The idea behind UPnP is to enable a user to plug a device into the network and automatically configure itself.  It takes DHCP a step further to go beyond just the basic IP settings.   It is designed for use on home networks and the chief proponents of the protocol are Microsoft and the SOHO device manufacturers like linksys, Dlink, and Netgear.   Due to this fact companies like Snom have integrated the protocol in the IP phones in order for SOHO users to actually plug the phone in and be able to make phone calls without configuring a thing.  This paper details the installation of a snom phone behind a Linksys UPnP enabled device. 
 
A typical Linksys cable/DSL router has a lot of technologies integrated in a tiny box at a tiny price.  It is acting as a switch,  a DHCP server,  a Firewall,  a UPnP Router, a NAT box, and probably more!  The first part of the process is for the IP phone to acquire its IP address from the DHCP server.  Now on an IP level it can talk to the Internet since the unit will NAT the IP addresses.  However if one looks at a SIP packet (see figure 1) you will notice that the SIP packet is inside the IP packet .  The IP packet gets NAT’d easily but how does the SIP portion of the packet get its IP address massaged so the proxy or other end point does not try to route the packet pack to the private address.  The contact says 192.168.0.90 but the route is learnt from UPnP so the REGISTER request should
make it back to the recipient from the proxy. 

Sent to udp:217.115.141.99:5060 at Tue, 25 Dec 2001 17:36:15:307 GMT (445 bytes):
REGISTER sip:snomag.de SIP/2.0

Via: SIP/2.0/UDP 66.31.121.76:60124;branch=z9hG4bK-lax83gpfg9m6;rport
Max-Forwards: 70
From: "km" <sip:km@snomag.de>;tag=9i5j6zkqbj
To: "km" <sip:km@snomag.de>
Call-ID: 3c267009447c-tefkcd6usp5p@192.168.0.90
User-Agent: snom100-1.15u
CSeq: 15 REGISTER
Contact: <sip:km@192.168.0.90:5060;line=2;transport=udp?
Route=sip:66.31.121.76:60124>;q=1.0;description="Available"
Expires: 86400
Content-Length: 0

Following is a high level overview of how UPnP works: P is the phone, R the router:
 
P via Multicast: “Hello, is there DSL router out there? Send answer to ipadr(P)”

P via Multicast: “Hello, is there DSL router out there? Send answer to ipadr(P)”
(message repetition because multicast is UDP)

R to P (UDP): “Yes I am a DSL router. Download my feature list from http:ipadr(R)/features.xml”

P downloads features.xml (via http) and looks at the list which says all kind of info.     
R is only interested in the URL for posting commands.

P posts a http request and asks: What is the public IP address that you are using? R answers with its WAN address.  P posts then a couple of addresses to set up port redirection. For example, it says: Whenever a packet for port 60124 arrives from the WAN side, forward it to me at port 5060 (SIP port).  
 
The first step in the process is to make sure that you UPnP router is running the latest firmware.  Http into the Linksys (192.168.1.1 is the defaul t IP address) and on the main page you can see what version it is running.  Make sure the firmware is at the latest on the web site to ensure success.  If your version is April 2002 it will probably not work.
They are improving the code all the time so download the latest. 

If it is not running the latest version then go to http://www.linksys.com/download
then it will ask you for your model number and operating system. Select the model you have by reading the numbers off the front of the unit. Then on the next screen select firmware and you should see something like below. 

BEFW11S4 - Wireless Access Point Router with 4-Port Switch - Version 2
 
Firmware Date : 2/28/2003

Firmware File Size : Varies

Firmware Version : 1.45

Click here to start downloading the new firmware for windows users
 
Save the file to a directory.  It is a zipped file so you will have to unzip it. 
 
Go back  your http session on your linksys main screen and press help, from the help screen select upgrade firmware and the following window will be shown. 
Select the firmware file and point to the code.bin file in the unzipped
directory you just copied it to.  Hit upgrade and then it will reset once the upgrade is complete and the unit should now be running the latest version. 

If the UPnP service is enabled now go to the advanced forwarding tab.  Scroll to the bottom and you should see the a UPnP forwarding button.  Click on it an the next screen will appear.

What you should notice on the bottom 5 lines is the UPnP ports that it learned dynamically. In this case the Snom IP phone is 192.168.0.91. When the router sends out SIP requests that sees on port 5060 internally it is going to send the IP packet out on 60123. The RTP ports 10000-10003, will be going out on 29608, 29609, 40034, and 40035. This table is static and if you move the IP phone around or something is not working you will need to go into this table and delete the application name s0AAtN, the external port, set the Int. port to 0, set the IP address to 0, and uncheck the check box. You will have to do this for all 5 entries. Once you hit apply then the window will scroll and show you the next UPnP ports if there are any. The router will hold 15 or so addresses but only show you the first 5. If problems are experienced on the network then you have to delete all the entries and reset the phone.
 
If one connects to the phone and look at its log file
http://192.168.0.91/log_en.htm
You will see the UPnP messages. This one says that it found the wide area address  to use when sending requests. 

12/24/2001 19:31:16 GMT:[5]UPnP: Found mapped address 66.31.121.76

Now when the phone sends out a registration request it looks as follows. You should notice the public address and port in the Via and the correct route and port in the contact. 

REGISTER sip:snomag.de SIP/2.0
Via: SIP/2.0/UDP 66.31.121.76:60123;branch=z9hG4bK-1mxrzs9u5hhj;rport
Max-Forwards: 70
From: "km" <sip:km@snomag.de>;tag=x34ck1af9e
To: "km" <sip:km@snomag.de>
Call-ID: 3c26700db350-tefkcd6usp5p@192.168.0.91
User-Agent: snom100-1.15u
CSeq: 77 REGISTER
Contact: <sip:km@192.168.0.91:5060;line=2;
transport=udp?Route=sip:66.31.121.76:60123>;
q=1.0;description="Available"
Expires: 3600
Content-Length: 0

If you are having an issue receiving calls from the advanced screen at the bottom of the linksys configuration screen make sure block when requests is disabled so in bound calls will be accepted. If you think you will need help the enable remote management and specify a port so help can connect to your linksys. 

© ABP International, Inc - How to update snom phone firmware with TFTP - 04/2003

All information in FAQ supplied as best effort only. ABP does no guarrantee suitability of products or provide any guarantees or warranties on our vendors produtcs.