SIP with NAT on a Router

[yamikani2g2]

Dear experts...

Has anyone ever configured SIP trunk coming of CME that has NAT?

Can you please share you experiences on how you resolved one way NAT.\

https://ucpros.net/sip-one-way-audio/

I am being advise the ITSP should be involved issue is the return RTP traffic coming from the ITSP gets lost...

Please share!

[yamikani2g2]

What are we doing wrong here... Same configuration on Asterisk platform we have two way voice.

when i try no NAT there is completely no Audio some calls drop.

I think someone some here here has implemented NAT with Voice what challenges did you have and how where they resolved.

[TONY SMITH]

I have done this several time where the CUBE is inside a NAT gateway, ie the SIP traffic is subject to NAT but it is not being carried out by the CUBE itself.   Depending on the service provider you may or may not need SIP inspection (or ALG) at the NAT firewall to re-write some of the payload.  Most don't.

[yamikani2g2]

This is a small deployment i have one interface pointing to the service provide 10.X.X.X and one leg in the VLAN were phones are 192.168.10.X. Phones can register. I have one way audio am forced to NAT the inside to the outside thats when stuff works... with one way audio..... if i remove i loose audio in both directions.

There is not firewall in front of this device its running CME and on another interface its connecting to the interface.

https://community.cisco.com/t5/ip-telephony-and-phones/sip-one-way-audio-site-has-nat/m-p/3954731

[TONY SMITH]

You shouldn't need to use NAT in that situation.  Instead make sure that your dial peer pointing to the SIP service is bound to interface 10.X.X.X and everything else bound to your internal VLAN.

[yamikani2g2]

I am able to get two way Audio now  LAN to External with No issues.

Issue is External to LAN phones ring and drop.  am getting several errors attached is a Debug cappi

[TONY SMITH]

Could you post debugs from a working inside to outside call?    In the failed example the service provider ended the call with a "Network out of order" message in response to your outgoing OK when the call connected.  Suggesting that it was unhappy with something in that OK message, maybe in the SDP since that's the first outbound SDP in the sequence.  Is the media IP address 10.178.178.110 valid, one that the service provider would expect to send to?

Could you maybe pull debugs from the log rather than the console so you don't get lots of "VOIP-RTR#" embedded in the messages?

[yamikani2g2 · Accepted solution]

Tony! When i did a packet capture i realized that my return RTP traffic was not coming back from my ITSP they did something on their end and it started coming. I also removed NAT from my router and all is working thanks Tony for the suggestions most of all i unbounnd sip on the internal facing interface. I left it on the outgoing interface ie interface facing the ITSP. thanks