Subject: [Sip] RE: [BEHAVE] Outbound and SPI

From: "Dan Wing" <[email-masked]>
Date: Thu, 1 Feb 2007 15:28:27 -0800

(CC'ing sip and the authors of sip-outbound)

That couldn't have been an enjoyable way to have spent a few hours of your
day.  That NAT isn't compliant with BEHAVE, of course, which requires that
such application awareness be turned off for UDP protocols.  For exactly
this reason!

In order to deal with such a NAT with its application layer gateway (SPI)
turned on, it might be prudent for sip-outbound to discuss verifying such a
middlebox isn't dropping STUN packets on UDP/5060.  For example,
sip-outbound could encourage a SIP UA to revert to a less appealing
keepalive mechanism if the initial STUN Binding Request messages don't
result in STUN Binding Response messages.

I expect that same SPI would have dropped the PING method, so it might not
be useful to choose the PING method as the less-appealing keepalive
mechanism.  I expect you're stuck with ".<CR><LF>" or frequent re-Register
to get around such a NAT, but I'll leave that for others to decide.

-d

> -----Original Message-----
> From: Frank W. Miller [mailto:[email-masked]] 
> Sent: Thursday, February 01, 2007 3:06 PM
> To: [email-masked]
> Subject: [BEHAVE] Outbound and SPI
> 
> 
> I ran into an interesting problem today while testing with a user.  
> While multiplexing STUN over the SIP port, it became apparent 
> that the 
> Stateful Packet Inspection (SPI) in a very popular widely sold 
> NAT/Firewall router that shall remain nameless was blocking the SIP 
> responses.  Won't such behaviour be a problem for the outbound draft 
> that calls for this multiplexing too.  Has anyone else seen this 
> behavior?  It appears that the router wants STUN on the STUN port and 
> SIP on the SIP port.  What do we do about this wrt multiplexing?
> 
> Thanks,
> FM
> 
> 
> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/behave

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip