forms two basic actions: C 2009 by Taylor & Francis Group, LLC NAT Traversal B1:b1 NAT A From A:a to A 1,:a From B:b to B1:b1 UA. A Internal network FIGURE 12.3 NAT supporting hairpinning. It registers itself in a SIP domain to be reachable by other UAs. It then initiates media sessions, possibly creating direct media flows with other participants. In addition, SIP messages are exchanged to manage and eventually terminate the session. Concerning the registration procedure, the UA sends a REGISTER message that binds the unique address of record (AOR) of the user to a globally routable Universal Resource Identifier (URI), i.e., a URI that uniquely iden- tifies the UA and ensures UA reachability, placed in the Contact header field of the message itself: the URI must ensure reachability because at any time the proxy may have to forward a SIP message to the UA. Typically, this URI includes a transport address rather than a fully qualified name since most UAs are not executed on hosts registered in the Domain Name Service (DNS). When a UA placed behind a NAT registers with an external SIP proxy, the provided URI must contain the external address dynamically assigned by the NAT that shall not change the binding with the corresponding internal address for the whole validity period of the registration. In addition, it must be ensured that incoming messages sent by the proxy are not filtered by the NAT. When the internal UA attempts to participate in new media session estab- lishment, the problem is further complicated. SIP messages used to establish media sessions must include a globally routable URI that will be used to exchange direct mid-dialog SIP messages and a valid reachable, hence exter- nal, transport address for each media flow that will be established: NAT filter- ing and mapping policies may compromise these media flows. The situation gets even more complex when considering non-deterministic NATs. Currently, SIP connectivity is usually ensured by delivering all mid-dialog SIP messages through intermediate SIP 