We sell IP PBXes and commonly have a situation where the PBX is installed a customer's main office with a remote office or two connecting their phones remotely. I ran into a weird situation yesterday where we set up a new branch office with a half dozen phones behind a USG 20 with the newest firmware. The PBX was only accepting SIP Invites from the first phone connected and rejecting all other phones. When I did packet captures on phones that were not working, it showed that the source port was different from the port in the header (say, 1311 in the source and 1309 in the header.) After talking with the PBX's manufacturers, we determined it was this mismatch that was causing the Invites to be rejected.
I think tested from behind a USG 50 and Linksys router. In both cases, all the phones worked and I did not see any mismatches on the ports. I'm not sure if this is relevant, but the USG 50 and other routers assign ports in the 10000-15000 range. The USG 20 assigns ports in the 1000-2000 range. Anyway, I tried a second USG 20 with a vanilla config on older firmware and had the same issue. I checked the SIP ALG settings compared to the USG 50 and they were identical (disabled).
I could make the phones work behind the USG 20 by either configuring an IPSEC VPN and connecting to the LAN IP of the PBX, or set the phones up on non-standard SIP ports and doing port forwarding. However, I'm curious if anyone is familiar with this issue. Not all of our customers use VPNs and having to setup nonstandard SIP ports on every phone makes it more difficult to administer. I opened up a ticket with Zyxel and am awaiting a response.
↧