Grandstream Budgetone 102 VOIP phone fails to connect to asterisk server

I have recently gotten asterisk running on my linux server and tested two xlite client connections on my lan, so calls internal to the lan work, but not with my VOIP phone.  The lan is nat'd behind a cisco pix, where I have opened ports 5060 (sip), 5004 and 8000 (rtp) and 4569 (iax).  I got a dial-tone when the phone was set to its factory default however once I assigned an ip to the phone and filled in the settings (referencing the manual) I lost the dial-tone so I'm assuming that I can't test connections to the phone on my lan, which I would have liked to do.  The status showed:
System Up Time:          0 day(s) 0 hour(s) xx minute(s) - but the phone is up only when NAT is disabled in sip.conf
Registered:         No
PPPoE Link Up:         disabled
NAT:         detected NAT type is blank, or when NAT is enabled in sip.conf I get 'detected NAT type is UDP blocked'
NAT Mapped IP:
After giving up on an internal LAN test I enabled NAT traversal in the Grandstream config pages and defined the STUN server as, and, alternately, - neither one results in a dial tone or connection.
The error that shows up in asterisk is:
 Apr 11 15:23:07 NOTICE[26727]: chan_iax2.c:7411 socket_read: Registration of 'my-FWD-account-number' rejected: 'Registration Refused' from: ''  
So it looks like the phone is trying to register with FWD, which is good, I think...but I have no idea where the non-routable ip is coming from, since it does not show up in the phone's config pages, which I'm viewing in a web browser, and it isn't in my asterisk config files either.  
Here's my iax.conf:
register =>

and my sip.conf:
nat=no  or yes -  no dial tone
host=dynamic or a static ip, asterisk error is the same

and my extensions.conf:
exten => 2005,1,Dial(SIP/xlite_client)
exten => 2006,1,Dial(SIP/phone)
exten => 2008,1,Dial(SIP/iaxfwd)
exten => 2006,1,Dial(SIP/phone)
exten => 2008,1,Dial(SIP/iaxfwd)

Let me know what I need to do to establish a working connection on this phone, thanks.  I'm using the Grandstream budgetone pdf manual and the O'Reilly Asterisk book as resources, so I've tried the RTFM approach but it's not working :(

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Just to clarify can you tell me where the asterisk box and the phone are located in terrms of on the local LAN or on the internet somewhere.
klukacAuthor Commented:
The asterisk box is on my lan and so is the phone.  I ran nmap on the phone, got this:
nmap -sU

Starting nmap 3.81 ( ) at 2006-04-12 11:27 EDT
Interesting ports on (
(The 1474 ports scanned but not shown below are in state: closed)
67/udp   open|filtered dhcpserver
80/udp   open|filtered http
1000/udp open|filtered ock
9876/udp open|filtered sd
MAC Address: xx:yy:11:etc (Grandstream Networks)

Nmap finished: 1 IP address (1 host up) scanned in 5.741 seconds
In sip.conf you should have :-


On the budgetone you should not have any NAT or proxy/STUN server configured.
Also make sure you have registration enabled.

>Apr 11 15:23:07 NOTICE[26727]: chan_iax2.c:7411 socket_read: Registration of 'my-FWD-account-number' rejected: 'Registration Refused' from: ''  
Thats an IAX protocol error. The Budgeton is a SIP. That error looks like Asterisk is trying to register with a provider on the internet.

Can you post all the settings you have on the account page of the budgetone web interface.
Cloud Class® Course: CompTIA Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

klukacAuthor Commented:
Of course the nmap scan leads to more questions - since this is a SIP phone, why is 5060, or 5004, the default ports used to configure the phone, not showing up on the scan?  I don't have ports 1000 or 9876 listed in /etc/services (or running on my server) and I'm assuming I don't need them, but it would be interesting to know what purpose they serve.  
I dont know why 5060 is not listed. Perhaps it is because you have a STUN server configured or NAT enabled and so it knows that it has to initiate the connection and so doesn't bother listening.

