Возникла проблема, уже не знаю куда рыть((( И так: я настраиваю sip trunk с провайдером:
Провайдер -> Cisco Asa 5520 -> АТС Avaya.
IP Провайдера 93.191.21.35
IP Моей атс 172.30.0.125
IP Голосового процессора 172.30.0.119
Проблема заключается в том, что сигнал от атс проходит:
UDP GARS 93.191.21.34:0 phone 172.30.0.125:5060, idle 0:01:00, bytes 0, flags ti
UDP GARS 93.191.21.34:5060 phone 172.30.0.125:0, idle 0:01:00, bytes 0, flags ti
UDP GARS 93.191.21.34:5060 phone 172.30.0.125:5060, idle 0:01:00, bytes 7043, flags T
НО, голосовые шлюзы режет аса:
Feb  2 13:14:08 192.168.1.19 %ASA-2-106006: Deny inbound UDP from 93.191.21.35/12516 to 172.30.0.119/37152 on interface GARS
Feb  2 13:14:08 192.168.1.19 %ASA-2-106006: Deny inbound UDP from 93.191.21.35/12516 to 172.30.0.119/37152 on interface GARS
Feb  2 13:14:08 192.168.1.19 %ASA-2-106006: Deny inbound UDP from 93.191.21.35/12516 to 172.30.0.119/37152 on interface GARS
Feb  2 13:14:08 192.168.1.19 %ASA-2-106006: Deny inbound UDP from 93.191.21.35/12516 to 172.30.0.119/37152 on interface GARS
Это при выключении inspect sip, а при включении:
Feb  2 13:09:27 192.168.1.19 %ASA-6-607001: Pre-allocate SIP RTP secondary channel for phone:172.30.0.6/60316 to GARS:93.191.21.34 from 180 message
Feb  2 13:09:27 192.168.1.19 %ASA-6-607001: Pre-allocate SIP RTCP secondary channel for phone:172.30.0.6/60317 to GARS:93.191.21.34 from 180 message
Feb  2 13:09:27 192.168.1.19 %ASA-6-607001: Pre-allocate SIP RTP secondary channel for GARS:93.191.21.34/29982 to phone:172.30.0.6 from 180 message
Feb  2 13:09:27 192.168.1.19 %ASA-6-607001: Pre-allocate SIP RTCP secondary channel for GARS:93.191.21.34/29983 to phone:172.30.0.6 from 180 message
Feb  2 13:09:28 192.168.1.19 %ASA-6-607001: Pre-allocate SIP SIGNALLING UDP secondary channel for GARS:93.191.21.34/5060 to phone:172.30.0.125 from CANCEL message
Feb  2 13:09:28 192.168.1.19 %ASA-6-607001: Pre-allocate SIP SIGNALLING UDP secondary channel for phone:172.30.0.125/5060 to GARS:93.191.21.34 from 4xx message
Feb  2 13:10:11 192.168.1.19 %ASA-6-607001: Pre-allocate SIP NOTIFY TCP secondary channel for inside:10.14.14.250/5067 to phone:172.30.0.125 from 200 message
Feb  2 13:12:17 192.168.1.19 %ASA-6-607001: Pre-allocate SIP NOTIFY TCP secondary channel for inside:10.89.16.105/5071 to phone:172.30.0.125 from 200 message
Feb  2 13:12:59 192.168.1.19 %ASA-6-607001: Pre-allocate SIP NOTIFY TCP secondary channel for inside:10.8.13.160/5077 to phone:172.30.0.125 from 200 message

Конфиг асы:

:
ASA Version 8.2(1)
!
hostname ASA-ALK
enable password 90ROVNeWqPYNnm0t encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 192.168.32.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 50
ip address 192.168.1.19 255.255.252.0
!
interface GigabitEthernet0/2
nameif phone
security-level 100
ip address 172.30.0.200 255.255.0.0
!
interface GigabitEthernet0/3
nameif GARS
security-level 5
ip address 10.203.51.19 255.255.255.0
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
management-only
!
