Registration Loop with Repeat Nonce

We’re trying to understand an issue with a SIP registration loop related to registering with an Avaya CS1000. Most of the time we have successful registration, but occasionally we get into a registration loop like the one below where we initially respond with a nonce (48050374), then instead of responding with a 200 when they authorize, we respond back with a 401 that has a new nonce (1e39944b) in it that is then used repeatedly for up to 50 registration attempts. After the 50th registration attempt, a break is taken and then the server tries to register again with a new nonce, in which it again fails the new nonce based on it being stale and it responds back with the same nonce (1e39944b) it responded with the previous time. Does anyone have any suggestions? Is this potentially a bug in Asterisk that we can hire someone to fix? Logs are below and we have a lot more if needed.

<— SIP read from UDP:XXX.XXX.XXX.XXX:5060 —>
REGISTER sip:xxxxxxx.comSIP/2.0
From: sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348
To: sip:xxxx@xxxxxxx.com
Call-ID: 8aac264-fc00a8c0-13c4-55013-0-205a1d21-0
CSeq: 553379 REGISTER
Via: SIP/2.0/UDP XXX.XXX.XXX.XXX:5060;branch=z9hG4bK-55348-14cd534b-490ba68c
Max-Forwards: 70
Supported: 100rel,x-nortel-sipvc,replaces,timer
User-Agent: Nortel CS1000 SIP GW release_7.0 version_ssLinux-7.50.17
Expires: 30
Contact: sip:xxxx@xxxxxxx.com:5060;maddr=XXX.XXX.XXX.XXX;transport=UDP;expires=30;x-nt-failsafe=0
Content-Length: 0

<------------->
— (12 headers 0 lines) —
Sending to XXX.XXX.XXX.XXX:5060 (NAT)

<— Transmitting (NAT) to XXX.XXX.XXX.XXX:5060 —>
SIP/2.0 401 Unauthorized

Via: SIP/2.0/UDP XXX.XXX.XXX.XXX:5060;branch=z9hG4bK-55348-14cd534b-490ba68c;received=XXX.XXX.XXX.XXX;rport=5060

From: sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348

To: sip:xxxx@xxxxxxx.com;tag=as219f1bc6

Call-ID: 8aac264-fc00a8c0-13c4-55013-0-205a1d21-0

CSeq: 553379 REGISTER

Server: Asterisk PBX 1.8.9.0

Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH

Supported: replaces, timer

WWW-Authenticate: Digest algorithm=MD5, realm=“testRealm”, nonce=“48050374”

Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘8aac264-fc00a8c0-13c4-55013-0-205a1d21-0’ in 32000 ms (Method: REGISTER)

<— SIP read from UDP:XXX.XXX.XXX.XXX:5060 —>
REGISTER sip:xxxxxxx.comSIP/2.0
From: sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348
To: sip:xxxx@xxxxxxx.com
Call-ID: 8aac264-fc00a8c0-13c4-55013-0-205a1d21-0
CSeq: 553380 REGISTER
Via: SIP/2.0/UDP XXX.XXX.XXX.XXX:5060;branch=z9hG4bK-55348-14cd53d0-9e69072
Max-Forwards: 70
Supported: 100rel,x-nortel-sipvc,replaces,timer
User-Agent: Nortel CS1000 SIP GW release_7.0 version_ssLinux-7.50.17
Expires: 30
Authorization: Digest username=“userTest”,realm=“testRealm”,nonce=“48050374”,uri=“sip:xxxxxxx.com”,response=“ae37e2cb3e7ca26b3d74f9b0f5e823ea”,algorithm=MD5
Contact: sip:xxxx@xxxxxxx.com:5060;maddr=XXX.XXX.XXX.XXX;transport=UDP;expires=30;x-nt-failsafe=0
Content-Length: 0

<------------->
— (13 headers 0 lines) —
Sending to XXX.XXX.XXX.XXX:5060 (NAT)
[2012-04-23 23:22:49.261] NOTICE[28293]: chan_sip.c:14239 check_auth: Correct auth, but based on stale nonce received from ‘sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348’

<— Transmitting (NAT) to XXX.XXX.XXX.XXX:5060 —>
SIP/2.0 401 Unauthorized

Via: SIP/2.0/UDP XXX.XXX.XXX.XXX:5060;branch=z9hG4bK-55348-14cd53d0-9e69072;received=XXX.XXX.XXX.XXX;rport=5060