One of the other ports is probably for the RTP packets which carry the actual voice calls. Iy may have more than one port open if it supports multiple lines.
klukacAuthor Commented:
ok, missed your last transmission before writing the above.  I disabled the iax.conf settings that make the phone try to register with FWD, to get rid of the error and to test the phone locallly first.  Also changed to host=dynamic and nat=no, which I had set for my xlite clients, forgot to do that with the phone.  Disabled NAT/proxy/STUN in the web interface and checked, SIP registration is enabled.  Finally, I figured out that asterisk couldn't establish a route to host / create a SIP channel because there was a conflict with my bind9 settings - I removed the phone from my host list, rebooted bind and the phone and got a dial tone, and called back and forth between an xlite client and the sip phone on my lan :)
On a subsequent reboot, the grandstream could receive calls but not make any (no dial tone) but I've cleared all the old settings for the domain the phone is on from the slave server so the dial tone is back up and should stay that way, internally.  

Checking the status, I have this:
System Up Time:          0 day(s) 0 hour(s) x minute(s)
Registered:         Yes

I'm not sure if the above information voids your need for the grandstream settings on the web interface, but here they are:
Basic settings - statically configured as
IP - Subnet Mask - Router - DNS, where the router = ip of pix firewall which is connected to DSL modem set to bridge mode
Advanced settings
SIP server
SIP user ID and Authenticate ID: phone
Preferred Vocoder (in order) PCMU, PCMA, G723, G729, G726-32, G728, iLBC, G722
G723 rate 6.3kbs encoding
iLBC frame size 20 ms
iLBC payload type 97
Silence suppression No
Voice frames per TX 2
Layer 3 QoS 48
Layer 2 QoS 802.1Q/VLAN Tag 0 802.1p priority value 0
Use DNS SRV Yes (default is no)
User ID is phone number No
SIP Registration Yes
Unregister on Reboot No
Register Expiration 60 min
Early Dial No
No Key Entry Timeout 4
Local SIP port 5060
Local RTP port 5004
Use random port No
NAT Traversal No
keep-alive interval 20
Use NAT IP (blank - if specified, this IP address is used in SIP/SDP message)
Proxy-Require (blank - if specified, the content will appear in Proxy-Require header)
Firmware Upgrade via TFTP - ip provided, not enabled
                              via HTTP - url provided, enabled
Automatic HTTP Upgrade No
Call features omitted - can provide if needed
Send DTMF in-audio (there's also 'via RTP (RFC2833)'  and 'via SIP INFO' options)
DTMF Payload Type 101
Send Flash Event No
NTP server url provided
System ringtone
Send Anonymous No
Lock keypad update No
Syslog server
Syslog level DEBUG

Unless otherwise indicated, settings are set to default.  Most of the options are selectable via radio button.  
So now I'd like to know how to use asterisk settings to connect to the Internet - I could test this from my xlite client first, if that's easier.  But if I enable the FWD look-up asterisk produces the same error as before, so there's something else that needs to change (the iax.conf settings shown in my earlier posting are straight out of the book, for initial settings).  I know that the pix firewall supports asterisk connections, because I connected to someone else's asterisk server from an xlite client through the same pix in an earlier life.  

Your config looks ok. I have the DTMF sent using RTP and dont have any problems. Sometimes if you are using a low bandwidth codec (anything other than PCMU or PCMA) then DTMF can have problems being recognised if sent as in-audio.
> [iaxfwd]
> type=user
> context=incoming
> auth=rsa
> inkeys=freeworlddialup
> register =>

I would recomend changing the context to context=fromfwd and also the register should be in the general section so :-

register =>


Your extensions.conf needs a little changing aswell.

exten => 2005,1,Dial(SIP/xlite_client)
exten => 2006,1,Dial(SIP/phone)
; the following line enables you to connect to the fwdnet for making calls by dialing an 8 prefix.
exten => _8.,1,Dial(IAX2/${EXTEN:1},60,r)

