ASA5505 and SIP, Gamma Telecom UK

dataIP · ‎08-27-2013

Hi all,

I have been directed here from my previous discussions on the UC500 forums https://supportforums.cisco.com/thread/2235187 as it is thought my issue is more ASA than UC500...

Fundamental problem is I can't get the SIP trunk to register, however we can recieve calls and have two way voice, so we are 90%+ there.

My question relates to how the SIP processing works on the ASA.

What we have is a UC540 behind an ASA5505 connected to the internet via a 887VA and an FTTC connection. The ASA is doing static NAT between the inside address of the UC540 and a spare public IP on the outside of the ASA. SIP inspection is turned on at the ASA.

With this SIP trunk, authentication is provided by IP address rather than user/password (I have other UC540's running using the user/password method and ASA/887VA).

Doing a SIP trace on the UC540 I see repeated attempts to REGISTER.... but no replies. I have not yet determined if the message is reaching the SIP provider, or the reply not being recieved at our end (The second option seeming unlikely as incomming calls do reach us).

001265: Aug 27 15:20:31.583: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:

Sent:

REGISTER sip:88.215.61.195:5060 SIP/2.0

Via: SIP/2.0/UDP 192.168.88.250:5060;branch=z9hG4bK4A2B5DB

From: <sip:01785218530@88.215.61.195>;tag=1E2A5FB0-5B6

To: <sip:01785218530@88.215.61.195>

Date: Tue, 27 Aug 2013 14:20:31 GMT

Call-ID: A0EAB889-E5A11E3-8B18FF77-500910C7

User-Agent: Cisco-SIPGateway/IOS-12.x

Max-Forwards: 70

Timestamp: 1377613231

CSeq: 2 REGISTER

Contact: <sip:01785218530@192.168.88.250:5060>

Expires: 3600

Supported: path

Content-Length: 0

001266: Aug 27 15:20:35.583: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:

Sent:

REGISTER sip:88.215.61.195:5060 SIP/2.0

Via: SIP/2.0/UDP 192.168.88.250:5060;branch=z9hG4bK4A2B5DB

From: <sip:01785218530@88.215.61.195>;tag=1E2A5FB0-5B6

To: <sip:01785218530@88.215.61.195>

Date: Tue, 27 Aug 2013 14:20:35 GMT

Call-ID: A0EAB889-E5A11E3-8B18FF77-500910C7

User-Agent: Cisco-SIPGateway/IOS-12.x

Max-Forwards: 70

Timestamp: 1377613235

CSeq: 2 REGISTER

Contact: <sip:01785218530@192.168.88.250:5060>

Expires: 3600

Supported: path

Content-Length: 0

On the ASA, I can do a sho sip and get the following result (NOTE: The messages may not match precisely to those above... it is part of a large trace and may not be 100% syncronised).

call-id A0EAB889-E5A11E3-8B18FF77-500910C7

CSeq: REGISTER

From: sip:01785218530@88.215.61.195;1E2A5FB0-5B6

To: sip:01785218530@88.215.61.195;

state Call init, timeout 0:03:00 idle 0:00:01

Transaction State Timeout Idle

Cseq 2 REGISTER Transaction Calling 0:03:00 0:00:01

call-id 5888FBC3-A4E11E3-8990FF77-500910C7

CSeq: REGISTER

From: sip:01785218530@88.215.61.195;1E2990F4-DA6

To: sip:01785218530@88.215.61.195;

state Call init, timeout 0:03:00 idle 0:00:50

Transaction State Timeout Idle

Cseq 2067 REGISTER Transaction Calling 0:03:00 0:00:50

call-id A0258FAE-E5A11E3-8B17FF77-500910C7@192.168.88.250

CSeq: UNKNOWN

From: sip:192.168.88.250;1E2A5AA4-1DEA

To: sip:88.215.61.196;

state Call init, timeout 0:03:00 idle 0:00:30

Transaction State Timeout Idle

Cseq 101 UNKNOWN Transaction Unknown 0:03:00 0:00:30

call-id 7BC48D64-E5A11E3-8B15FF77-500910C7@192.168.88.250

CSeq: UNKNOWN

From: sip:192.168.88.250;1E296C3C-209

To: sip:88.215.61.196;

state Call init, timeout 0:03:00 idle 0:01:31

Transaction State Timeout Idle

Cseq 101 UNKNOWN Transaction Unknown 0:03:00 0:01:31

None of the above message show our public IP... which I was expecting to see. All we see is the IP of the SIP provider, and our internal private IP.

Can anyone suggest where to look with this issue?

Thanks

Mark

Rob Wilson · ‎04-04-2014

Hi Mark,

I appreciate that we're 7 months down the line now, but I, too, am trying to connect to Gamma over a SIP trunk.

Our ASA 5510 is doing Static NAT of our public IP address to our internal server IP address, and we've configured SIP Inspection so that all of the headers get NAT'd, too.

Inbound calls work great - all of the headers in the SIP INVITE (and other messages) are NAT'd correctly, so inspection is doing a bang-up job.

However, outbound (from us to Gamma) we were running 8.4.6 release and none of the headers were being inspected and NAT'd (i.e. To: From: P-Asserted-ID, Contact, Via). After upgrading to 8.4.7 every header EXCEPT From: are NAT'd correctly in both directions. So, my big problem now is how to get the From: IP address converted from Private to Public IP and why does the ASA do every other damn field and not this one?

I wrote a SIP normalization script for the CUCM to change the Private IP in the from header to our Public IP address and guess what? The ASA decides to NAT it back to the internal address before sending it out!!!!!!!!!!

So, any help from anyone with similar issue would be massively welcome!

-Rob.

Paul Austin · ‎04-05-2016

Hey, Did you get any resolution to this problem as I have much the same problem with the same setup?

Thanks

Rob Wilson · ‎04-05-2016

Hi Paul,

I opened a TAC case and Cisco eventually decided that it was a bug (CSCuo23892). We were sent an engineering pre-release to use in the meantime but it has been integrated into the main branch now so you shouldn't hit the same issue with a newer version of the software.

Hope that helps

-Rob.

Paul Austin · ‎04-05-2016

Thanks Rob.