Бесконечные SUBSCRIBE запросы от клиентов за NAT

[Astronomik]

Добрый день. У меня возникла проблема с клиентами за NAT. Схема такая. Asterisk - ISA (NAT) - клиенты. Все работает, видео в том числе. Но от клиентов идут постоянные SUBSCRIBE запросы. На одного клиента примерно -4-5 запросов. В итоге количество открытых коннектов превышает 100 на 20 пользователей, на что естественно дико матерится фаерволл на ISA.
Вывод sip show channels

PRIME_BBCODE_SPOILER_SHOW PRIME_BBCODE_SPOILER:

sip show channels
Peer User/ANR Call ID Format Hold Last Message Expiry Peer
192.168.96.5 (None) ZTI1YjY0ZmFjNzk 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) ZTI1YjY0ZmFjNzk 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) ZTI1YjY0ZmFjNzk 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) ZTI1YjY0ZmFjNzk 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) ZTAxOTc5MjBiMTA 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) ZTAxOTc5MjBiMTA 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) ZTAxOTc5MjBiMTA 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) MDQxNGQ5YmNmYWE 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) MDQxNGQ5YmNmYWE 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) MDQxNGQ5YmNmYWE 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) MDQxNGQ5YmNmYWE 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) MDQxNGQ5YmNmYWE 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) MDQxNGQ5YmNmYWE 0x0 (nothing) No Rx: SUBSCRIBE <guest>
192.168.96.5 (None) MDQxNGQ5YmNmYWE 0x0 (nothing) No Rx: SUBSCRIBE <guest>
16 active SIP dialogs

Сделал дебаг одного из номеров

PRIME_BBCODE_SPOILER_SHOW PRIME_BBCODE_SPOILER:

<--- SIP read from UDP:192.168.96.5:35217 --->
SUBSCRIBE sip:Unknown@192.168.96.12:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.99.38:51876;branch=z9hG4bK-d8754z-ca4e271f854e625c-1---d8754z-;rport
Max-Forwards: 70
Contact: <sip:1028@192.168.99.38:35217;rinstance=2bbfba1082e99dc8>
To: "user"<sip:1028@asterisk3a:5060>;tag=as7e1060fe
From: "user"<sip:1028@asterisk3a:5060>;tag=5443092c
Call-ID: ZTAxOTc5MjBiMTA4ZWQ4ZjQ3MDk5NWNmZjM3ZGZhNDA.
CSeq: 2070 SUBSCRIBE
Expires: 120
User-Agent: 3CXPhone 5.0.14900.0
Authorization: Digest username="1028",realm="asterisk",nonce="66c90a4f",uri="sip:Unknown@192.168.96.12:5060",response="812997a763dbb1f5bafad06592c3a5d3",algorithm=MD5
Event: message-summary
Content-Length: 0

<------------->
--- (13 headers 0 lines) ---

<--- SIP read from UDP:192.168.96.5:35217 --->
SUBSCRIBE sip:Unknown@192.168.96.12:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.99.38:51876;branch=z9hG4bK-d8754z-ca4e271f854e625c-1---d8754z-;rport
Max-Forwards: 70
Contact: <sip:1028@192.168.99.38:35217;rinstance=2bbfba1082e99dc8>
To: "user"<sip:1028@asterisk3a:5060>;tag=as7e1060fe
From: "user"<sip:1028@asterisk3a:5060>;tag=5443092c
Call-ID: ZTAxOTc5MjBiMTA4ZWQ4ZjQ3MDk5NWNmZjM3ZGZhNDA.
CSeq: 2070 SUBSCRIBE
Expires: 120
User-Agent: 3CXPhone 5.0.14900.0
Authorization: Digest username="1028",realm="asterisk",nonce="66c90a4f",uri="sip:Unknown@192.168.96.12:5060",response="812997a763dbb1f5bafad06592c3a5d3",algorithm=MD5
Event: message-summary
Content-Length: 0

