SIP Inspection and dynamic port opening after re-invite

Question

Platform: ASA 8.3(2)
Hello,
I have SIP devices along with SipTrunk and media endpoints. I am having issues with the ASA not dynamically opening (sip inspect enabled) UDP ports for RTP after a SIP re-invite causes the media endpoints to change within SDP.
The problem as below.
Initial SIP invite setups properly with ports dynamically opened between the media endpoints in the ASA
Re-inivite from the SIP device causes the media endpoints to change within the SDP
ASA blocks ports associated to the new media endpoints
I can resolve this by allowing the ports in the ACL, but suprised this is not working as re-invites to change media endpoints is to be expected in SIP conversation.
Regards,
AJ

Answer 1

Below is the script you can use to reproduce this. Points worth mentioning.
Initial invite sets up the media between SIP Trunk and a media device ( 10.1.2.150) in the inside network, SIP signalling will be with 10.1.2.100. At this poit RTP flows freely between the SIP Trunk and the media device.
If the call is fax, a re-invite will occur and this will cause the IP address to change in the SDP. The new media endpoint becomes 10.1.2.151 (This device is SIP and Media (T38) capable).
For every SIP call we establish 10.1.2.150 will be used for media, we do not want to change this behaviour.
ASA 8.3 (2)
conf t
interface Ethernet0/0
nameif Inside_Voice
security-level 100
ip address 10.1.2.11 255.255.255.0 standby 10.1.2.12
exit
interface Ethernet0/1
nameif Outside_SIP_Trunk
security-level 0
ip address 10.1.60.254 255.255.255.0 standby 10.1.60.253
exit
object-group network SIP_trunks
network-object 1.2.3.0 255.255.255.0
exit
object-group service SIP_service
service-object tcp destination eq sip
service-object udp destination eq sip
exit
object-group network SIP_inside_servers
network-object host 10.1.2.100
exit
access-list Outside_SIP_in extended permit object-group SIP_service object-group SIP_trunks object-group SIP_inside_servers
access-group Outside_SIP_in in interface Outside_SIP_Trunk
route Outside_SIP_Trunk 0.0.0.0 0.0.0.0 10.1.60.1
class-map inspection_default
match default-inspection-traffic
exit
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
inspect icmp error
lass class-default
set connection decrement-ttl
exit
service-policy global_policy global
end