You configure a static NAT entry 1-to-1 for the asterisk box and allow the SIP (udp 5060) through the firewall, but SIP registration fails constantly.

While troubleshooting the [...]]]> You have an asterisk based VoIP phone system sitting on an internal network and you are trying to establish connectivity to a SIP-based trunk provider.

You configure a static NAT entry 1-to-1 for the asterisk box and allow the SIP (udp 5060) through the firewall, but SIP registration fails constantly.

While troubleshooting the issue you observe some strange behavior in the NAT. The SIP registration packet (source port 5060, destination port 5060) reaches the firewall, changes the source port at the interior interface and to another high port at the exterior interface, but the answer packet will not be translated correctly.

Fw monitor shows the following:

a.b.c.d is the internal (private) IP address
n.n.n.n is the external (public) IP address
w.x.y.z is the SIP providers IP address

eth1.10:i[502]: a.b.c.d -> w.x.y.z (UDP) len=502 id=0

UDP: 5060 -> 5060

eth1.10:I[502]: a.b.c.d -> w.x.y.z (UDP) len=502 id=0

UDP: 17973 -> 5060

eth0:o[502]: a.b.c.d -> w.x.y.z (UDP) len=502 id=0

UDP: 17973 -> 5060

eth0:O[510]: n.n.n.n -> w.x.y.z (UDP) len=510 id=0

UDP: 40625 -> 5060

eth0:i[404]: w.x.y.z -> n.n.n.n (UDP) len=404 id=5495

UDP: 5060 -> 40625

eth0:I[398]: w.x.y.z -> a.b.c.d (UDP) len=398 id=5495

UDP: 5060 -> 17973

eth1.10:o[398]: w.x.y.z -> a.b.c.d (UDP) len=398 id=5495

UDP: 5060 -> 17973

eth1.10:O[398]: w.x.y.z -> a.b.c.d (UDP) len=398 id=5495

UDP: 5060 -> 17973

As it can be seen the reply does not get translated back as it should to destination port 5060 and thus will not be accepted by the asterisk box.

To understand and be able to solve the current dilemma its imperative that we explore why the Checkpoint Firewall is behaving this way and preventing our Asterisk box from registering the SIP trunk.

The Stateful Inspection Technology implements all the necessary firewall capabilities at the network level. The FireWall-1 Inspection Module accesses and analyzes data derived from all communication layers. The FireWall-1 Security Server enables the system administrator to define a Security Policy on a per-user basis.

The Inspection Module is located between the Data Link (IP-Stack) and Network Layer (Device Driver). Authentication and Content Security are provided by a suite of FireWall-1 Security Servers, running at the application layers.

The Security Servers enforce Content Security and Authentication for a particular service. Defining a protocol type within an associated service invokes specific protocol handlers enabling a higher level of security by parsing the protocol, and a higher level of connectivity by tracking dynamic actions and these checks are mostly overridden by SmartDefense checks.

So to recap. As the data moves up the OSI layers, it can be intercepted by both the Security Servers and SmartDefense. In this particular case the protocol definition which invokes specific protocol handlers are modifying the reply SIP packets during translation using a random port and not the UDP 5060 asterisk is expecting.

Modifying the Protocol Type on the udp-sip service under the “Advance UDP Services Properties” from SIP_UDP to None will solve the issue.

Reminds me of a blog entry I read recently “Everything I Know About Business I Learned From Poker” and more specifically the quote: “If there are [...]]]> The more I research on the potential and possibilities of VoIP phone systems, the more companies I see trying to get a piece of the market.

Reminds me of a blog entry I read recently “Everything I Know About Business I Learned From Poker” and more specifically the quote: “If there are too many competitors (some irrational or inexperienced), even if you’re the best it’s a lot harder to win.” which definitely rings true here.

Below is a partial list of VoIP phone systems geared towards small businesses, meaning deployments of less than 50 phones. Although several of these systems can easily scale into the hundreds of phones.