From: sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348

To: sip:xxxx@xxxxxxx.com;tag=as3c0366fa

Call-ID: 8aac264-fc00a8c0-13c4-55013-0-205a1d21-0

CSeq: 553380 REGISTER

Server: Asterisk PBX 1.8.9.0

Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH

Supported: replaces, timer

WWW-Authenticate: Digest algorithm=MD5, realm=“testRealm”, nonce=“1e39944b”, stale=true

Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘8aac264-fc00a8c0-13c4-55013-0-205a1d21-0’ in 32000 ms (Method: REGISTER)

<— SIP read from UDP:XXX.XXX.XXX.XXX:5060 —>
REGISTER sip:xxxxxxx.comSIP/2.0
From: sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348
To: sip:xxxx@xxxxxxx.com
Call-ID: 8aac264-fc00a8c0-13c4-55013-0-205a1d21-0
CSeq: 553381 REGISTER
Via: SIP/2.0/UDP XXX.XXX.XXX.XXX:5060;branch=z9hG4bK-55348-14cd545b-41dd32b8
Max-Forwards: 70
Supported: 100rel,x-nortel-sipvc,replaces,timer
User-Agent: Nortel CS1000 SIP GW release_7.0 version_ssLinux-7.50.17
Expires: 30
Authorization: Digest username=“userTest”,realm=“testRealm”,nonce=“48050374”,uri=“sip:xxxxxxx.com”,response=“ae37e2cb3e7ca26b3d74f9b0f5e823ea”,algorithm=MD5
Authorization: Digest username=“userTest”,realm=“testRealm”,nonce=“1e39944b”,uri=“sip:xxxxxxx.com”,response=“913c9f3fe957305afddda1cce4e0b40d”,algorithm=MD5
Contact: sip:xxxx@xxxxxxx.com:5060;maddr=XXX.XXX.XXX.XXX;transport=UDP;expires=30;x-nt-failsafe=0
Content-Length: 0

<------------->
— (14 headers 0 lines) —
Sending to XXX.XXX.XXX.XXX:5060 (NAT)
[2012-04-23 23:22:49.391] NOTICE[28293]: chan_sip.c:14239 check_auth: Correct auth, but based on stale nonce received from ‘sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348’

<— Transmitting (NAT) to XXX.XXX.XXX.XXX:5060 —>
SIP/2.0 401 Unauthorized

Via: SIP/2.0/UDP XXX.XXX.XXX.XXX:5060;branch=z9hG4bK-55348-14cd545b-41dd32b8;received=XXX.XXX.XXX.XXX;rport=5060

From: sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348

To: sip:xxxx@xxxxxxx.com;tag=as3c0366fa

Call-ID: 8aac264-fc00a8c0-13c4-55013-0-205a1d21-0

CSeq: 553381 REGISTER

Server: Asterisk PBX 1.8.9.0

Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH

Supported: replaces, timer

WWW-Authenticate: Digest algorithm=MD5, realm=“testRealm”, nonce=“1e39944b”, stale=true

Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘8aac264-fc00a8c0-13c4-55013-0-205a1d21-0’ in 32000 ms (Method: REGISTER)

<— SIP read from UDP:XXX.XXX.XXX.XXX:5060 —>
REGISTER sip:xxxxxxx.comSIP/2.0
From: sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348
To: sip:xxxx@xxxxxxx.com
Call-ID: 8aac264-fc00a8c0-13c4-55013-0-205a1d21-0
CSeq: 553382 REGISTER
Via: SIP/2.0/UDP XXX.XXX.XXX.XXX:5060;branch=z9hG4bK-55348-14cd54d5-3562b35e
Max-Forwards: 70
Supported: 100rel,x-nortel-sipvc,replaces,timer
User-Agent: Nortel CS1000 SIP GW release_7.0 version_ssLinux-7.50.17
Expires: 30
Authorization: Digest username=“userTest”,realm=“testRealm”,nonce=“48050374”,uri=“sip:xxxxxxx.com”,response=“ae37e2cb3e7ca26b3d74f9b0f5e823ea”,algorithm=MD5
Authorization: Digest username=“userTest”,realm=“testRealm”,nonce=“1e39944b”,uri=“sip:xxxxxxx.com”,response=“913c9f3fe957305afddda1cce4e0b40d”,algorithm=MD5
Authorization: Digest username=“userTest”,realm=“testRealm”,nonce=“1e39944b”,uri=“sip:xxxxxxx.com”,response=“913c9f3fe957305afddda1cce4e0b40d”,algorithm=MD5
Contact: sip:xxxx@xxxxxxx.com:5060;maddr=XXX.XXX.XXX.XXX;transport=UDP;expires=30;x-nt-failsafe=0
Content-Length: 0