; when a call comes in from free world dialup the xlite and the phone is rung for 20 seconds.
; the first to pick up gets the call.
exten => 123456,1,Dial(SIP/xlite_client&SIP/phone,20,r)
klukacAuthor Commented:
I made those changes but still get the same error (chan_iax2.c:7411 socket_read: Registration of '123456' rejected: 'Registration Refused' from: '') and of course there's no dial tone.
My sip.conf file still has the accounts labeled as nat=no, but those are for local numbers, which doesn't apply to how asterisk connects to the internet. Since asterisk looks up a local ip by default on startup, there should be a config setting to change that, but I don't see where that is.  I've checked my pix firewall, and I have static routes and acls opening up ports 4569, 5060,5004 to the server and 5060, 5004 and 8000 to the sip phone - I'm wondering if asterisk is looking for dhcp somewhere, since it could not accept static ip's for local hosts.  
The first message is unrelated to the problem you are having with the phone. The '123456' and 'password' should be replaced with the username( tel number) and password you setup with freeworlddialup. The error indicated it was unable to authenticate which is normally an incorrect username/password
klukacAuthor Commented:
oops, didn't realize that only 192.168/16 is non-routable, not the entire 192 is the remote server, and the good news is that I'm reaching it.  However it still refuses to register my account.  I've visited FWD and logged in, so my log-on and password are accepted there.  Not sure why they aren't being accepted from my server, can't see any error in iax.conf or extensions.conf...tried the "call me" feature that FWD provides but of course that connection didn't work either.  I've also checked for the freeworlddialup keys on my server and they are where they're supposed to be.  
I beleive you also have to specifically request the IAX service.
klukacAuthor Commented:
Thanks...I'm checking with FWD, and with my ISP, because reverse lookup on my servers did not resolve as expected.  Will get back to you as soon as I get somewhere.
A minor correction. There is no need to use the 'r' prefix as they will be generating the ringing tone to the end user. You dont need to specify a timeout either as they do it on their system.

; when a call comes in from free world dialup the xlite and the phone is rung for 20 seconds.
; the first to pick up gets the call.
exten => 123456,1,Dial(SIP/xlite_client&SIP/phone)

This is basically the setup I have just configured at home. My IAX connection is to my phone account at work. When comeone calls me my desk phone (SIP) rings and it also dials my IAX client.
My home server logs in as the IAX client and forwards the call onto my SIP phone at home. This all works very well. The only additiional thing I would like is the ability to pass on the message waiting indication to my home phone aswell.
klukacAuthor Commented:
Thanks!  You were right about the IAX service, I have to go to my FWD account, select Extra Features and toggle IAXSelect to allow FWD to talk directly to my IAX server.  There was no mention of this in the O'Reilly book, which is deceptive since it otherwise takes a step-by-step approach.  And FWD doesn't mention this up front, you have to poke around to find this out.  

Got rid of the timeout and r prefix on the fromfwd extension.

My ISP has fixed the PTR record for this server, so now I have to wait 24 hours for the FWD registration process to take the meantime, there are others reporting to the FWD forums with the same error, in some cases where registration worked and now doesn't, so we'll see.
klukacAuthor Commented:
ok, one step at a time... the FWD registration error in the CLI has disappeared but:
>iax2 show registry
>Host                           Username    Perceived             Refresh  State   123456      <Unregistered>         60      Timeout

Everything else flows from the fact that I'm not registered - the dial tone on the SIP phone is now dead - it can receive calls from my xlite client but obviously it can't make calls and the web interface confirms that the phone is not registered (although the phone has been up for some time).  

I'll contact FWD (forums) to see what the problem is now, since the 24-hour wait period to process registration requests is long over.   I've checked my firewall - I have all the ports opened to my IAX server (4569,5060,5004,5082) for tcp and udp, although tcp is probably overkill.
The 'iax2 show registry' is just showing the FWD status.

The Grandstream is a SIP phone so do a 'sip show peers' and it should show if it has registered.
klukacAuthor Commented:
ok, we have progress :)
*CLI> sip show peers
Name/username              Host          Dyn Nat ACL Port     Status
user1/user1                     D         5060     OK (7 ms)
user2/user2                  (Unspecified)   D             0         Unknown
phone/phone                   D          5060     Unmonitored
3 sip peers [2 online , 1 offline]