1. PhoneBochs from Rochbochs, Inc. (Duluth, MN based Rochbochs builds appliances based on Linux ranging from firewalls, asterisk telephony, Zimbra Email Collaboration and Fax over IP.)
2. GXE502X from Grandstream. (Brookline, MA based Grandstream builds the GXE502x appliance, a powerful all-in-one voice + video + fax + data communication solution for the small to medium sized business)
3. Jazinga PBX from Jazinga. (Toronto based Jazinga integrates data networking, traditional telephone service and low-cost Voice-over-IP (VoIP) service into one simple solution for small business and homes)
4. Response Point from Microsoft. (Redmond, WA based Microsoft could not miss the action and introduced their next generation phone system for small businesses.)
5. Trixbox from Fonality. (Los Angeles, CA based Fonality who acquired Trixbox which itself was re-branded from the open source project Asterisk @Home brings both software and appliance offerings to the table going beyond the small business market.)
6. Switchvox IP PBX from Digium. (Huntsville, AL based Digium and the cradle of Asterisk brings forth their flagship product Switchvox which is probably one of the most popular offerings out there today.)
7. TalkSwitch from Centrepoint Technologies. (Canada based Centrepoint, now TalkSwitch provides telecommunications solutions ideal for small and multi-location businesses with up to 32 telephone users per office.)
8. PIKA WARP by PIKA Technologies. (Ontario, Canada based PIKA builds appliances focused on Asterisk and Linux solutions for small businesses.)
9. BYOB by yourself. (Locally based, you can “Build Your Own Box” using Sangoma or Digium hardware for POTS landlines and build your own VoIP phone system using any Asterisk distribution, including Trixbox®, Elastix, AsteriskNOW, Elastix, CentPBX, and PBX-in-a-Flash, or FreeSWITCH, or YATE.

Amongst the other options available are the hosted solution where you pay a fixed cost per device, and then there’s the Colo solution where you would have one of the options above hosted by someone else.

There are many variables that need to be taken into account and every business is different.

Small businesses are likely to have some type of broadband connectivity to the Internet, whether cable or DSL and not the more reliable T1 circuit. Although I have not had any problems with my broadband connection for over 3 years, I have seen businesses add redundant cable and/or DSL because they have to stay up when their service gets interrupted occasionally during a storm.

The amount of simultanous calls at any one time and the codec used will also play a role in deciding if the hosted solution is viable, since most broadband providers do not offer symmetrical upload and download speeds but rather assimetrical where the upload is usually much lower than the download speeds.

My rule of thumb for a business with more than 10 phones and 3 lines with heavy phone usage is to stay with the premises PBX and only use VoIP trunks as secondary circuits for savings.

Over the years the technology has matured to the point where its possible to provide reliable phone service over the Internet. [...]]]> Using VoIP lines to save on long distance and/or international calls is smart but real savings come in when you are able to dump your landline and go all the way with VoIP.

Over the years the technology has matured to the point where its possible to provide reliable phone service over the Internet. Vonage being a pioneer in this market and recently major telcos offering this service to their existing client base has begun to erode the excepticism on VoIP.

When migrating for landline to VoIP its very important for the service to just work. People expect the phone to have a dial tone when its picked up just as they expect the lights to come on when the switch is flipped. It has become a utility.

Even though VoIP has come a long way, its important to keep an eye on it. Because voice now travels the same path that data those, there is a wide variety of tools available to measure and monitor performance and availability.

The script below allows you to e-mail you the status of a SIP or IAX trunk on an asterisk based VoIP phone system. The script scheduled every 5 minutes would check the status of the registration status for the specific trunk.

We being by creating two files in the /etc/asterisk directory.

• trunkalerts_iax.txt
• trunkalerts_sip.txt

Each file contains the registration domain and port as shown when querying sip and iax registrations.

Example of trunkalerts_sip.txt

sip.broadvoice.com:5060

Script: (download here)

#!/usr/bin/perl

################################################## #############################
##################### ###########################
####
#### Trunk Alerts script written by Jim Hribnak Oct 7th 2007
#### if there is any questions please feel free to drop me an email at jimh at d
omain nucleus.com
#### Called using Cron job

################################################## #############################
##################### ###########################
####
#### Create the following 2 files in /etc/asterisk
####
#### in the files below add the hosts entry from asterisk -rx “sip show registry
” and
#### from asterisk -rx “iax2 show registry”.
####

open(IAXTRUNKS,”/etc/asterisk/trunkalerts_iax.txt”);
open(SIPTRUNKS,”/etc/asterisk/trunkalerts_sip.txt”);

################################################## #############################
##################### ###########################
####
#### SIP Related Code
####

#print “================================================= ===========\n”;
#print “SIP Trunk information\n”;
#print “================================================= ===========\n”;

while (<SIPTRUNKS>) {
chomp;
$siptrunks = `/usr/sbin/asterisk -rx “sip show registry” |grep \”$_\” | awk ‘{pr
int $4}’`;

