This might help you: http://pastebin.freeswitch.org/20301 Try comparing the SIP messages to yours. Notice that it tries to register twice, the first one is Unauthorized. On Fri, Dec 7, 2012 at 1:54 PM, Brian Foster <bdfoster@endigotech.com>wrote:

Let's do this step by step. First of all, my server is off site. We are going through a NAT in order to get to FreeSWITCH. Looks like this is the same setup you have.

I have the same phone as you do: Phone InformationPhone Model SoundPoint IP 335Part Number2345-12375-001 Rev:A MAC Address00:04:F2:37:3D:C0 IP Address10.0.0.39UC Software Version 4.0.2.11307BootROM Software Version5.0.2.12692

Alright so now that we have that squared away, the next step is to set up the phone.

Settings > SIP

Local Settings:

Local SIP Port: 0 Calls Per Line Key: 4 New SDP Type: Disable Live Communication Server Support: Disable Non-Standard Line Seize: Enable Digitmap: Not relevent Digitmap Timeout: 3|3|3|3|3|3 Remove End-of-Dial Marker: Enable Digit Impossible Match: 0

Outbound Proxy:

Address: <Blank> Port: 0 Transport: DNSnaptr

Server 1:

Address: pbx.endigovoip.com Port: 0 Transport: DNSnaptr (You shouldn't have issues with UDPonly, might be worth trying though. Espires (s): 3600 Register: Yes Retry Timeout (ms): 0 Retry Maximum Count: 3 Line Seize Timeout: 30

I do not have a second server.

Settings > Network > NAT

NAT *** IP Address *** Signalling Port *** Media Port Start Keep-Alive Interval (s)

Settings > Lines

*Identification* Display Name Address Authentication User ID Authentication Password Label Type Private Shared Third Party Name Number of Line Keys Calls Per Line Ring TypeLow TrillLow Double TrillMedium TrillMedium Double TrillHigh TrillHigh Double TrillHighest TrillHighest Double TrillBeebleTripletRingback-styleLow Trill PrecedenceRing Splash

*Outbound Proxy* Address Port Transport UDPOnly TCPpreferred DNSnaptr TCPonly TLS

*Server 1* Address Port Transport UDPOnly TCPpreferred DNSnaptr TCPonly TLS Expires (s) Register Yes No Retry Timeout (ms) Retry Maximum Count Line Seize Timeout (s)

*Server 2* Address Port Transport UDPOnly TCPpreferred DNSnaptr TCPonly TLS Expires (s) Register Yes No Retry Timeout (ms) Retry Maximum Count Line Seize Timeout (s)

*Call Diversion* *** Always Forward Enable Disable *** Always Forward To Contact *** If Busy, Forward Enable Disable *** If Busy, Forward To Contact *** On No Answer, Forward Enable Disable *** On No Answer, Forward To Contact *** No Answer Timeout (seconds) *** On Do Not Disturb, Forward Enable Disable * ** On Do Not Disturb, Forward To Contact *** Disable Forward For Shared Lines Yes No *** Forward Specific Caller Enable Disable

*Message Center* Subscription Address Callback Mode Registration Contact Disabled Callback Contact

Check those and let us know where you stand after that.

-BDF

On Fri, Dec 7, 2012 at 1:20 PM, Steven Ayre <steveayre@gmail.com> wrote:

...

Try this parameter: http://wiki.freeswitch.org/wiki/NDLB#NDLB-force-rport

or if that fails http://wiki.freeswitch.org/wiki/NDLB#NDLB-connectile-dysfunction

On 7 December 2012 16:39, Sean Devoy <sdevoy@bizfocused.com> wrote:

...

HI All,****

** **

I am still banging my head against the wall here try to get a Polycom 335 to register w/ FS. I have checked all the SERVER and USER/AUTH fields like 1000 times and 900 variations. I think my problem may be NAT related. I know on my CISCO 504G I had to enable several NAT features to work behind our firewall. I am totally new to Polycom, so some very basic help is needed.****

** **

The server is remote but not behind a NAT there. The phones are NAT’ed to the internet. In the sofia sip trace I see this over and over:****

------------------------------------------------------------------------ ****

recv 552 bytes from udp/[71.127.152.57]:1026 at 16:26:07.358892:****

------------------------------------------------------------------------ ****

REGISTER sip:fs_bfis.bizfocused.com SIP/2.0****

Via: SIP/2.0/UDP 10.10.40.47:5060;branch=z9hG4bKbf81dbdc8E687A5****

From: "228 Sean" <sip:228@fs_bfis.bizfocused.com

...

