SBC traversal far-end and near-end firewall

TOPOLOGY

(SIP Device) [public IP:172.16.10.2;Registrar :172.16.10.10] <->

(NAT1) [172.16.10.2 mirrored to 20.20.20.2;172.16.10.10 mirrored to 10.10.10.10]

<->

(NAT2) [10.10.10.10 NATed to 192.168.10.10 ]<->

(SBC) [Access IP:192.168.10.10; Core IP:192.168.40.147]<->

(PBX) [192.168.10.139]

1. SBC's public address is mirrored to a private address by far end NAT .

2. sip devices send REGISTRATION to the mirrored private address 172.16.10.10 and NAT sends the message to address 10.10.10.10 .

then NAT route the message to sbc's access interface 192.168.10.10.

3.after REGISTRATION process done ,PBX initiates an INVITE for endpoint.  SBC sends INVITE to called sip device ,but it can't receive "200 OK "reply from the called sip device because the destination of "200 OK " is 192.168.10.10 which copied in "Via" and there is no route for destination address 192.168.10.10 in the private network.