: 0

When there is no proxy, everything works very well, but when it pass through the proxy, it doesn't work.
What does the phone expect? There is something worng with the packet passing through the proxy?
Thanks in advance and sorry about my english.

Jonathan Schulenberg · ‎08-02-2012

This phone model is not entirely RFC-compliant; Cisco tweaked the behavior to add features that existed in the SCCP code. Only the original 7940 and 7960 SIP loads were intended to be compatible with third-party SIP UAs. To be honest you'll probably have to get packet captures of the phone registering to a CUCM server and work backward from there. This forum typically doesn't answer this type of question because the phone behavior is "behind the curtain" when working with Cisco's UAs.

Alternatively you can look into a Technology Developer Program membership which may give you additional options. I have heard rumors of Cisco coming after third-parties who reverse-engineered their SCCP protocol though. Be sure to check in with your legal councel on this and follow the EULA that you've already agreed to by creating a Cisco.com account.

Please remember to rate helpful responses and identify helpful or correct answers.