Hello
this is my scenario:

CORE:
Cisco 2651XM, NAT 1-1 with internal ip
WAN: 9.9.9.9/24
LAN: 10.0.1.1/24

RB2011 distribution level:
WAN: 10.0.1.254/24
LAN: 172.16.0.0/16

The Cisco does NAT1-1 with some hosts in the LAN section.
The RB2011 does routing only, queueing. (NAT rules disabled), CONNTRACK on

I am not able to let the VOIP phones (using SIP) to autenthicate correctly through MT.

If I connect the VOIP phones behind the cisco directly, they work flawlessy.
If I connect the voip phones behind the RB2011, both with nat 1-1 or nat overload from cisco, they goes in timeout and doesnt authenticate with a public SIP server.

How can I do?

i would try to figure out where is a problem with wireshark, first yu can install softphone on PC behind 2011 MKT and see what is happening, after that run packet sniffer on mkt which will sent you a copy of traffic to your PC which has wireshark... After that try to see where is the problem

Well, I made a lot of tests.

Then I may have find a solution:

If the MT in the "middle" does only routing and NO NAT, I disabled the helpers (all) and it seem to work.

The results are not consistent. I tried to route the subnet from the core router (cisco) to the MT and there do the NAT 1-1 (without helpers) and it worked.

then it stopped working.

booooooo

I tried with wireshark to inspect SIP packets and the source ip / destination are correctly managed.

The problem that they goes timeout, with no apparent reason.

It happens only when I have a MT device in the middle between:

Core router - cisco that does NAT 1-1 only.
MT router (routes core-subnet with distribution-subnet).

It fails with NO firewall policies, No conntrack, no helpers.

Sometimes it works with conntrack and regular firewall.

I really have to drop mikrotik in this core network because SIP is not working, and I can't understand why.

When I have a MT router in the middle (now updated with 5.22) the SIP drops.

Hello, I have the same problem. MK drops sip's packets. My Asterisk goes timeout and doesnt authenticate with a public SIP server. I have two routers, one-2HN RB751U with version 5.22 and 493G with 4.17
When I connect the rb751 beginning to see the timeouts. Connect the RB493 and everything starts working again.
The funny thing is that I have other routers work with 5.x versions. But in others, not. It seems somewhat random. To me it is clear, version 5.x does not work well with SIP.

Mikrotik Team!! Help!

Could you try with this command:

ip firewall service-port set sip ports=5060,5061 disabled=yes

Hello, Today I reset to factory settings and tried the RB751 lower it to version 4.17 to see how it worked. I have found that with the RB that version does not work well, not detected when connected with an ethernet cable, you can only connect to it via wireless when freshly reset, and if you load a backup or reboot, go back to completely lose connectivity with it and should do another hard reset.

After several tests and many hard reset ..... I'm back to version 5.22, I disabled the service ports for SIP. To my surprise, it works now. I'm doing several tests with Asterisk and registers to external servers.

I will share the results of the tests in this thread. Thanks for the suggestions.

Good day.

If you're not using NAT, why even have connection tracking on? Are you using mangle rules with connection mark perhaps? (there are other things that stop working with connection tracking off but usually if you don't need NAT, you can turn it off) It may help?

Definitely I can 100% guarantee to you that the MikroTik SIP Helper does NOT work. In fact, it makes it worse. Always leave it off when using SIP phones via a MT device.

In fact, I have only ever found the FTP helper to work

Yes, I have connection tracking enabled because I use NAT. What I find really disturbing is that I have about 25 routers with VoIP services (Asterisk) running and just gives me problems some devices, and randomly.
Another curious thing happens to me with SIP connections, if I lose internet connection for a few seconds, the connection between SIP device and the SIP provider is lost but still active in the MK and device does not re-register until manually delete the active connection (UDP: 5060). (UDP timeout is 10s, UDP stream-timeout is 3m)
If the WAN interface manually disable, the UDP connection is always active! Never closes, I waited more than 3 minutes to see if the timeout closed the connection, but no. Why is this? What am I missing?

I have no idea, as I have no information on your setup.