SIP Fixup issue- ports being denied

gregwoodson · ‎03-29-2012

After troubleshooting and looking through logs, I think I found it. SIP fixup appears to be working but the RTP ports specified in the SIP Invite are not being opened by the ACL.

4|Mar 29 2012|13:33:45|106023|<<VENDOR ADDRESS 1>>|8290|<<USER ADDRESS 1>>|11678|Deny udp src outside:<<VENDOR ADDRESS 1>>/8290 dst <<VOICE SW>>:<<USER ADDRESS 1>>/11678 by access-group "outside_access_in" [0x0, 0x0]

6|Mar 29 2012|13:33:45|607001|<<USER ADDRESS 1>>|11679|<<VENDOR ADDRESS 2>>||Pre-allocate SIP RTCP secondary channel for <<VOICE SW>>:<<USER ADDRESS 1>>/11679 to outside:<<VENDOR ADDRESS 2>> from INVITE message

6|Mar 29 2012|13:33:45|607001|<<USER ADDRESS 1>>|11678|<<VENDOR ADDRESS 2>>||Pre-allocate SIP RTP secondary channel for <<VOICE SW>>:<<USER ADDRESS 1>>/11678 to outside:<<VENDOR ADDRESS 2>> from INVITE message

Here is what shows in the INVITE from <<USER ADDRESS 1>> to <<VENDOR ADDRESS 2>> telling <<VENDOR ADDRESS 2>> what to use for sending RTP

The ASA should open port 11678

Pre-allocate SIP RTP secondary channel for <<VOICE SW>>:<<USER ADDRESS 1>>/11678

<<VENDOR ADDRESS 2>> responds back with a 180 Ringing w/SDP and tells <<USER ADDRESS 1>> where to send RTP to which is different from the signaling IP of <<VENDOR ADDRESS 2>>

This is sent prior to RTP being sent that gets blocked by the ACL. I am not sure if it is opening port 11678 to ONLY <<VENDOR ADDRESS 2>> or what but it should accept traffic on that port from <<VENDOR ADDRESS 1>> and it is not. I don’t know why this is happening.

Thanks

Greg