<------------->
— (15 headers 0 lines) —
Sending to XXX.XXX.XXX.XXX:5060 (NAT)
[2012-04-23 23:22:49.521] NOTICE[28293]: chan_sip.c:14239 check_auth: Correct auth, but based on stale nonce received from ‘sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348’

<— Transmitting (NAT) to XXX.XXX.XXX.XXX:5060 —>
SIP/2.0 401 Unauthorized

Via: SIP/2.0/UDP XXX.XXX.XXX.XXX:5060;branch=z9hG4bK-55348-14cd54d5-3562b35e;received=XXX.XXX.XXX.XXX;rport=5060

From: sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348

To: sip:xxxx@xxxxxxx.com;tag=as3c0366fa

Call-ID: 8aac264-fc00a8c0-13c4-55013-0-205a1d21-0

CSeq: 553382 REGISTER

Server: Asterisk PBX 1.8.9.0

Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH

Supported: replaces, timer

WWW-Authenticate: Digest algorithm=MD5, realm=“testRealm”, nonce=“1e39944b”, stale=true

Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘8aac264-fc00a8c0-13c4-55013-0-205a1d21-0’ in 32000 ms (Method: REGISTER)

<— SIP read from UDP:XXX.XXX.XXX.XXX:5060 —>
REGISTER sip:xxxxxxx.comSIP/2.0
From: sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348
To: sip:xxxx@xxxxxxx.com
Call-ID: 8aac264-fc00a8c0-13c4-55013-0-205a1d21-0
CSeq: 553383 REGISTER
Via: SIP/2.0/UDP XXX.XXX.XXX.XXX:5060;branch=z9hG4bK-55349-14cd5558-73f69864
Max-Forwards: 70
Supported: 100rel,x-nortel-sipvc,replaces,timer
User-Agent: Nortel CS1000 SIP GW release_7.0 version_ssLinux-7.50.17
Expires: 30
Authorization: Digest username=“userTest”,realm=“testRealm”,nonce=“48050374”,uri=“sip:xxxxxxx.com”,response=“ae37e2cb3e7ca26b3d74f9b0f5e823ea”,algorithm=MD5
Authorization: Digest username=“userTest”,realm=“testRealm”,nonce=“1e39944b”,uri=“sip:xxxxxxx.com”,response=“913c9f3fe957305afddda1cce4e0b40d”,algorithm=MD5
Authorization: Digest username=“userTest”,realm=“testRealm”,nonce=“1e39944b”,uri=“sip:xxxxxxx.com”,response=“913c9f3fe957305afddda1cce4e0b40d”,algorithm=MD5
Authorization: Digest username=“userTest”,realm=“testRealm”,nonce=“1e39944b”,uri=“sip:xxxxxxx.com”,response=“913c9f3fe957305afddda1cce4e0b40d”,algorithm=MD5
Contact: sip:xxxx@xxxxxxx.com:5060;maddr=XXX.XXX.XXX.XXX;transport=UDP;expires=30;x-nt-failsafe=0
Content-Length: 0

<------------->
— (16 headers 0 lines) —
Sending to XXX.XXX.XXX.XXX:5060 (NAT)
[2012-04-23 23:22:49.654] NOTICE[28293]: chan_sip.c:14239 check_auth: Correct auth, but based on stale nonce received from ‘sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348’

<— Transmitting (NAT) to XXX.XXX.XXX.XXX:5060 —>
SIP/2.0 401 Unauthorized

Via: SIP/2.0/UDP XXX.XXX.XXX.XXX:5060;branch=z9hG4bK-55349-14cd5558-73f69864;received=XXX.XXX.XXX.XXX;rport=5060

From: sip:xxxx@xxxxxxx.com;tag=acdccca8-fc00a8c0-13c4-55013-55348-739cf7e2-55348

To: sip:xxxx@xxxxxxx.com;tag=as3c0366fa

Call-ID: 8aac264-fc00a8c0-13c4-55013-0-205a1d21-0

CSeq: 553383 REGISTER

Server: Asterisk PBX 1.8.9.0

Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH

Supported: replaces, timer

WWW-Authenticate: Digest algorithm=MD5, realm=“testRealm”, nonce=“1e39944b”, stale=true

Content-Length: 0

Take a look at the following thread:
viewtopic.php?p=161257