;tag=3F42C046-B61A297****

To: <sip:228@fs_bfis.bizfocused.com>****

CSeq: 1 REGISTER****

Call-ID: 2f482c2-2599cc43-1fb1a78@10.10.40.47****

Contact: <sip:228@10.10.40.47:5060>;methods="INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER" ****

User-Agent: PolycomSoundPointIP-SPIP_335-UA/3.3.3.0069****

Accept-Language: en****

Max-Forwards: 70****

Expires: 600****

Content-Length: 0****

** **

------------------------------------------------------------------------ ****

send 710 bytes to udp/[71.127.152.57]:5060 at 16:26:07.359067:****

------------------------------------------------------------------------ ****

SIP/2.0 401 Unauthorized****

Via: SIP/2.0/UDP 10.10.40.47:5060 ;branch=z9hG4bKbf81dbdc8E687A5;received=71.127.152.57****

From: "228 Sean" <sip:228@fs_bfis.bizfocused.com>;tag=3F42C046-B61A297 ****

To: <sip:228@fs_bfis.bizfocused.com>;tag=t232me1NSD02S****

Call-ID: 2f482c2-2599cc43-1fb1a78@10.10.40.47****

CSeq: 1 REGISTER****

User-Agent: FreeSWITCH-mod_sofia/1.2.0-rc2+git~20120712T080314Z~435f28cefb+unclean~20120712T101002Z ****

Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, UPDATE, INFO, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE****

Supported: precondition, path, replaces****

WWW-Authenticate: Digest realm="fs_bfis.bizfocused.com", nonce="b9583359-0163-4bf2-9818-788f64c34207", algorithm=MD5, qop="auth"* ***

Content-Length: 0****

****

If I understand correctly, the server should be sending back this 401 message with the nonce so the phone can re-attempt the registration with an encrypted password. If NAT is failing, the phone is never seeing the 401 w/ the nonce.****

** **

So what do I do in the WEB config interface to enable NAT on this phone? ****

** **

Thanks,****

Sean ****

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Brian D. Foster Endigo Computer LLC Email: bdfoster@endigotech.com Phone: 317-800-7876 Indianapolis, Indiana, USA

This message contains confidential information and is intended for those listed in the "To:", "CC:", and/or "BCC:" fields of the message header. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. If verification is required please request a hard-copy version.

-- Brian D. Foster Endigo Computer LLC Email: bdfoster@endigotech.com Phone: 317-800-7876 Indianapolis, Indiana, USA This message contains confidential information and is intended for those listed in the "To:", "CC:", and/or "BCC:" fields of the message header. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. If verification is required please request a hard-copy version.

I had to set SETTINGS > SIP > LOCAL SETTINGS > Local SIP Port: 5062 (first nonzero value I tired). I got logged in!!!! Can't call or be called, but I got REGISTERED! The rest is usually much easier. I think I have NAT RTP issues now. I will look at these next: Try this parameter: http://wiki.freeswitch.org/wiki/NDLB#NDLB-force-rport or if that fails http://wiki.freeswitch.org/wiki/NDLB#NDLB-connectile-dysfunction THANKS AGAIN. From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Sean Devoy Sent: Friday, December 07, 2012 3:15 PM To: 'FreeSWITCH Users Help' Subject: Re: [Freeswitch-users] Polycom IP 335 - 401 Unauthorized .... NAT ISSUE? First Brian THANKS, it clearly took some time to put together such a detailed response. I reset to factory settings. I have updated to a minor newer version than yours. Yours UC Software Version 4.0.2.11307 Mine UC Software Version 4.0.3.7562 I set everything EXACTLY as you specified in your post except my server, extension, password, etc where it applies. It still fails. There is an interesting difference in the SIP Messages though. From yours the phone sends CSeq: 1 Register, gets a response for CSeq: 1 Register (with the nonce), then your phone sends CSeq: 2 Register .