#print “siptrunks = $siptrunks\n”;
if ($siptrunks =~ “Registered”) {
#print “$_ is up\n” ;

} else {
#print “We have a problem\n”;
print “$_ trunk is not registering\n”;
mailalert();

}
} #end of while loop (read SIP file)

################################################## #############################
##################### ###########################
####
#### IAX Related Code
####

#print “\n\n============================================= ===============\n”;
#print “IAX2 Trunk information\n”;
#print “================================================= ===========\n”;

while (<IAXTRUNKS>) {
chomp;
$iaxtrunks = `/usr/sbin/asterisk -rx “iax2 show registry” |/bin/grep \”$_\” | aw
k ‘{print $5}’`;

#print “iaxtrunks = $iaxtrunks\n”;

if ($iaxtrunks =~ “Registered”) {
#print “$_ is up\n” ;

} else {
mailalert();
print “We have a problem\n”;
print “$_ trunk is not registering\n”;
my $subject = “Subject: TRUNK $iaxtrunks is DOWN!!!!\n”;
my $content = “TRUNK $iaxtrunks is DOWN!!!!\n”;

}
} #end of while loop (read SIP file)

################################################## ########################
####
#### Email Subroutines
#### Change anywhere below where there is an email address an email addres
#### must have \@ as perl needs to escape the @ symbol
####
################################################## ########################

sub mailalert {

my $sendmail = “/usr/sbin/sendmail -t”;
my $from= “FROM: <pbx\@sekiur.com>\n”; #replace xxx with your FROM email ID
my $reply_to = “Reply-to: <support\@sekiur.com\n”;
my $subject = “Subject: $_ is DOWN!!!!\n”;
my $content = “TRUNK $_ is DOWN!!!!\n”;
my $send_to = “To:<support\@sekiur.com>\n”; #replace xxx with your TO email ID
open(SENDMAIL, “|$sendmail”) or die “Cannot open $sendmail: $!”;
print SENDMAIL $from;
print SENDMAIL $reply_to;
print SENDMAIL $subject;
print SENDMAIL $send_to;
print SENDMAIL $content;
close(SENDMAIL);

#log
my $logfile = “/var/log/asterisk/trunkfailure.log”;
my $date = localtime();
my $logmsg = “$date TRUNK $_ is down”;
open LOGFILE, “>>$logfile” or die “cannot open logfile $logfile for append: $!”;
print LOGFILE $logmsg, “\n”;
close LOGFILE;

print “An email has been sent!\n\n”;
}

Basically the configuration had to be erased, the phone unlocked and pointed to the asterisk server where the tftp daemon is and the firmware lies.

The most important thing to keep in mind is the client/server relationship when calling/forwarding from one server to [...]]]> I have found very scattered and little documentation on connecting two asterisk servers via IAX2, so I decided to put these words together. IAX2 is a protocol that plays nice with NAT and very powerful.

The most important thing to keep in mind is the client/server relationship when calling/forwarding from one server to another. So when you are calling from Server A to Server B, then Server A is the “Client” and Server B is the “Server” and of course if you are calling from Server B to Server A, then Server B would be the “Client” and Server A would be the “Server”.

MORE…

The next thing to know is that “Trunks” allow endpoints to establish a communication channel between each other, but Outbound & Inbound Routes also need to be established.

Home Server:

TRUNKS:

Add IAX2 Trunk

OUTGOING SETTINGS

Trunk name: SOHO
Peer Details:
auth=rsa
context=from-pstn
host=Office server IP address/dns address
inkeys=otherserver
secret=
type=friend
username=home

INCOMING SETTINGS

User Context: office
User Details:
context=from-pstn
host=dynamic
outkey=otherservervoip
secret=
type=friend
username=office

Registration String:
home:@

OUTBOUND ROUTING:

Dial Patterns:
7|.

Trunk Sequence:
Select trunk just built.

Office Server:

TRUNKS:

Add IAX2 Trunk

OUTGOING SETTINGS

Trunk name: SOHO
Peer Details:
auth=rsa
context=from-pstn
host=home server IP address/dns address
inkeys=otherserver
secret=
type=friend
username=office

INCOMING SETTINGS

User Context: home
User Details:
context=from-pstn
host=dynamic
outkey=otherservervoip
secret=
type=friend
username=home

Registration String:
office:@

OUTBOUND ROUTING:

Dial Patterns:
7|.

Trunk Sequence:
Select trunk just built.