Have not looked at details on the debug, but you should not have any NAT on the interface that faces your ITSP. Remove that and try again.
Another thing, you should not share your inbound dial peer between your internal and external call legs. Recommend you to create another dial peer to be used as the inbound from your ITSP and add bind statements to all your dial peers. Use the internal interface for the pair that faces CUCM and the external for the pair that faces your ITSP.
The reason for why this would not work is that you need to have different bind statements on the dial peers, so one catch all for the inbound won’t do for this.
It looks like you have at least two CUCMs but only one is defined in your configuration. You should have all call processing nodes defined in your trust list and also have either multiple dial peers towards CUCM or use server groups, where the later would be a more up to date style of configuration. Have a look at this excellent document for how dial peers operate. https://www.cisco.com/c/en/us/support/docs/voice/ip-telephony-voice-over-ip-voip/211306-In-Depth-Explanation-of-Cisco-IOS-and-IO.html
Start by doing the corrections that have been identified up to this point and post a new debug as a attached file as that makes it much easier to search through than if you add the text inline to your post.
For your reference this is from our internal standards configuration documentation for how we normally configure SIP connections to an ITSP. Please note that we do not in general use internet as our bearer circuit, so that might need different adjustments in your case and in general there is no one fits all thing, so our configuration would likely not fit you straight off. For sure for us we often have to make minor adjustments to fit the various ITSPs demands to get this working.
[A.A.A.A] = LAN Interface IP Address (Voice Vlan) [B.B.B.B] = Assigned IP address from ITSP (Outside Interface) [C.C.C.C] = ITSP SIP SBC IP Address [D.D.D.D] = ITSP CPE IP address Note: Please note that for some telco, SIP SBC is same as CPE IP address voice service voip ip address trusted list ipv4 10.138.16.32 ;CPE Subscriber ipv4 10.138.16.33 ;CPE Subscriber ipv4 10.138.16.34 ;CPE Subscriber ;add as many line as there are CPE nodes in the CM cluster ;************** ipv4 [C.C.C.C] ;or ipv4 [C.C.C.C] 255.255.255.xxx ;add as many line as there are needed for ITSP service rtp-port range 16384 32766 ;default, unless specific by Telco address-hiding mode border-element license capacity 25 ;adopt to need for site media bulk-stats allow-connections sip to sip sip header-passing error-passthru early-offer forced midcall-signaling passthru / midcall-signaling passthru media-change midcall-signaling block midcall-signaling preserve-codec privacy-policy passthru ! voice class uri CUCM sip host ipv4:10.138.16.32 ;CPE Subscriber host ipv4:10.138.16.33 ;CPE Subscriber host ipv4:10.138.16.34 ;CPE Subscriber ;add as many line as there are CPE nodes in the CM cluster ! voice class uri PSTN sip host ipv4:[C.C.C.C] ;add as many line as there are needed for ITSP service ! voice class codec 1 codec preference 1 g711ulaw ;Please verify with Telco for the codec supported codec preference 2 g711alaw ! ! voice class sip-profiles 10 ;modify as needed for ITSP service requirement request ANY sip-header From modify "From:(.*)(<sip:.*@.*>)" "From: \2" response ANY sip-header From modify "From:(.*)(<sip:.*@.*>)" "From: \2" request ANY sip-header Remote-Party-ID modify "Remote-Party-ID:(.*)(<sip:.*@.*>)" "Remote-Party-ID: \2" response ANY sip-header Remote-Party-ID modify "Remote-Party-ID:(.*)(<sip:.*@.*>)" "Remote-Party-ID: \2" request ANY sip-header P-Asserted-Identity modify "P-Asserted-Identity:(.*)(<sip:.*@.*>)" "P-Asserted-Identity: \2" response ANY sip-header P-Asserted-Identity modify "P-Asserted-Identity:(.*)(<sip:.*@.*>)" "P-Asserted-Identity: \2" ! voice class e164-pattern-map 1 description E164 Pattern Map for called number to CUCM e164 +8912355599[089].. ! voice class e164-pattern-map 2000 description E164 Pattern Map for called number to PSTN e164 0T ! voice class server-group 1 ipv4 10.138.16.32 preference 1 ipv4 10.138.16.33 preference 2 ipv4 10.138.16.34 preference 3 description Inbound calls from PSTN to CUCM ! voice class server-group 2000 ipv4 [C.C.C.C] preference 1 ;add as many line as there are needed for ITSP service description Outbound calls to PSTN ITSP provider ! voice class sip-options-keepalive 1 description Used for Server Group SIP OPTIONS PING !
voice translation-rule 10
rule 1 /\(.*\)/ /\0/
!
voice translation-rule 20
rule 1 /\(.*\)/ /\0/
!
voice translation-rule 30
rule 1 /\(.*\)/ /\0/
!
voice translation-rule 40
rule 1 /^001017\(.*\)/ /+\1/
rule 2 /^00\(8.*\)/ /+891\1/
rule 3 /^00\(.*\)/ /+89\1/
rule 4 /^0\(.*\)/ /+8912\1/
!
voice translation-rule 60
rule 1 /^\+8912\(.*\)/ /0\1/
rule 2 /^\+891\(8.*\)/ /00\1/
rule 3 /^\+89\(.*\)/ /00\1/
rule 4 /^\+\(.*\)/ /001017\1/
!