<------------->
--- (13 headers 0 lines) ---

<--- SIP read from UDP:192.168.96.5:35217 --->
SUBSCRIBE sip:Unknown@192.168.96.12:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.99.38:51876;branch=z9hG4bK-d8754z-ca4e271f854e625c-1---d8754z-;rport
Max-Forwards: 70
Contact: <sip:1028@192.168.99.38:35217;rinstance=2bbfba1082e99dc8>
To: "user"<sip:1028@asterisk3a:5060>;tag=as7e1060fe
From: "user"<sip:1028@asterisk3a:5060>;tag=5443092c
Call-ID: ZTAxOTc5MjBiMTA4ZWQ4ZjQ3MDk5NWNmZjM3ZGZhNDA.
CSeq: 2070 SUBSCRIBE
Expires: 120
User-Agent: 3CXPhone 5.0.14900.0
Authorization: Digest username="1028",realm="asterisk",nonce="66c90a4f",uri="sip:Unknown@192.168.96.12:5060",response="812997a763dbb1f5bafad06592c3a5d3",algorithm=MD5
Event: message-summary
Content-Length: 0

<------------->
--- (13 headers 0 lines) ---

Причем SUBSCRIBE флудять только клиенты за NAT. Остальные же вполне спокойно работают и никаких подобных сообщений нету. Подскажите куда копать, потому как эти бесчисленные SUBSCRIBE реально мешают.

[awsswa]

sip show peers покажите
и настройки на клиента

[Astronomik]

PRIME_BBCODE_SPOILER_SHOW PRIME_BBCODE_SPOILER:

