Why is the SIP phone not registering?

Question

Asterisk

Good day, colleagues!
There is a problem with registering remote phones on the Askozia SIP server.
I have the following network:
- Office 1. There is a Mikrotik router with a subnet of 192.168.1.0/24. The VM is running Askozia with IP 192.168.125. A VPN server (L2TP) has been raised on Mikrotik. White IP 1.1.1.1
- Office 2. There is a Mikrotik with a subnet of 192.168.0.0/24. On Mikrotik, a VPN tunnel was raised to Mikrotik in office 1. There are two SIP phones that cannot register on the server. White IP 2.2.2.2
From office 2 192.168.1.25 responds, and judging by the output of sip set debug, the problem is different.

spoiler

<code>REGISTER sip:192.168.1.25 SIP/2.0
Via: SIP/2.0/UDP 2.2.2.2:5060;branch=z9hG4bK884506602fdce9ff5c28156725d0365a;rport
From: "201" <sip:[email protected]>;tag=1279952574
To: "201" <sip:[email protected]>
Call-ID: [email protected]_168_0_50
CSeq: 587 REGISTER
Contact: <sip:[email protected]:5060>
Max-Forwards: 70
User-Agent: A510 IP/42.207.00.000.000
Expires: 180
Allow: INVITE, ACK, CANCEL, BYE, OPTIONS, INFO, SUBSCRIBE, NOTIFY, REFER
Content-Length: 0

<------------->
--- (12 headers 0 lines) ---
Sending to 2.2.2.2:5060 (NAT)

<--- Transmitting (NAT) to 2.2.2.2:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 2.2.2.2:5060;branch=z9hG4bK884506602fdce9ff5c28156725d0365a;received=2.2.2.2;rport=5060
From: "201" <sip:[email protected]>;tag=1279952574
To: "201" <sip:[email protected]>;tag=as4ab728e6
Call-ID: [email protected]_168_0_50
CSeq: 587 REGISTER
Server: AskoziaPBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="askozia", nonce="715d282b"
Content-Length: 0


<------------>
Scheduling destruction of SIP dialog '[email protected]_168_0_50' in 32000 ms (Method: REGISTER)

<--- SIP read from UDP:2.2.2.2:5060 --->
REGISTER sip:192.168.1.25 SIP/2.0
Via: SIP/2.0/UDP 2.2.2.2:5060;branch=z9hG4bK884506602fdce9ff5c28156725d0365a;rport
From: "201" <sip:[email protected]>;tag=1279952574
To: "201" <sip:[email protected]>
Call-ID: [email protected]_168_0_50
CSeq: 587 REGISTER
Contact: <sip:[email protected]:5060>
Max-Forwards: 70
User-Agent: A510 IP/42.207.00.000.000
Expires: 180
Allow: INVITE, ACK, CANCEL, BYE, OPTIONS, INFO, SUBSCRIBE, NOTIFY, REFER
Content-Length: 0

<------------->
--- (12 headers 0 lines) ---
Sending to 2.2.2.2:5060 (NAT)

<--- Transmitting (NAT) to 2.2.2.2:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 2.2.2.2:5060;branch=z9hG4bK884506602fdce9ff5c28156725d0365a;received=2.2.2.2;rport=5060
From: "201" <sip:[email protected]>;tag=1279952574
To: "201" <sip:[email protected]>;tag=as4ab728e6
Call-ID: [email protected]_168_0_50
CSeq: 587 REGISTER
Server: AskoziaPBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="askozia", nonce="715d282b"
Content-Length: 0


<------------>
Scheduling destruction of SIP dialog '[email protected]_168_0_50' in 32000 ms (Method: REGISTER)

<--- SIP read from UDP:2.2.2.2:5060 --->
REGISTER sip:192.168.1.25 SIP/2.0
Via: SIP/2.0/UDP 2.2.2.2:5060;branch=z9hG4bK884506602fdce9ff5c28156725d0365a;rport
From: "201" <sip:[email protected]>;tag=1279952574
To: "201" <sip:[email protected]>
Call-ID: [email protected]_168_0_50
CSeq: 587 REGISTER
Contact: <sip:[email protected]:5060>
Max-Forwards: 70
User-Agent: A510 IP/42.207.00.000.000
Expires: 180
Allow: INVITE, ACK, CANCEL, BYE, OPTIONS, INFO, SUBSCRIBE, NOTIFY, REFER
Content-Length: 0

<------------->
--- (12 headers 0 lines) ---
Sending to 2.2.2.2:5060 (NAT)

<--- Transmitting (NAT) to 2.2.2.2:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 2.2.2.2:5060;branch=z9hG4bK884506602fdce9ff5c28156725d0365a;received=2.2.2.2;rport=5060
From: "201" <sip:[email protected]>;tag=1279952574
To: "201" <sip:[email protected]>;tag=as4ab728e6
Call-ID: [email protected]_168_0_50
CSeq: 587 REGISTER
Server: AskoziaPBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="askozia", nonce="715d282b"
Content-Length: 0</code>

And 3 days ago everything worked, no one changed the configuration.

Answer 1

On Mikrotik 2, are packets from 401 towards A510 visible? There is a suspicion that they block.

Answer 2

disable NAT in asterisk and SIP ALG in Mikrotik

Answer 3

And 3 days ago everything worked, no one changed the configuration.

Barabashki :)
And the accounts are exactly right, can they kill the passwords and try again?

Answer 4

Well, the server says 401 Unathorized to the client - and waits for a response to the authorization request.
I don’t see Register packets with authorization from clients - I suspect that packets simply don’t reach phones