Subject: [SIP] A problem in SIP-NAT solution:

From: "YinShaoHua" <[email-masked]>
Date: Thu, 22 Mar 2001 10:30:11 +0800

Hi,
In all the solution that handle SIP signalling through NAT or Firewall, the IP address of SDP message is replaced but the address in SIP headers is not considered. (Please see draft-ietf-sip-call-flows-03.txt or draft-thernelius-sip-firewall-solution-00.txt) Actually, if the address of the SIP headers is not replaced, it will lead to call failure also. 
                 _ _ _ _                                              _ _ _ _
                           \                                           /
A  (Private Address) |NAT1   (Public Address)   NAT2|  B  (Private Address)
                           /                                           \
                   -----                                               ------
Regarding a special case of above figure. The A and B domain have private address, perhaps, they have a same address plan. If one user(A1) of A domain call a user(B1) of B domain through a Proxy(P1) of B domain(viz. A1 --> NAT1 --> NAT2 --> P1 --> B1 ),  meanwhile, A1 and P1 have the same IP address in different private address domain. Therefore, if we don't replace the address of Via header of INVITE message when it go through NAT1, P1 will detect a loop and then reject the call. 
From the above example, I think we should replace the IP address of SIP headers also when SIP message goes through a NAT. Any suggestions are welcomed! 

ShaoHua Yin
SIP Project,Signalling Department,
Huawei Co.LTD
Kefa Road
Science-Based Industrial Park
Nanshan District, Shenzhen,P.R.C

Shenzhen - 518057

Tel: 86-755-6544623
Fax:86-755-6544453
www.huawei.com

---

From: Jiri Kuthan <[email-masked]>
Date: Thu, 22 Mar 2001 04:54:55 +0100

The now-expired I-D draft-rosenberg-sip-firewalls-00.txt discusses
header fields affected by NAT.

Jiri

> YinShaoHua wrote:
> 
> Hi,
> In all the solution that handle SIP signalling through NAT or Firewall, the IP address of SDP message is replaced but the address in SIP headers is not considered.

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.

---

From: "Christopher A. Martin" <[email-masked]>
Date: Thu, 22 Mar 2001 10:29:22 -0600

also see draft-martin-midcom-sip-natfw-callflows-00.txt, which details the
modifications requireed in the SIP body as well.
  -----Original Message-----
  From: [email-masked]
[mailto:[email-masked]]On Behalf Of YinShaoHua
  Sent: Wednesday, March 21, 2001 8:30 PM
  To: [email-masked]
  Subject: [SIP] A problem in SIP-NAT solution:

  Hi,
  In all the solution that handle SIP signalling through NAT or Firewall,
the IP address of SDP message is replaced but the address in SIP headers is
not considered. (Please see draft-ietf-sip-call-flows-03.txt or
draft-thernelius-sip-firewall-solution-00.txt) Actually, if the address of
the SIP headers is not replaced, it will lead to call failure also.
                   _ _ _ _                                              _ _
_ _
                             \                                           /
  A  (Private Address) |NAT1  (Public Address)   NAT2|  B  (Private Address)
                             /                                           \
                     -----                                               ---
---
  Regarding a special case of above figure. The A and B domain have private
address, perhaps, they have a same address plan. If one user(A1) of A domain
call a user(B1) of B domain through a Proxy(P1) of B domain(viz. A1 -->
NAT1 --> NAT2 --> P1 --> B1 ), meanwhile, A1 and P1 have the same IP address
in different private address domain. Therefore, if we don't replace the
address of Via header of INVITE message when it go through NAT1, P1 will
detect a loop and then reject the call.
  From the above example, I think we should replace the IP address of SIP
headers also when SIP message goes through a NAT. Any suggestions are
welcomed!

  ShaoHua Yin

  Shenzhen - 518057

  Tel: 86-755-6544623
  Fax:86-755-6544453
  www.huawei.com