voice translation-profile PSTN-IN
translate calling 10
translate called 20
!
voice translation-profile PSTN-OUT
translate calling 30
translate called 40
!
voice translation-profile NOPLUS-IN
translate called 60
!
class-map match-any SIP match protocol sip class-map match-any RTP match protocol rtp ! policy-map VOIP class RTP set dscp ef class SIP set dscp af31 ! interface GigabitEthernet0/0/0 description LAN interface to Voice VLAN ip address [A.A.A.A] 255.255.254.0 duplex full speed 100 media-type rj45 service-policy output VOIP no shutdown ! interface GigabitEthernet0/0/1 description Outside IP Address to Telco ip address [B.B.B.B] 255.255.255.252 no cdp enable no shutdown ! ip route 0.0.0.0 0.0.0.0 10.141.8.1 name INT_CompanyName_DEFAULT ip route [C.C.C.C] 255.255.255.255 [D.D.D.D] name EXT_TO_ITSP; Optional if C and D are not the same. ! sip-ua g729-annexb override retry invite 2 timers trying 300 no remote-party-id ! dial-peer voice 1000 voip description Outbound calls from CUCM translation-profile incoming NOPLUS-IN voice-class codec 1 voice-class sip bind control source-interface GigabitEthernet0/0/0 voice-class sip bind media source-interface GigabitEthernet0/0/0 session protocol sipv2 incoming uri via CUCM dtmf-relay rtp-nte sip-kpml no vad ! dial-peer voice 1010 voip description Inbound calls to CUCM subscribers session protocol sipv2 session server-group 1 destination e164-pattern-map 1 voice-class codec 1 voice-class sip options-keepalive profile 1 voice-class sip bind control source-interface GigabitEthernet0/0/0 voice-class sip bind media source-interface GigabitEthernet0/0/0 dtmf-relay rtp-nte sip-kpml no vad ! dial-peer voice 100 voip description Inbound calls from PSTN translation-profile incoming PSTN-IN session protocol sipv2 incoming uri via PSTN voice-class codec 1 voice-class sip bind control source-interface GigabitEthernet0/0/1 voice-class sip bind media source-interface GigabitEthernet0/0/1 dtmf-relay rtp-nte no vad ! dial-peer voice 110 voip description Outbound calls to PSTN translation-profile outgoing PSTN-OUT session protocol sipv2 session server-group 2000 destination e164-pattern-map 2000 voice-class codec 1 ;if ITSP provider has other requirement for codecs create another profile to match their requirements voice-class sip profiles 10 voice-class sip options-keepalive profile 1 ;if ITSP provider has other requirement for SIP options ping create another profile to match their requirements voice-class sip bind control source-interface GigabitEthernet0/0/1 voice-class sip bind media source-interface GigabitEthernet0/0/1 voice-class sip audio forced dtmf-relay rtp-nte no vad ! **Security Configuration specific for ITSP SIP connection** Some service providers use TCP instead of UDP, or both. Adopt the ACL as needed for the requirements specific to the service provider. ip access-list extended PSTN_ACL remark Permit SIP from ITSP CUBE to CompanyName CUBE permit udp host [C.C.C.C] host [B.B.B.B] eq 5060 permit udp host [C.C.C.C] eq 5060 host [B.B.B.B] remark Permit RTP from ITSP CUBE to CompanyName CUBE permit udp host [C.C.C.C] host [B.B.B.B] range 16384 32766 remark Permit ICMP from ITSP CUBE to CompanyName CUBE permit icmp host [C.C.C.C] host [B.B.B.B] permit icmp host [D.D.D.D] host [B.B.B.B] ! interface GigabitEthernet0/0/1 ip access-group PSTN_ACL in call treatment on call threshold global cpu-avg low 70 high 80 call threshold global total-mem low 70 high 80 call spike 10 steps 6 size 200
One more thing, you don’t have any route statement that points out your internal networks that goes via the internal network interface. You have this “ip route 10.3.3.0 255.255.255.0 172.16.16.1”, as that points to the external network gateway it must be incorrect. It should point to the internal network gateway and likely be more inclusive than only the subnet where your CUCMs are located
Pure speculation, but something along the lines of this would possibly be what you should have ip route 10.0.0.0 255.0.0.0 10.3.3.254. You would need to alter the IP for the gateway in the route statement to fit your setup.
Looked at your debug in details now and you're sending the invite three times without ever getting any response back from your Telco. That's why you eventually get a 408 timeout. You need to make sure that you have communication with the Telco and that you communicate with the proper endpoint on their end.
Further to the point if your using internet as the bearer of traffic it's strongly advised to look at encryption so that not everyone on the interweb can listen in on your calls. Also please note that SIP calls do not like to have any NAT involved, so if you have that on the internet gateway that might cause you all sorts of issues.
Remove these lines from your configuration.
- registrar ipv4:206.80.250.100 expires 3600
- registrar server
The first one is under sip-ua and the second is under voice service voip / sip. Likely you can also remove this sip-server dns:tor.trk.tprm.ca from sip-ua.
Once done with these changes please post your current configuration so that we can verify it.