The xlite client on user2 isn't running, so this output looks good.  But why no dial tone on the sip phone?  The FWD echo and dial-in tests also fail.  
Not sure. Maybe its a setting on the phone somewhere. Can you take a screenshot of all the configuration pages and post them somewhere?
klukacAuthor Commented:
Thanks for hanging in on this Basic and Advanced Settings were posted here earlier, so the only thing left is to post the status, which, since I enabled FWD registration in iax.conf, looks like this:
MAC Address:
WAN IP Address:
Product Model:         BT100
Software Version:         Program--    Bootloader--    HTML--    VOC--
System Up Time:         6 day(s) 21 hour(s) 26 minute(s)
Registered:         No
PPPoE Link Up:         disabled
NAT Mapped IP:
NAT Mapped Port:         0
Total Inbound Calls:         1
Total Outbound Calls:         0
Total Missed Calls:         1
Total Call Time (in minutes):         0
Total SIP Message Sent:         82654
Total SIP Message Received:         6
Total RTP Packet Sent:         134
Total RTP Packet Received:         211
Total RTP Packet Loss:         0

What's interesting is my asterisk CLI shows an error that did not appear earlier, and its responses to registry queries have changed...Now I get no response on sip clients, but the iax server registers ok.  I have no idea why the sip response and the iax response appear exclusive to one another, or what triggers the change :(

>Apr 19 21:28:24 NOTICE[21040]: app_dial.c:1012 dial_exec_full: Unable to create channel of type 'SIP' (cause 3 - No route to destination)

sip show registry
Host                            Username       Refresh State
iax2 show registry
Host                             Username    Perceived                          Refresh  State   764012        60          Registered

My xlite client says that I'm logged in, but my sip phone can no longer receive calls from the xlite, and since the dial tone died when I enabled registration with FWD in iax.conf, the sip phone cannot make calls either.

I'd like to try making an external call with the xlite which can dial out and has its own logs (the phone is supposed to log events on the server, but there's nothing in /var/log - am I supposed to create a directory and point the phone to it?  if so, how does the Grandstream software see that directory?).  So far [iaxfwd] settings in iax.conf have two settings:
type=user, to receive calls, and type=peer, to make calls.  Enabling both types looks like I may create a conflict, and using type=friend is not in the example/your guidance, so I'm not sure if either one of these is working.  
Looking for a test to run, dialing 613 as recommended in the book (by enabling the extension in the fromfwd context in extensions.conf) results in "Call failed, 404 not found."

The Budgetone has not registered with asterisk. Thats why you are getting the error as asterisk is trying to connect to the SIP phone but has no IP address for it.

You are running firmware on the phone which is quite old. I suggest you upgrade it to the current release ( I suspect it could be a firmware bug in the pgone causing problems.

type=friend permits inbound and outbound calls so it will be fine for you to use that.

If you followed my example and added "exten => _8.,1,Dial(IAX2/${EXTEN:1},60,r)" then you will need to dial an 8 prefix to make a call over fwd. Therefore if they say to dial 613 you would actually dial 8613.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
klukacAuthor Commented:
Thanks, I had the 613 in my 'internal' context which wasn't active, plus I didn't have the 8 prefix set up for it - copied that to the (active) fromfwd context with your format and was able to test it on my xlite client.

Upgrading my sip phone to the latest release was harder, but I got lucky - I took it to a LUG meeting last night and the head of a local broadband company reset the phone to its factory defaults and connected it via cross-over cable to his laptop which was running DHCP and other services.  He was able to connect the phone to Grandstream's TFTP server and upgrade the firmware (although initially the server rejected the connection - no permission, which was my experience).   So the firmware is upgraded and I'm preparing to test this again, but before I post the results I was wondering (I realize I may be pushing my luck here) how to set syslog on my host server to actually log what the phone is doing (the Grandstream settings have pointed to my asterisk server however nothing has actually been logged, and I understand that I need to modify syslog.conf to allow logging for my sip phone, which is on a fixed ip).  I know that you can set syslog to accept remote connections for logging, but I want to limit that to a specific IP, and I have found no examples of how that might be done.   Thanks again!
To get syslog to accept remote connections you need to start it with the -r option appended. If you wish to restrict which IP's can send messages to it then this has to be done using the built in iptables firewall.

To configure syslog you first need to configure the Grandstream with the syslog server and the facility to use (local6 for example). Then edit /etc/syslog.conf and add :-
local6.*                                                /var/log/grandstream.log
Then restart syslog (/etc/init.d/syslog restart) and it should work.
klukacAuthor Commented:

Thanks very much, /var/log/syslog is now showing my sip registrations, and although /var/log/phone.log is still empty ( I have a feeling that the grandstream gui doesn't take more than an ip as a server logging parameter), I have the information I need and can work that issue later.

