The SIP trace shows an oddity. The request has expires=3600, but the response from FS says expires=30. This is happening on ALL devices that have the latest CISCO firmware. Can you see anything wrong with the registration request: ------------------------------------------------------------------------ recv 767 bytes from udp/[69.137.35.208]:1024 at 18:59:53.382917: ------------------------------------------------------------------------ REGISTER sip: [my domain name] SIP/2.0 Via: SIP/2.0/UDP 69.137.35.208:1024;branch=z9hG4bK-b2eec5e;rport From: "Ann-Marie" <sip:11@[my domain name]>;tag=86dec25c650ffef4o0 To: "Ann-Marie" <sip:11@[my domain name]> Call-ID: d1a1e2df-34f61b38@192.168.2.11 CSeq: 10545 REGISTER Max-Forwards: 70 Authorization: Digest username="11",realm="[my domain name]",nonce="6d8f48f6-0d40-4f18-8a87-4b961f7b7881",uri="sip: [my domain name]",algorithm=MD5,response="c73d90489df58e17dad9a9d3b1b06865",qop=auth,nc=00000010,cnonce="4c9c7235" Contact: "Ann-Marie" <sip:11@69.137.35.208:1024>;expires=3600 User-Agent: Cisco/SPA504G-7.5.5 Content-Length: 0 Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE Supported: replaces ------------------------------------------------------------------------ send 614 bytes to udp/[69.137.35.208]:1024 at 18:59:53.386375: ------------------------------------------------------------------------ SIP/2.0 200 OK Via: SIP/2.0/UDP 69.137.35.208:1024;branch=z9hG4bK-b2eec5e;rport=1024 From: "Ann-Marie" <sip:11@[my domain name]>;tag=86dec25c650ffef4o0 To: "Ann-Marie" <sip:11@[my domain name]>;tag=tpUU52gppFZrj Call-ID: d1a1e2df-34f61b38@192.168.2.11 CSeq: 10545 REGISTER Contact: <sip:11@69.137.35.208:1024>;expires=30 Date: Wed, 10 Jun 2015 18:59:53 GMT User-Agent: FreeSWITCH-mod_sofia/1.2.22+git~20140309T212137Z~65fed130e5~64bit Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE Supported: path, replaces Content-Length: 0 From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Michael Jerris Sent: Wednesday, June 10, 2015 1:41 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] TOO Frequent SIP Registration Likely relates to us detecting them as nat. Take a look at the registrations, do they say NAT? To confirm why you would look at the sip trace to see whats going on with the registration, my guess would be sip ALG on the client side messing up the traffic. On Jun 10, 2015, at 1:30 PM, Sean Devoy <sdevoy@bizfocused.com<mailto:sdevoy@bizfocused.com>> wrote: Hi everyone, Forgive my lack of knowledge here. I have a multi-tenant server setup and oddly everything is working correctly! Working correctly isn’t odd, writing when everything is ok is odd. For one of my domains, all of the phones re-register about every 30 seconds. The log is filled with messages like: sofia_reg.c:1532 SIP auth challenge (REGISTER) on sofia profile 'external' for [43@<snip>] On the phones I changed the “Reg Min Expires” to 300 and they disappeared from registration!! Also, the phones are registered, I can call them and their status web page says next registration is xx (30 or less) seconds. So … How often show registered phones re-register? How/Where do I set it? Why only one of my domains? (This domain may be the only one to get the latest firmware in the phones). For extra points does this relate to NAT Keepalive at all? I did google this but the only registration expiration info I can find is on gateways, not phones.