I am using SIP between two subnets ( and each connected via VPN.

I have a call server on, and two phones (Ext. 3128) and (Ext. 3126) on the remote subnet.

The WAN IP on the subnet where the call server is located is

There is an issue with quality of service from the ISP with SIP packets, so instead of the phones communicating over the internet, we wish them to communicate over the site-to-site VPN instead (at no point should SIP and RTP packets leave the VPN).

For the invite packet #10, I can see the following inside the header captured with WireShark (source -> destination):


INVITE sip:3126@ SIP/2.0
+ Via: SIP/2.0/UDP;branch=z9hG4bK1ddb1569;rport
+ From: <sip:3128@>;tag=as5c1d47d0
+ To: <sip:3126@>
+ Contact <sip:3128@>
+ Call-ID: 132184eda2535423432dde2343243252@

As far as I understand, once the call has been setup the Call Manager will hand off the conversation between the phones directly with RTP packets.

When this happens, the RTP packets try and out from the rmeote subnet, over the WAN (and not VPN) and try and connect to the address of the WAN router

What is going on here and why does the phone not continue to talk to one another over the VPN via the Call Manager( -> <-, or even directly ( <->

Why is mentioned in the INVITE packet?

No. Time    Source  Destination Protocol    Length  Info
1   0   SIP 504 Request: NOTIFY sip: | 
2   0.219589  SIP 464 Status: 200 OK | 
3   15.006336  SIP 578 Request: OPTIONS sip:3128@ | 
4   15.041422   SIP 383 Status: 200 OK | 
5   20.043149   SIP 508 Request: NOTIFY sip: | 
6   20.263419  SIP 468 Status: 200 OK | 
7   25.212516   SIP 313 Request: ACK sip:3126@ | 
8   25.299476   SIP/SDP 1134    Request: INVITE sip:3126@ | 
9   25.522622  SIP 496 Status: 100 Trying | 
10  25.874887  SIP/SDP 925 Request: INVITE sip:3126@ | 
11  25.876331  SIP 512 Status: 180 Ringing | 
12  25.892092   SIP 366 Status: 100 Trying | 
13  26.01489   SIP 592 Status: 180 Ringing | 
14  26.234984  SIP 512 Status: 180 Ringing | 
15  27.900866   SIP/SDP 782 Status: 200 OK | 
16  28.066616   RTP 214 "PT=ITU-T G.711 PCMU, SSRC=0x2EB141F2, Seq=7931, Time=0, Mark"
  • 1
    The router/firewall that is handling the VPN could possibly alter the addresses as part of NAT. what kind of device do you use for the vpn? I assume the packet you show was captured at the destination? – lacasitos Jun 18 '14 at 17:41
  • On the call server side there is a Zyxel router, on the local side (where the 2 phones are) is a Mikrotik. A IPSEC VPN tunnel is between both. The techs insist the Zyxel does not have NAT or SIP ALG (the Mikrotik definitely has disabled SIP ALG and NAT) - would the trace indicate the Zyxek is changing packets and not the Mikrotik? – morleyc Jun 19 '14 at 7:36

You have use


in sip.conf in general section.

Also you need ensure no nat applied

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.