I found my own solution to this one, but given how much of a pain it was to diagnose I figured it was worth documenting in case others find the same. This was running on Asterisk 20 and PJSIP 2.15.1
Symptom
After an external network change, Polycomm endpoints were occasionally registering correctly, but mostly were failing to register with my Asterisk instance. No config had changed, but the 401 responses led me to verifying the login details and a lot of headscratching. It was the intermittent nature - i.e. occasionally registering - that was making me deeply confused.
Cause
It turned out that the Polycom phones were flip-flopping between a GUA and ULA IPv6 address as they registered. Across the handshake, the Polycom phones initiated with one IPv6 address, but then replied from another. Across that they had the same nonce, but PJSIP calculates the nonce based on the originating address - which had now changed. So, the Polycom phones were theoretically acting reasonably (replying with the same nonce) but PJSIP was unable to verify it as the input to its calculation had changed. I am inferring…but a chat with Claude verified this.
Solution
There may be other solutions out there, but I took the easy route - set up an AAAA record on my DNS server with an alias hardcoded to one IPv6 address for the Asterisk server. Now all is well.
Further comment…
There is something of an irony that IPv6 is theoretically much better for SIP because of the absence of NAT (plus, ). Yet running an IPv6 only network with Asterisk and Polycomm devices is something of a trial. The main advantage is that it has really helped me understand how IPv6 works (or doesn’t).
I hope someone finds this useful.