My phone is registered and up (with dial tone :), which shows that the firmware upgrade you recommended was in fact a critical step.  I can still dial inside my LAN, including 613 for an echo test which I'm guessing is my asterisk server but I'm not sure and it would be nice to try some other numbers.

/var/log/syslog shows this:
Apr 21 15:15:03 GS_LOG: [00:0B:82:06:03:F9][000][FFFF][01000810] Send SIP message: 1 To
Apr 21 15:15:03 GS_LOG: [00:0B:82:06:03:F9][000][FFFF][01000810] REGISTER SIP/2.0  Via: SIP/2.0/UDP;branch=z9hG4bKd07d31ad138bb334  From: "My Name" <>;tag=8014764f0867ccec  To: <>  Contact: <sip:phone@>  Supported: replaces  Call-ID: 5b258eea3ed4114c@  CSeq: 100 REGISTER  Expires: 3600  User-Agent: Grandstream BT110  Max-Forwards: 70  Allow: INVITE,ACK,CANCEL,BYE,NOTIFY,REFER,OPTIONS,INFO,SUBSCRIBE  Content-Length: 0

And the xlite client shows registration with asterisk in its own logs:
SEND TIME: 3189552585
SIP/2.0 200 Ok
Via: SIP/2.0/UDP;branch=z9hG4bK4f722e37;rport
From: "asterisk" <sip:asterisk@>;tag=as33bdc909
To: <sip:xlite@>;tag=1695904375
Contact: <sip:xlite@>
Call-ID: 6887e39e5cd0ab2658442bb44aed50e7@
Server: X-Lite release 1105d
Content-Length: 0

RECEIVE TIME: 3189612598
OPTIONS sip:xlite@ SIP/2.0
Via: SIP/2.0/UDP;branch=z9hG4bK1dde471d;rport
From: "asterisk" <sip:asterisk@>;tag=as4030422e
To: <sip:xlite@>
Contact: <sip:asterisk@>
Call-ID: 1eba6abc020b04f36008adcb60976115@
User-Agent: Asterisk PBX
Max-Forwards: 70
Date: Fri, 21 Apr 2006 20:21:41 GMT
Content-Length: 0

I conclude that the firewall is blocking sip registration with FWD.  When my xlite client was registered to another asterisk server behind this firewall, it was sufficient to open udp ports 8000 - 8006 and tcp/udp ports 5060.  I've now also opened tcp/udp 5082 for sip bidirectional, 5004 for rtp  (not sure this helps since they aren't listed in /etc/services and RFC 1700 wasn't very helpful in showing how to add them in) and 4569 for asterisk,  but clearly I'm missing stuff here.   I ran tcpdump to see what sip was looking for and got this:

tcpdump | grep sip
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
14:48:20.887123 IP > SIP, length: 2
14:48:21.691064 IP > SIP, length: 485
14:48:21.697288 IP > SIP, length: 400
14:48:30.965075 IP > SIP, length: 2
14:48:41.061766 IP > SIP, length: 2
14:48:51.138472 IP > SIP, length: 2
14:49:01.216629 IP >  45+ SRV? (45)

where the xlite_client = xlite in the xlite client's log file.  

I'm kind of wondering if this tcpdump output means anything other than showing xlite registering with asterisk (weird that the sip phone doesn't also show up).   I'm resigned to putting the phone + xlite client + asterisk server outside my firewall, but it bothers me that I've opened the ports addressed in the documentation and my sip hosts still don't connect, which I understand is necessary for me to call outside my LAN.  I'll have a pretty good indication that I have an outside connection when my phone LCD actually displays the correct date.  You've been more than patient on the issues related to this question so I'm prepared to move on, but if anything here jumps off the page let me know, thanks.

klukacAuthor Commented:
I've been working with the assumption that the asterisk server will forward all requests for connections to the sip clients as needed, so my static routes connect only to the asterisk box - there are no rules in the firewall for the clients, because if I did that, I'd have to use up all my external IPs, which I'd rather not do.  
FWD uses the IAX protocol not SIP.