From mine the phone sends CSeq: 1 Register again, and again, and again. I still think it is actually not receiving the 401 message with the nonce.

One other minor difference that may by important. On your FIRST 401 Unauthorized Message Via line says Via: SIP/2.0/UDP 10.0.0.39;branch=z9hG4bK848ac3ba5589D827;received=76.238.166.184;rport=5060 Mine says: Via: SIP/2.0/UDP 10.10.40.47;branch=z9hG4bKa9b37440268F7B2B;received=71.127.152.57 It does not have an rport. I don't know if that matters. It doesn't it matter that other phones here are using port 5060, right? Are their other ports I can specify for rport? How can I tell if the phone is actually getting the 401? The syslog from the phone says: sip |4|03|Registration failed User: 228, Error Code:480 Temporarily not available 10.10.40.47 07/12 14:48:17.315 Thanks again for your help. From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian Foster Sent: Friday, December 07, 2012 2:11 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] Polycom IP 335 - 401 Unauthorized .... NAT ISSUE? This might help you: http://pastebin.freeswitch.org/20301 Try comparing the SIP messages to yours. Notice that it tries to register twice, the first one is Unauthorized. On Fri, Dec 7, 2012 at 1:54 PM, Brian Foster <bdfoster@endigotech.com> wrote: Let's do this step by step. First of all, my server is off site. We are going through a NAT in order to get to FreeSWITCH. Looks like this is the same setup you have. I have the same phone as you do: Phone Information Phone Model SoundPoint IP 335 Part Number 2345-12375-001 Rev:A MAC Address 00:04:F2:37:3D:C0 IP Address 10.0.0.39 UC Software Version 4.0.2.11307 BootROM Software Version 5.0.2.12692 Alright so now that we have that squared away, the next step is to set up the phone. Settings > SIP Local Settings: Local SIP Port: 0 Calls Per Line Key: 4 New SDP Type: Disable Live Communication Server Support: Disable Non-Standard Line Seize: Enable Digitmap: Not relevent Digitmap Timeout: 3|3|3|3|3|3 Remove End-of-Dial Marker: Enable Digit Impossible Match: 0 Outbound Proxy: Address: <Blank> Port: 0 Transport: DNSnaptr Server 1: Address: pbx.endigovoip.com Port: 0 Transport: DNSnaptr (You shouldn't have issues with UDPonly, might be worth trying though. Espires (s): 3600 Register: Yes Retry Timeout (ms): 0 Retry Maximum Count: 3 Line Seize Timeout: 30 I do not have a second server. Settings > Network > NAT NAT * IP Address * Signalling Port 0 * Media Port Start 0 Keep-Alive Interval (s) 0 Settings > Lines <http://10.0.0.39/images/icon_minus.gif> Identification Display Name Brian Foster Address 2546@pbx.endigovoip.com Authentication User ID 2546 Authentication Password [ ] Label 2546 Type (X) Private ( ) Shared Third Party Name Number of Line Keys 2 Calls Per Line 4 Ring Type [Low Trill \/] <http://10.0.0.39/images/icon_minus.gif> Outbound Proxy Address Port 0 Transport [DNSnaptr \/] <http://10.0.0.39/images/icon_minus.gif> Server 1 Address Port 0 Transport [DNSnaptr \/] Expires (s) 3600 Register (X) Yes ( ) No Retry Timeout (ms) 0 Retry Maximum Count 3 Line Seize Timeout (s) 30 <http://10.0.0.39/images/icon_minus.gif> Server 2 Address Port 0 Transport [DNSnaptr \/] Expires (s) 3600 Register (X) Yes ( ) No Retry Timeout (ms) 0 Retry Maximum Count 3 Line Seize Timeout (s) 30 <http://10.0.0.39/images/icon_minus.gif> Call Diversion * Always Forward (X) Enable ( ) Disable * Always Forward To Contact * If Busy, Forward (X) Enable ( ) Disable * If Busy, Forward To Contact * On No Answer, Forward (X) Enable ( ) Disable * On No Answer, Forward To Contact * No Answer Timeout (seconds) 55 * On Do Not Disturb, Forward ( ) Enable (X) Disable * On Do Not Disturb, Forward To Contact * Disable Forward For Shared Lines (X) Yes ( ) No * Forward Specific Caller (X) Enable ( ) Disable <http://10.0.0.39/images/icon_minus.gif> Message