diff --git a/openbsc/include/openbsc/bsc_nat.h b/openbsc/include/openbsc/bsc_nat.h
index 3090eb0..027b6de 100644
--- a/openbsc/include/openbsc/bsc_nat.h
+++ b/openbsc/include/openbsc/bsc_nat.h
@@ -372,7 +372,7 @@
 
 struct nat_sccp_connection *bsc_mgcp_find_con(struct bsc_nat *, int endpoint_number);
 struct msgb *bsc_mgcp_rewrite(char *input, int length, int endp, const char *ip,
-			      int port, int osmux, int *payload_type, int mode_set);
+			      int port, int osmux, int *first_payload_type, int mode_set);
 void bsc_mgcp_forward(struct bsc_connection *bsc, struct msgb *msg);
 
 void bsc_mgcp_clear_endpoints_for(struct bsc_connection *bsc);
diff --git a/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c b/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c
index 5a024db..f04c981 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c
@@ -815,7 +815,7 @@
 /* we need to replace some strings... */
 struct msgb *bsc_mgcp_rewrite(char *input, int length, int endpoint,
 			      const char *ip, int port, int osmux_cid,
-			      int *payload_type, int ensure_mode_set)
+			      int *first_payload_type, int ensure_mode_set)
 {
 	static const char crcx_str[] = "CRCX ";
 	static const char dlcx_str[] = "DLCX ";
@@ -873,14 +873,15 @@
 				output->l3h[0] = '\n';
 			}
 		} else if (strncmp(aud_str, token, (sizeof aud_str) - 1) == 0) {
-			if (sscanf(token, "m=audio %*d RTP/AVP %d", &payload) != 1) {
+			int offset;
+			if (sscanf(token, "m=audio %*d RTP/AVP %n%d", &offset, &payload) != 1) {
 				LOGP(DMGCP, LOGL_ERROR, "Could not parsed audio line.\n");
 				msgb_free(output);
 				return NULL;
 			}
 
-			snprintf(buf, sizeof(buf)-1, "m=audio %d RTP/AVP %d%s",
-				 port, payload, cr ? "\r\n" : "\n");
+			snprintf(buf, sizeof(buf)-1, "m=audio %d RTP/AVP %s\n",
+				 port, &token[offset]);
 			buf[sizeof(buf)-1] = '\0';
 
 			output->l3h = msgb_put(output, strlen(buf));
@@ -908,8 +909,8 @@
 		memcpy(output->l3h, buf, strlen(buf));
 	}
 
-	if (payload != -1 && payload_type)
-		*payload_type = payload;
+	if (payload != -1 && first_payload_type)
+		*first_payload_type = payload;
 
 	return output;
 }
diff --git a/openbsc/tests/bsc-nat/bsc_data.c b/openbsc/tests/bsc-nat/bsc_data.c
index 3f1f527..3a9f1da 100644
--- a/openbsc/tests/bsc-nat/bsc_data.c
+++ b/openbsc/tests/bsc-nat/bsc_data.c
@@ -157,8 +157,8 @@
 
 
 /* patch the ip and port */
-static const char crcx_resp[] = "200 23265295\r\nI: 1\r\n\r\nv=0\r\nc=IN IP4 172.16.18.2\r\nm=audio 4002 RTP/AVP 98\r\na=rtpmap:98 AMR/8000\r\n";
-static const char crcx_resp_patched[] = "200 23265295\r\nI: 1\r\n\r\nv=0\r\nc=IN IP4 10.0.0.1\r\nm=audio 999 RTP/AVP 98\r\na=rtpmap:98 AMR/8000\r\na=fmtp:98 mode-set=2\r\n";
+static const char crcx_resp[] = "200 23265295\r\nI: 1\r\n\r\nv=0\r\nc=IN IP4 172.16.18.2\r\nm=audio 4002 RTP/AVP 98 3\r\na=rtpmap:98 AMR/8000\r\n";
+static const char crcx_resp_patched[] = "200 23265295\r\nI: 1\r\n\r\nv=0\r\nc=IN IP4 10.0.0.1\r\nm=audio 999 RTP/AVP 98 3\r\na=rtpmap:98 AMR/8000\r\na=fmtp:98 mode-set=2\r\n";
 
 /* patch the ip and port */
 static const char mdcx[] = "MDCX 23330829 8@mgw MGCP 1.0\r\nC: 394b0439fb\r\nI: 1\r\nL: p:20, a:AMR, nt:IN\r\nM: recvonly\r\n\r\nv=0\r\no=- 1049380491 0 IN IP4 172.16.18.2\r\ns=-\r\nc=IN IP4 172.16.18.2\r\nt=0 0\r\nm=audio 4410 RTP/AVP 126\r\na=rtpmap:126 AMR/8000/1\r\na=fmtp:126 mode-set=2;start-mode=0\r\na=ptime:20\r\na=recvonly\r\nm=image 4412 udptl t38\r\na=T38FaxVersion:0\r\na=T38MaxBitRate:14400\r\n";