Can you post your current extensions.conf file.

Also run 'asterisk -r -vvv' and post what is displayed when you try to make an external call.
klukacAuthor Commented:
Here's my extensions.conf:


[globals]                                                     ; will make use of this later, when stuff works
CONSOLE=Console/dsp                        ; Console interface for demo
FWDNUMBER => 764012 ;my calling number
FWDCIDNAME => mycallerid
FWDPASSWORD => mypassword
FWDRINGS=sip/2006 ;the phone to ring

exten => 2007,1,Dial(SIP/Christine)
;exten => 2005,1,Dial(SIP/Paul)           ; not in use right now, for testing only
exten => 2006,1,Dial(SIP/phone)

;this allows to connect to fwd to make calls with a dial-prefix of 8
exten => _8.,766821,Dial(IAX2/iaxfwd/_8.,766821,20,r)            ;FWD account used for testing

exten => 2006,1,Dial(SIP/phone)

[fromfwd]                      ; this is the active context (from iax.conf) so all #'s in use are here
;when a call comes in from free world dialup it will ring...
exten => 764012,1,Dial(SIP/Christine&SIP/phone)
exten => _8.,613,1,Dial(IAX2/iaxfwd/613)
exten => _8.,766821,Dial(IAX2/iaxfwd/_8.,766821,20,r)

exten => 2007,1,Dial(SIP/Christine)

exten => 2005,1,Dial(SIP/Paul)

Here's the asterisk output when dialing an outside number:

Asterisk Ready.
    -- Executing SetCallerID("SIP/phone-656b", "myaccount") in new stack
    -- Executing Dial("SIP/phone-656b", "IAX2/|60|r") in new stack
    -- Called
    -- Call accepted by (format ulaw)
    -- Format for call is ulaw
    -- IAX2/iaxfwd-2 is ringing
    -- IAX2/iaxfwd-2 is busy
    -- Hungup 'IAX2/iaxfwd-2'
  == Everyone is busy/congested at this time (1:1/0/0)
    -- Executing Congestion("SIP/phone-656b", "") in new stack
  == Spawn extension (incoming, 8766821, 3) exited non-zero on 'SIP/phone-656b'

I also get these notices, periodically (iaxfwd points to my active context, fromfwd):
Apr 22 14:43:23 NOTICE[1932]: chan_iax2.c:7124 socket_read: Peer 'iaxfwd' is now TOO LAGGED (2057 ms)!
Apr 22 14:43:33 NOTICE[1932]: chan_iax2.c:7118 socket_read: Peer 'iaxfwd' is now REACHABLE! Time: 69

It does appear as though it worked. The problem is that FWD told you that 766821 was busy.
I cant get through to their website at the moment but there may be a specific number you can use to test with. They often provide number which tell you the date&time or give an echo test.
The first of the other messages you are seeing indicate that the packet took too long to get to FWD and back again. In the example given this was 2 seconds which is far too long. This would give a 2 second lag in the phone conversation. The next message indicated a very good delay.

Were you using your connection heavily at the time?
klukacAuthor Commented:
no...but since then my calls with a prefix of 8 (for outgoing) result in a 404 Not Found error and are no longer registered with Asterisk.
The asterisk CLI shows no errors other than the usual periodic latency problem.  Other than that, all looks good:

[] => (Session Initiation Protocol (SIP))
  == Parsing '/etc/asterisk/sip.conf': Found
    -- SIP Seeding peer from astdb: 'phone' at phone@ for 3600
    -- SIP Seeding peer from astdb: 'Christine' at Christine@ for 1800
  == SIP Listening on
 == Registered application 'WaitForRing'
 []    -- Registered IAX2 to '', who sees us as with no messages waiting

I did at one point change my pix firewall log setting to warnings (from critical) and saw that the dns header for FWD exceeded the bytes my pix would allow (530 vice the default limit of 512) so I modified the pix.  
nslookup now answers :)  and there are no warnings of attempted sip connections.

The only good news is that I know how to id whether the problem is with my firewall or my asterisk server.  

Sorry I didn't follow all that you said.
What outstanding problems do you have now?
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Voice Over IP

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.