Center Subscription Address Callback Mode [Registration \/] Callback Contact Check those and let us know where you stand after that. -BDF On Fri, Dec 7, 2012 at 1:20 PM, Steven Ayre <steveayre@gmail.com> wrote: Try this parameter: http://wiki.freeswitch.org/wiki/NDLB#NDLB-force-rport or if that fails http://wiki.freeswitch.org/wiki/NDLB#NDLB-connectile-dysfunction On 7 December 2012 16:39, Sean Devoy <sdevoy@bizfocused.com> wrote: HI All, I am still banging my head against the wall here try to get a Polycom 335 to register w/ FS. I have checked all the SERVER and USER/AUTH fields like 1000 times and 900 variations. I think my problem may be NAT related. I know on my CISCO 504G I had to enable several NAT features to work behind our firewall. I am totally new to Polycom, so some very basic help is needed. The server is remote but not behind a NAT there. The phones are NAT'ed to the internet. In the sofia sip trace I see this over and over: ------------------------------------------------------------------------ recv 552 bytes from udp/[71.127.152.57]:1026 at 16:26:07.358892: ------------------------------------------------------------------------ REGISTER sip:fs_bfis.bizfocused.com SIP/2.0 Via: SIP/2.0/UDP 10.10.40.47:5060;branch=z9hG4bKbf81dbdc8E687A5 From: "228 Sean" <sip:228@fs_bfis.bizfocused.com <mailto:sip%3A228@fs_bfis.bizfocused.com> >;tag=3F42C046-B61A297 To: <sip:228@fs_bfis.bizfocused.com <mailto:sip%3A228@fs_bfis.bizfocused.com> > CSeq: 1 REGISTER Call-ID: 2f482c2-2599cc43-1fb1a78@10.10.40.47 Contact: <sip:228@10.10.40.47:5060>;methods="INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER" User-Agent: PolycomSoundPointIP-SPIP_335-UA/3.3.3.0069 Accept-Language: en Max-Forwards: 70 Expires: 600 Content-Length: 0 ------------------------------------------------------------------------ send 710 bytes to udp/[71.127.152.57]:5060 at 16:26:07.359067: ------------------------------------------------------------------------ SIP/2.0 401 Unauthorized Via: SIP/2.0/UDP 10.10.40.47:5060;branch=z9hG4bKbf81dbdc8E687A5;received=71.127.152.57 From: "228 Sean" <sip:228@fs_bfis.bizfocused.com <mailto:sip%3A228@fs_bfis.bizfocused.com> >;tag=3F42C046-B61A297 To: <sip:228@fs_bfis.bizfocused.com <mailto:sip%3A228@fs_bfis.bizfocused.com> >;tag=t232me1NSD02S Call-ID: 2f482c2-2599cc43-1fb1a78@10.10.40.47 CSeq: 1 REGISTER User-Agent: FreeSWITCH-mod_sofia/1.2.0-rc2+git~20120712T080314Z~435f28cefb+unclean~20120 712T101002Z Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, UPDATE, INFO, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE Supported: precondition, path, replaces WWW-Authenticate: Digest realm="fs_bfis.bizfocused.com", nonce="b9583359-0163-4bf2-9818-788f64c34207", algorithm=MD5, qop="auth" Content-Length: 0 If I understand correctly, the server should be sending back this 401 message with the nonce so the phone can re-attempt the registration with an encrypted password. If NAT is failing, the phone is never seeing the 401 w/ the nonce. So what do I do in the WEB config interface to enable NAT on this phone? Thanks, Sean _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Brian D. Foster Endigo Computer LLC Email: bdfoster@endigotech.com Phone: 317-800-7876 Indianapolis, Indiana, USA This message contains confidential information and is intended for those listed in the "To:", "CC:", and/or "BCC:" fields of the message header. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. -- Brian D. Foster Endigo Computer LLC Email: bdfoster@endigotech.com Phone: 317-800-7876 Indianapolis, Indiana, USA This message contains confidential information and is intended for those listed in the "To:", "CC:", and/or "BCC:" fields of the message header. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. If verification is required please request a hard-copy version.