ftp mode passive
object-group network inside_phone
object-group network dest_net
network-object 192.168.144.0 255.255.240.0
network-object 192.168.85.0 255.255.255.0
network-object 192.168.90.0 255.255.255.0
object-group network dest_phone
network-object 172.50.0.0 255.255.0.0
network-object 172.40.0.0 255.255.0.0
network-object 172.60.0.0 255.255.0.0
network-object 192.168.0.0 255.255.252.0
network-object 10.0.0.0 255.0.0.0
object-group network inside_net
network-object 192.168.0.0 255.255.252.0
network-object 10.0.0.0 255.0.0.0
access-list canal_to_vrx extended permit ip 192.168.0.0 255.255.252.0 192.168.144.0 255.255.240.0
access-list canal_to_vrx extended permit ip 172.30.0.0 255.255.0.0 172.50.0.0 255.255.0.0
access-list canal_to_vrx extended permit ip 10.0.0.0 255.0.0.0 172.50.0.0 255.255.0.0
access-list canal_to_nah extended permit ip 192.168.0.0 255.255.252.0 192.168.85.0 255.255.255.0
access-list canal_to_nah extended permit ip 172.30.0.0 255.255.0.0 172.40.0.0 255.255.0.0
access-list canal_to_var extended permit ip 192.168.0.0 255.255.252.0 192.168.90.0 255.255.255.0
access-list canal_to_var extended permit ip 172.30.0.0 255.255.0.0 172.60.0.0 255.255.0.0
access-list canal_to_var extended permit ip 10.0.0.0 255.0.0.0 172.60.0.0 255.255.0.0
access-list inside_access_in extended permit ip 192.168.0.0 255.255.252.0 192.168.144.0 255.255.240.0
access-list inside_access_in extended permit ip 192.168.0.0 255.255.252.0 192.168.90.0 255.255.255.0
access-list inside_access_in extended permit ip 192.168.0.0 255.255.252.0 192.168.85.0 255.255.255.0
access-list inside_access_in extended permit ip 10.0.0.0 255.0.0.0 172.0.0.0 255.0.0.0
access-list inside_access_in extended permit ip 192.168.0.0 255.255.252.0 172.30.0.0 255.255.0.0
access-list inside_access_in extended permit ip 10.0.0.0 255.0.0.0 172.30.0.0 255.255.0.0
access-list inside_access_in extended permit ip 10.0.0.0 255.0.0.0 192.168.85.0 255.255.255.0
access-list inside_access_in extended permit ip 93.191.21.0 255.255.255.0 172.30.0.0 255.255.0.0
access-list phone_access_in extended permit ip 172.30.0.0 255.255.0.0 10.0.0.0 255.0.0.0
access-list phone_access_in extended permit ip 172.30.0.0 255.255.0.0 172.0.0.0 255.0.0.0
access-list phone_access_in extended permit ip 172.30.0.0 255.255.0.0 172.50.0.0 255.255.0.0
access-list phone_access_in extended permit ip 172.30.0.0 255.255.0.0 172.40.0.0 255.255.0.0
access-list phone_access_in extended permit ip 172.30.0.0 255.255.0.0 172.60.0.0 255.255.0.0
access-list phone_access_in extended permit ip 93.191.21.0 255.255.255.0 172.30.0.0 255.255.0.0
access-list phone_access_in extended permit ip 172.30.0.0 255.255.0.0 93.191.21.0 255.255.255.0
access-list phone_access_in extended permit ip 10.203.51.0 255.255.255.0 172.30.0.0 255.255.0.0
access-list phone_access_in extended permit ip 172.30.0.0 255.255.0.0 10.203.51.0 255.255.255.0
access-list Phone_h323 extended permit udp 172.0.0.0 255.0.0.0 172.30.0.0 255.255.0.0
access-list Phone_h323 extended permit tcp 172.0.0.0 255.0.0.0 172.30.0.0 255.255.0.0 eq h323
access-list outside_access_in extended permit ip 172.0.0.0 255.0.0.0 172.30.0.0 255.255.0.0
access-list outside_access_in extended permit ip 172.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0
access-list GARS_access_in extended permit ip 10.203.51.0 255.255.255.0 172.30.0.0 255.255.0.0
access-list GARS_access_in extended permit ip 172.30.0.0 255.255.0.0 10.203.51.0 255.255.255.0
access-list GARS_access_in extended permit ip 93.191.21.0 255.255.255.0 172.30.0.0 255.255.0.0
access-list GARS_access_in extended permit ip 172.30.0.0 255.255.0.0 93.191.21.0 255.255.255.0
access-list GARS_access_in extended permit udp 93.191.21.0 255.255.255.0 172.30.0.0 255.255.0.0
access-list GARS_access_in extended permit ip host 93.191.21.34 172.30.0.0 255.255.0.0
access-list GARS_access_in extended permit udp any any eq sip
access-list GARS_access_list extended permit udp 93.191.21.0 255.255.255.0 172.30.0.0 255.255.0.0 eq sip
access-list GARS_access_list extended permit icmp any any
pager lines 24
logging trap debugging
logging asdm informational
logging host inside 192.168.1.1
mtu outside 1500
mtu inside 1500
mtu phone 1500
mtu GARS 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group phone_access_in in interface phone
route outside 0.0.0.0 0.0.0.0 192.168.32.2 1
route inside 10.0.0.0 255.0.0.0 192.168.1.79 1
route GARS 93.191.21.0 255.255.255.0 10.203.51.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server session-timeout 30
http 192.168.0.0 255.255.252.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec transform-set Office esp-des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 20 match address canal_to_vrx
crypto map outside_map 20 set peer 192.168.10.3
crypto map outside_map 20 set transform-set Office
crypto map outside_map 30 match address canal_to_nah
crypto map outside_map 30 set peer 192.168.39.2
crypto map outside_map 30 set transform-set Office
crypto map outside_map 40 match address canal_to_var
crypto map outside_map 40 set peer 192.168.37.2
crypto map outside_map 40 set transform-set Office
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 192.168.0.0 255.255.252.0 inside
ssh timeout 60
console timeout 60
management-access inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tunnel-group 192.168.10.3 type ipsec-l2l
tunnel-group 192.168.10.3 ipsec-attributes
pre-shared-key *
tunnel-group 192.168.39.2 type ipsec-l2l
tunnel-group 192.168.39.2 ipsec-attributes
pre-shared-key *
tunnel-group 192.168.37.2 type ipsec-l2l
tunnel-group 192.168.37.2 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
  message-length maximum client auto
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect netbios
  inspect tftp
  inspect icmp
  inspect sip
policy-map type inspect sip sip
parameters
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:5873a504c137e5aefbdb8f85b64c917a
: end
ASA-ALK#