sip show peers
Name/username Host Dyn Forcerport ACL Port Status
1002 (Unspecified) D N A 0 UNKNOWN
1003/1003 192.168.96.5 D N A 50949 OK (102 ms)
1004/1004 (Unspecified) D A 0 UNKNOWN
1005/1005 192.168.131.34 D A 5060 OK (181 ms)
1006 (Unspecified) D N A 0 UNKNOWN
1007 (Unspecified) D N A 0 UNKNOWN
1008/1008 192.168.67.11 D N A 5060 OK (112 ms)
1009 (Unspecified) D A 0 UNKNOWN
1010 (Unspecified) D N A 0 UNKNOWN
1011 (Unspecified) D A 0 UNKNOWN
1012 (Unspecified) D N A 0 UNKNOWN
1013 (Unspecified) D N A 0 UNKNOWN
1015 (Unspecified) D N A 0 UNKNOWN
1017/1017 (Unspecified) D A 0 UNKNOWN
1018 (Unspecified) D N A 0 UNKNOWN
1019 (Unspecified) D N A 0 UNKNOWN
1020/1020 (Unspecified) D N A 0 UNKNOWN
1021 (Unspecified) D N A 0 UNKNOWN
1023 (Unspecified) D N A 0 UNKNOWN
1024 (Unspecified) D N A 0 UNKNOWN
1025 (Unspecified) D N A 0 UNKNOWN
1026/1026 192.168.96.5 D N A 44488 OK (1106 ms)
1027 (Unspecified) D N A 0 UNKNOWN
1028/1028 192.168.96.5 D N A 35217 OK (114 ms)
1029 (Unspecified) D N A 0 UNKNOWN
1030/1030 (Unspecified) D N A 0 UNKNOWN
1031/1031 (Unspecified) D N A 0 UNKNOWN
1032 (Unspecified) D N A 0 UNKNOWN
1033 (Unspecified) D N A 0 UNKNOWN
1035/1035 (Unspecified) D A 0 UNKNOWN
1036/1036 (Unspecified) D A 0 UNKNOWN
1037/1037 192.168.201.44 D A 58053 OK (240 ms)
1038 (Unspecified) D A 0 UNKNOWN
1039/1039 192.168.201.65 D A 54291 OK (235 ms)
1040/1040 (Unspecified) D A 0 UNKNOWN
1041 (Unspecified) D A 0 UNKNOWN
1042/1042 192.168.201.70 D A 54163 OK (237 ms)
1044 (Unspecified) D N A 0 UNKNOWN
1046 (Unspecified) D A 0 UNKNOWN
1048/1048 192.168.96.5 D N A 34759 OK (101 ms)
1049/1049 (Unspecified) D N A 0 UNKNOWN
1050/1050 (Unspecified) D N A 0 UNKNOWN
1051 (Unspecified) D N A 0 UNKNOWN
1052 (Unspecified) D A 0 UNKNOWN
1053 (Unspecified) D N A 0 UNKNOWN
1054/1054 (Unspecified) D A 0 UNKNOWN
1061 (Unspecified) D N A 0 UNKNOWN
1065/1065 (Unspecified) D N A 0 UNKNOWN
1081 (Unspecified) D A 0 UNKNOWN
1082 (Unspecified) D N A 0 UNKNOWN
1083 (Unspecified) D N A 0 UNKNOWN
1084 (Unspecified) D N A 0 UNKNOWN
1085/1085 192.168.96.5 D N A 36046 OK (106 ms)
1086/1086 (Unspecified) D A 0 UNKNOWN
1088/1088 (Unspecified) D A 0 UNKNOWN
1089 (Unspecified) D N A 0 UNKNOWN
1091 (Unspecified) D A 0 UNKNOWN
1092 (Unspecified) D A 0 UNKNOWN
1093 (Unspecified) D A 0 UNKNOWN
1094/1094 192.168.96.5 D N A 12732 OK (103 ms)
1101/1101 (Unspecified) D A 0 UNKNOWN
1102 (Unspecified) D A 0 UNKNOWN
1103 (Unspecified) D A 0 UNKNOWN
1105 (Unspecified) D A 0 UNKNOWN
1106 (Unspecified) D A 0 UNKNOWN
1107/1107 (Unspecified) D A 0 UNKNOWN
1108/1108 192.168.96.5 D N A 20489 OK (105 ms)
1109 (Unspecified) D N A 0 UNKNOWN
1110 (Unspecified) D N A 0 UNKNOWN
1111 (Unspecified) D A 0 UNKNOWN
1112/1112 192.168.96.5 D N A 29936 OK (106 ms)
1113/1113 (Unspecified) D N A 0 UNKNOWN
1114 (Unspecified) D N A 0 UNKNOWN
1115 (Unspecified) D N A 0 UNKNOWN
1116 (Unspecified) D N A 0 UNKNOWN
1117/1117 (Unspecified) D N A 0 UNKNOWN
1118/1118 (Unspecified) D N A 0 UNKNOWN
1125 (Unspecified) D A 0 UNKNOWN
1126/1126 192.168.201.52 D A 52003 OK (235 ms)
1128/1128 192.168.201.88 D A 61555 OK (150 ms)
1129 (Unspecified) D N A 0 UNKNOWN
1130 (Unspecified) D A 0 UNKNOWN
1131 (Unspecified) D A 0 UNKNOWN
1132 (Unspecified) D A 0 UNKNOWN
1134 (Unspecified) D A 0 UNKNOWN
