FreeSWITCH Sofia DNS Cache SIP/SDP INVITE Auth Fail
Hi, I have been struggling with failed outbound calls to my ITSP. Seems that my FreeSWITCH does not know who to send SIP/SDP INVITE packets to. FS has the DNS cached and uses that to send the first INVITE, then it gets expired and refreshes it to another IP, just in time for the second INVITE, causing an AUTHENTICATION failure. The packet capture would only show the 1st INVITE SIP to one resolved IP. Then, the 2nd INVITE SIP/SDP to a different resolved IP. FS is on a DMZ. I have extensively tested IPTABLES, NAT, and even rebuilt FS from the latest GIT 2 days ago. In the ext. SIP profile, if I use hostname for proxy, initial calls fail, but on redial, they complete. Now, in the same SIP profile, I use the IP address, call are OK. (for both, REG is false) A reasonable solution seems to be to use the IP in the ext. SIP profile. But, is that the best? Any experience with this kind of issue? Any suggestion would be greatly appreciated. Thank you, Cheers
The Borg have many technologies, apparently sip nat traversal is not one of them. Defense against assimilation: 1. Provide open sip server for communications with collective 2. Place behind 2-wire router 3. Laugh at their inability to traverse NAT 4. Repeat On Aug 26, 2010, at 9:04 AM, Locutis of Borg wrote:
Hi,
I have been struggling with failed outbound calls to my ITSP.
Seems that my FreeSWITCH does not know who to send SIP/SDP INVITE packets to. FS has the DNS cached and uses that to send the first INVITE, then it gets expired and refreshes it to another IP, just in time for the second INVITE, causing an AUTHENTICATION failure.
The packet capture would only show the 1st INVITE SIP to one resolved IP. Then, the 2nd INVITE SIP/SDP to a different resolved IP.
FS is on a DMZ. I have extensively tested IPTABLES, NAT, and even rebuilt FS from the latest GIT 2 days ago. In the ext. SIP profile, if I use hostname for proxy, initial calls fail, but on redial, they complete. Now, in the same SIP profile, I use the IP address, call are OK. (for both, REG is false)
A reasonable solution seems to be to use the IP in the ext. SIP profile. But, is that the best?
Any experience with this kind of issue? Any suggestion would be greatly appreciated.
Thank you, Cheers
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
put two wire in bridged mode and use superior assimilated firewall technology in lieu of striking rocks together to scare the packets into alignment... On Thu, Aug 26, 2010 at 1:41 PM, Michael Jerris <mike@jerris.com> wrote:
The Borg have many technologies, apparently sip nat traversal is not one of them.
Defense against assimilation:
1. Provide open sip server for communications with collective 2. Place behind 2-wire router 3. Laugh at their inability to traverse NAT 4. Repeat
On Aug 26, 2010, at 9:04 AM, Locutis of Borg wrote:
Hi,
I have been struggling with failed outbound calls to my ITSP.
Seems that my FreeSWITCH does not know who to send SIP/SDP INVITE packets to. FS has the DNS cached and uses that to send the first INVITE, then it gets expired and refreshes it to another IP, just in time for the second INVITE, causing an AUTHENTICATION failure.
The packet capture would only show the 1st INVITE SIP to one resolved IP. Then, the 2nd INVITE SIP/SDP to a different resolved IP.
FS is on a DMZ. I have extensively tested IPTABLES, NAT, and even rebuilt FS from the latest GIT 2 days ago. In the ext. SIP profile, if I use hostname for proxy, initial calls fail, but on redial, they complete. Now, in the same SIP profile, I use the IP address, call are OK. (for both, REG is false)
A reasonable solution seems to be to use the IP in the ext. SIP profile. But, is that the best?
Any experience with this kind of issue? Any suggestion would be greatly appreciated.
Thank you, Cheers
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
We are Dyslexic of Borg. You will have your ass laminated. /b On Aug 26, 2010, at 12:50 PM, Tony Graziano wrote:
put two wire in bridged mode and use superior assimilated firewall technology in lieu of striking rocks together to scare the packets into alignment...
On Thu, Aug 26, 2010 at 1:41 PM, Michael Jerris <mike@jerris.com> wrote: The Borg have many technologies, apparently sip nat traversal is not one of them.
Defense against assimilation:
1. Provide open sip server for communications with collective 2. Place behind 2-wire router 3. Laugh at their inability to traverse NAT 4. Repeat
You assimilated too much * code into FS. No, but seriously. I may have fixed it without understanding that it was a NAT issue. Ditched the gateway. Went to IP auth. Seems to be working ok. Tried hostname in the dialplan and it seems to resolve ok. I know you guys are probably sick-to-death of explaining NAT. So, don't worry about it. On Thu, Aug 26, 2010 at 1:56 PM, Brian West <brian@freeswitch.org> wrote:
We are Dyslexic of Borg. You will have your ass laminated.
/b
On Aug 26, 2010, at 12:50 PM, Tony Graziano wrote:
put two wire in bridged mode and use superior assimilated firewall technology in lieu of striking rocks together to scare the packets into alignment...
On Thu, Aug 26, 2010 at 1:41 PM, Michael Jerris <mike@jerris.com> wrote: The Borg have many technologies, apparently sip nat traversal is not one of them.
Defense against assimilation:
1. Provide open sip server for communications with collective 2. Place behind 2-wire router 3. Laugh at their inability to traverse NAT 4. Repeat
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (4)
-
Brian West
-
Locutis of Borg
-
Michael Jerris
-
Tony Graziano