Call flow explanation

We had the same problem on a Juniper SRX on junos 12.1R2.9.

The SIP provider has 4 IP addresses which change by DNS round robin, and obviously hundreds (max 512 IP addresses) that sent the RTP packets.

The previous firewall was a Snapgear, old, but with ease of use. The Juniper has symmetric NAT and seems more strict.

We managed to get audio from inside to outside using a persistent source nat.

For audio from outside to inside, we had to add a source nat rule:

1. Disable SIP ALG when in use.
2. Make sure you connect always to the same IP of the SIP provider (say 131.131.160.2).
3. If traffic comes in from the IP range of SIP provider, then map source address to the same IP address 131.131.160.2.

The persistent NAT ensures that the traffic is allowed. Obviously it works. Perhaps step 2 can be skipped but given the amount of down time so far I have left it in.

nat { source { pool sip-zipt-nl-no-round-robin { address { 131.131.160.2/32; } } address-persistent; interface { port-overloading off; } rule-set trust-to-untrust { from zone trust; to zone untrust; rule source-nat-rule { match { source-address 0.0.0.0/0; } then { source-nat { interface { persistent-nat { permit any-remote-host; } } } } } }

rule-set sip-incoming { from zone untrust; to zone trust; rule sip-zipt-nl-no-round-robin { match { source-address 131.131.160.0/23; destination-address 0.0.0.0/0; } then { source-nat { pool { sip-zipt-nl-no-round-robin; } } } } } }

This is a workaround that I found that is OK for my situation, but I'd generally consider it a gross hack. I found this gem in chan_sip.c:

/* Always OK if no secret */
if (ast_strlen_zero(secret) && ast_strlen_zero(md5secret))
  return AUTH_SUCCESSFUL;

So, my workaround is to put:

secret=

In the config for each extension. This is OK for me because I'm not worried about someone on my network trying to register for an extension that isn't theirs. In general, however, it's totally insecure because it bypasses any further authentication (including my issue with the username mismatch).