1135/1135 (Unspecified) D A 0 UNKNOWN
1136/1136 192.168.200.64 D A 1208 OK (244 ms)
1137/1137 192.168.200.55 D A 1223 OK (246 ms)
1140/1140 192.168.200.95 D A 1189 OK (234 ms)
1141/1141 192.168.200.52 D A 1207 OK (150 ms)
1142 (Unspecified) D A 0 UNKNOWN
1145/1145 (Unspecified) D A 0 UNKNOWN
1146 (Unspecified) D A 0 UNKNOWN
1147/1147 192.168.201.55 D A 56749 OK (237 ms)
1148/1148 192.168.201.59 D A 50901 OK (249 ms)
1152/1152 (Unspecified) D N A 0 UNKNOWN
1153/1153 192.168.201.73 D A 61581 OK (240 ms)
1154/1154 192.168.201.48 D A 60553 OK (242 ms)
1155 (Unspecified) D A 0 UNKNOWN
1156 (Unspecified) D A 0 UNKNOWN
1157 (Unspecified) D A 0 UNKNOWN
1158/1158 192.168.201.81 D A 51898 OK (239 ms)
1159 (Unspecified) D N A 0 UNKNOWN
1160 (Unspecified) D N A 0 UNKNOWN
1162 (Unspecified) D A 0 UNKNOWN
1163 (Unspecified) D N A 0 UNKNOWN
1165/1165 (Unspecified) D A 0 UNKNOWN
1166/1166 (Unspecified) D A 0 UNKNOWN
1167 (Unspecified) D A 0 UNKNOWN
1169 (Unspecified) D N A 0 UNKNOWN
1170 (Unspecified) D A 0 UNKNOWN
1171 (Unspecified) D N A 0 UNKNOWN
1172 (Unspecified) D N A 0 UNKNOWN
1173 (Unspecified) D N A 0 UNKNOWN
1174 (Unspecified) D N A 0 UNKNOWN
1175 (Unspecified) D A 0 UNKNOWN
1176/1176 80.94.235.34 D N A 62957 OK (238 ms)
1177 (Unspecified) D N A 0 UNKNOWN
1178 (Unspecified) D N A 0 UNKNOWN
1179 (Unspecified) D A 0 UNKNOWN
1180 (Unspecified) D A 0 UNKNOWN
1181 (Unspecified) D N A 0 UNKNOWN
1182 (Unspecified) D N A 0 UNKNOWN
1183 (Unspecified) D A 0 UNKNOWN
1185/1185 192.168.200.69 D A 2774 OK (245 ms)
1186 (Unspecified) D A 0 UNKNOWN
1187 (Unspecified) D N A 0 UNKNOWN
1188 (Unspecified) D N A 0 UNKNOWN
1189 (Unspecified) D N A 0 UNKNOWN
1190 (Unspecified) D N A 0 UNKNOWN
1191/1191 (Unspecified) D N A 0 UNKNOWN
1192/1192 (Unspecified) D N A 0 UNKNOWN
1193 (Unspecified) D N A 0 UNKNOWN
1194 (Unspecified) D N A 0 UNKNOWN
1195/1195 (Unspecified) D N A 0 UNKNOWN
1196 (Unspecified) D N A 0 UNKNOWN
1197 (Unspecified) D N A 0 UNKNOWN
1198/1198 (Unspecified) D N A 0 UNKNOWN
1199 (Unspecified) D N A 0 UNKNOWN
1200 (Unspecified) D N A 0 UNKNOWN
1201 (Unspecified) D N A 0 UNKNOWN
1202 (Unspecified) D N A 0 UNKNOWN
1203/1203 (Unspecified) D N A 0 UNKNOWN
1204 (Unspecified) D N A 0 UNKNOWN
1205/1205 192.168.131.39 D N A 5060 OK (98 ms)
1206 (Unspecified) D N A 0 UNKNOWN
1207 (Unspecified) D N A 0 UNKNOWN
1208 (Unspecified) D N A 0 UNKNOWN
1209 (Unspecified) D N A 0 UNKNOWN
1210 (Unspecified) D N A 0 UNKNOWN
1211 (Unspecified) D N A 0 UNKNOWN
1212 (Unspecified) D N A 0 UNKNOWN
1213 (Unspecified) D N A 0 UNKNOWN
1214 (Unspecified) D N A 0 UNKNOWN
1215 (Unspecified) D N A 0 UNKNOWN
1216 (Unspecified) D N A 0 UNKNOWN
1217 (Unspecified) D N A 0 UNKNOWN
1218 (Unspecified) D N A 0 UNKNOWN
1219 (Unspecified) D N A 0 UNKNOWN
1220 (Unspecified) D N A 0 UNKNOWN
1221 (Unspecified) D N A 0 UNKNOWN
1222 (Unspecified) D N A 0 UNKNOWN
1223 (Unspecified) D N A 0 UNKNOWN
1224/1224 (Unspecified) D N A 0 UNKNOWN
1225 (Unspecified) D N A 0 UNKNOWN
1226 (Unspecified) D N A 0 UNKNOWN
1227 (Unspecified) D N A 0 UNKNOWN
1228 (Unspecified) D N A 0 UNKNOWN
1229 (Unspecified) D N A 0 UNKNOWN
1230 (Unspecified) D A 0 UNKNOWN
1231 (Unspecified) D A 0 UNKNOWN
1232/1232 (Unspecified) D A 0 UNKNOWN
1233/1233 (Unspecified) D N A 0 UNKNOWN

