Every time I have ever looked at an edited sip trace, the real problem has been obscured by the edits, so I don't bother looking at them anymore .  Check out the sip trace and debug and your config to see why it's detecting nat 

On Wednesday, June 10, 2015, Sean Devoy <sdevoy@bizfocused.com> wrote:

The SIP trace shows an oddity.  The request has expires=3600, but the response from FS says expires=30.  This is happening on ALL devices that have the latest CISCO firmware.  Can you see anything wrong with the registration request:

 

   ------------------------------------------------------------------------

recv 767 bytes from udp/[69.137.35.208]:1024 at 18:59:53.382917:

   ------------------------------------------------------------------------

   REGISTER sip: [my domain name]  SIP/2.0

   Via: SIP/2.0/UDP 69.137.35.208:1024;branch=z9hG4bK-b2eec5e;rport

   From: "Ann-Marie" <sip:11@[my domain name]>;tag=86dec25c650ffef4o0

   To: "Ann-Marie" <sip:11@[my domain name]>

   Call-ID: d1a1e2df-34f61b38@192.168.2.11

   CSeq: 10545 REGISTER

   Max-Forwards: 70

   Authorization: Digest username="11",realm="[my domain name]",nonce="6d8f48f6-0d40-4f18-8a87-4b961f7b7881",uri="sip: [my domain name]",algorithm=MD5,response="c73d90489df58e17dad9a9d3b1b06865",qop=auth,nc=00000010,cnonce="4c9c7235"

   Contact: "Ann-Marie" <sip:11@69.137.35.208:1024>;expires=3600

   User-Agent: Cisco/SPA504G-7.5.5

   Content-Length: 0

   Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE

   Supported: replaces

 

   ------------------------------------------------------------------------

send 614 bytes to udp/[69.137.35.208]:1024 at 18:59:53.386375:

  ------------------------------------------------------------------------

   SIP/2.0 200 OK

   Via: SIP/2.0/UDP 69.137.35.208:1024;branch=z9hG4bK-b2eec5e;rport=1024

   From: "Ann-Marie" <sip:11@[my domain name]>;tag=86dec25c650ffef4o0

   To: "Ann-Marie" <sip:11@[my domain name]>;tag=tpUU52gppFZrj

   Call-ID: d1a1e2df-34f61b38@192.168.2.11

   CSeq: 10545 REGISTER

   Contact: <sip:11@69.137.35.208:1024>;expires=30

   Date: Wed, 10 Jun 2015 18:59:53 GMT

   User-Agent: FreeSWITCH-mod_sofia/1.2.22+git~20140309T212137Z~65fed130e5~64bit

   Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE

   Supported: path, replaces

   Content-Length: 0

 

 

From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Michael Jerris
Sent: Wednesday, June 10, 2015 1:41 PM
To: FreeSWITCH Users Help
Subject: Re: [Freeswitch-users] TOO Frequent SIP Registration

 

Likely relates to us detecting them as nat.  Take a look at the registrations, do they say NAT?  To confirm why you would look at the sip trace to see whats going on with the registration, my guess would be sip ALG on the client side messing up the traffic.

 

On Jun 10, 2015, at 1:30 PM, Sean Devoy <sdevoy@bizfocused.com> wrote:

 

Hi everyone,

 

Forgive my lack of knowledge here.  I have a multi-tenant server setup and oddly everything is working correctly!  Working correctly isn’t odd, writing when everything is ok is odd.

 

For one of my domains, all of the phones re-register about every 30 seconds.  The log is filled with messages like:

sofia_reg.c:1532 SIP auth challenge (REGISTER) on sofia profile 'external' for [43@<snip>]

 

On the phones I changed the “Reg Min Expires” to 300 and they disappeared from registration!!

Also, the phones are registered, I can call them and their status web page says next registration is xx (30 or less) seconds.

 

So … 

How often show registered phones re-register?

How/Where do I set it?

Why only one of my domains?  (This domain may be the only one to get the latest firmware in the phones).

 

For extra points does this relate to NAT Keepalive at all?

 

I did google this but the only registration expiration info I can find is on gateways, not phones.