[asterisk-users] Cisco 7960 become UNREACHABLE behind pix firewall

[James Lamanna]

Alyed wrote:

> From: http://www.voip-info.org/wiki/view/Asterisk+sip+qualify
> "If you turn on *qualify* in the configuration of a SIP device in
> sip.conf<http://www.voip-info.org/wiki/view/Asterisk+config+sip.conf>,
> asterisk will send a SIP
> OPTIONS<http://www.voip-info.org/wiki/view/SIP+method+options>command
> regularly to check that the device is still online. If the device
> does not answer within the configured (or default) period (in ms) Asterisk
> considers the device off-line for future calls. This status can be checked
> by the SIPPEER function<http://www.voip-info.org/wiki/view/Asterisk+func+sippeer>,
> and inversely this function will only provide status information for peers
> which have *qualify=yes*."
> My guess is that your Nat/firewall is closing the connection after some time
> the phone is idle, so this way Asterisk will make sure to always have
> communication going trhough that connection so your NAT/firewall won't just
> close it.

Sorry, should have mentioned that all these phones have qualify=yes
and nat=yes in sip.conf.

Thanks.

-- James

> On Sat, Mar 27, 2010 at 8:17 AM, James Lamanna <jlamanna at gmail.com> wrote:
>> Hi,
>> I have about 10 Cisco 7960s behind a PIX 506E (IOS v6.3) firewall.
>> After some period of time, asterisk says that some of them are
>> unreachable, and the phones lose their registration.
>> The only way to make the phones recover is to clear the NAT
>> translation tables for the phones on the PIX (clear xlate...)
>> Does anyone know how to fix this? As you can imagine, it is quite
>> annoying. And it does not happen to all the phones either.
>>
>> sip fixup is enabled on the PIX
>>
>> phone config parts:
>>
>> nat_enable : 1
>> nat_received_processing : 0
>> nat_address: [public ip of PIX]