Настройки клиента в аттаче.
на всякий случай
core show version
Asterisk 1.8.11.1-1digium1~squeeze built by pbuilder @ nighthawk on a x86_64 running Linux on 2012-04-25 17:36:29 UTC

[SolarW]

... или из файла настроек или вывод команды

Код: Выделить всё

sip show peer 1234

[Astronomik]

Ступил, утро, не проснулся) Извиняюсь.
sip show peer 1028 ( удобнее его, 1234 и 1028 настройки одинаковые)

PRIME_BBCODE_SPOILER_SHOW PRIME_BBCODE_SPOILER:

sip show peer 1028


* Name : 1028
Secret : <Set>
MD5Secret : <Not set>
Remote Secret: <Not set>
Context : from-internal
Subscr.Cont. : <Not set>
Language :
AMA flags : Unknown
Transfer mode: open
CallingPres : Presentation Allowed, Not Screened
Callgroup :
Pickupgroup :
MOH Suggest :
Mailbox : 1028@device
VM Extension : *97
LastMsgsSent : 32767/65535
Call limit : 2147483647
Max forwards : 0
Dynamic : Yes
Callerid : "device" <1028>
MaxCallBR : 384 kbps
Expire : 51
Insecure : no
Force rport : Yes
ACL : Yes
DirectMedACL : No
T.38 support : No
T.38 EC mode : Unknown
T.38 MaxDtgrm: -1
DirectMedia : No
PromiscRedir : No
User=Phone : No
Video Support: Yes
Text Support : No
Ign SDP ver : No
Trust RPID : Yes
Send RPID : No
Subscriptions: Yes
Overlap dial : Yes
DTMFmode : rfc2833
Timer T1 : 500
Timer B : 32000
ToHost :
Addr->IP : 192.168.96.5:35217
Defaddr->IP : (null)
Prim.Transp. : UDP
Allowed.Trsp : UDP
Def. Username: 1028
SIP Options : (none)
Codecs : 0x3c050e (gsm|ulaw|alaw|g729|ilbc|h261|h263|h263p|h264)
Codec Order : (alaw:20,ulaw:20,g729:20,gsm:20,ilbc:30)
Auto-Framing : No
Status : OK (106 ms)
Useragent : 3CXPhone 5.0.14900.0
Reg. Contact : sip:1028@192.168.99.38:35217;rinstance=2bbfba1082e99dc8
Qualify Freq : 60000 ms
Sess-Timers : Accept
Sess-Refresh : uas
Sess-Expires : 1800 secs
Min-Sess : 90 secs
RTP Engine : asterisk
Parkinglot :
Use Reason : No
Encryption : No

конфиг клиента из файла

PRIME_BBCODE_SPOILER_SHOW PRIME_BBCODE_SPOILER:

[1028]
deny=0.0.0.0/0.0.0.0
secret=
dtmfmode=rfc2833
canreinvite=no
context=from-internal
host=dynamic
trustrpid=yes
sendrpid=no
type=friend
nat=yes
port=5060
qualify=yes
qualifyfreq=60
transport=udp
encryption=no
callgroup=
pickupgroup=
dial=SIP/1028
mailbox=1028@device
permit=0.0.0.0/0.0.0.0
callerid=device <1028>
callcounter=yes
faxdetect=no

[awsswa]

а не включен ли у вас hint в диалплане ?
Попробуйте на клиенте за нат убрать port=5060
а qualify=yes выставить в no

[Astronomik]

хинты есть,
exten => 1028,hint,SIP/1028
строка генерировалась автоматом freepbx. Других записей с хинтами не нашел.
Если qualify=no, порты закрываться не будут? Там не высокоинтеллектуальный линуксовый сип коннтрак, там поделие от мелкомягких...
port=5060 убрал, с этим параметром игрался в свое время, визуально ни на что не влиял, все равно клиенты коннектились по 5060 порту, который был указан в sip.conf.

[Vlad1983]

так они и будут валиться пока астериск не начнет на них отвечать
может и отвечает тока ХЗ куда оно уходит

в софтфоне по кнопке "Дополнително" отключить подписывание нельзя?
может какие-нить со странными названиями опции есть, смысл которых понятен только 3xc-писателям.
может скрытые опции в реестре форточки хранятся.

можно попробовать выставить на пирах за NAT
allowsubscribe=no

[Astronomik]

Vlad1983, не имеет значения, какой там клиент. Проблема одна и та же, нам просто более удобен 3cx. Если я правильно понимаю, отвечать он должен по SIP протоколу, по установленной линке. В принципе, клиент получает нормальный ответ, если нат неявный или его нету. (под неявным натом имею в виду цепочку asterisk - маршрутизаторы - linux firewall (nat, sip_nat_conntrac, sip_conntrac) - isa (nat) - клиент). Возникают проблемы именно с клиентами, которые взаимодействуют напрямую с ISA сервером. Я в дампе иногда замечал дропнутые пакеты, но они шли по rtp, потому по идее на subcribe влиять не должны. Если я не прав, поправьте. Счас пробую два варианта, пока разницы не вижу, посмотрим что к вечеру будет.

[ded]

SUBSCRIBE - это не OPTIONS, которые генерирует qualify=yes.
SUBSCRIBE - этолибо presense, либо голосовая почта. Сильно догадываюсь, что софтфон 3СХ пытается показывать состояние френдов - presense, BLF.
И то и другое можно отключить.