Unable to get incoming calls through SIP trunks. Getting error SIP/2.0 401 Unauthorized

Hi All,

I was able to fix the problem with the help of Asterisk Team. Thanks a ton to them and to you all for your replies and inputs.It seems the calls were not getting completed because of my extensions having secret. But the logs from the Asterisk were mis-leading, since according to it, the other PBX needed authentication to complete the call.

Non-working call :-

CUCM ----(SIP Trunk)---- Asterisk

        ------------> Invite
       <-----------  401 Unauthorised
        ------------> ACK

This is mis-leading, and makes us think that CUCM needs authentication to complete the call. Below are the exact SIP messages from the SIP dialog for the non-working call.

<— SIP read from UDP:20.1.1.170:5060 —>
INVITE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 20.1.1.170:5060;branch=z9hG4bK36a362292c0ca
From: sip:[email protected];tag=730648~4ab333c0-314e-1172-16a8-eca8c1530263-31440129
To: sip:[email protected]
Date: Sun, 06 Sep 2015 09:45:57 GMT
Call-ID: [email protected]
Supported: timer,resource-priority,replaces
Min-SE: 1800
User-Agent: Cisco-CUCM10.5
Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY
CSeq: 101 INVITE
Expires: 180
Allow-Events: presence
Supported: X-cisco-srtp-fallback,X-cisco-original-called
Cisco-Guid: 0292208128-0000065536-0000002366-2852192532
Session-Expires: 1800
P-Asserted-Identity: sip:[email protected]
Remote-Party-ID: sip:[email protected];party=calling;screen=yes;privacy=off
Contact: sip:[email protected]:5060;bfcp
Max-Forwards: 69
Content-Type: application/sdp
Content-Length: 198

v=0
o=CiscoSystemsCCM-SIP 730648 1 IN IP4 20.1.1.170
s=SIP Call
c=IN IP4 20.1.1.170
t=0 0
m=audio 25502 RTP/AVP 0 101
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
<------------->
— (22 headers 9 lines) —
Sending to 20.1.1.170:5060 (no NAT)
Sending to 20.1.1.170:5060 (no NAT)
Using INVITE request as basis request - [email protected]
Found peer ‘2723’ for ‘2723’ from 20.1.1.170:5060

<— Reliably Transmitting (NAT) to 20.1.1.170:5060 —>
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 20.1.1.170:5060;branch=z9hG4bK36a362292c0ca;received=20.1.1.170;rport=5060
From: sip:[email protected];tag=730648~4ab333c0-314e-1172-16a8-eca8c1530263-31440129
To: sip:[email protected];tag=as37a2e028
Call-ID: [email protected]
CSeq: 101 INVITE
Server: FPBX-12.0.76(11.19.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="716cae18"
Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘[email protected]’ in 25472 ms (Method: INVITE)

e[Kknaufsappdc*CLI>
e[0K
<— SIP read from UDP:20.1.1.170:5060 —>
ACK sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 20.1.1.170:5060;branch=z9hG4bK36a362292c0ca
From: sip:[email protected];tag=730648~4ab333c0-314e-1172-16a8-eca8c1530263-31440129
To: sip:[email protected];tag=as37a2e028
Date: Sun, 06 Sep 2015 09:45:57 GMT
Call-ID: [email protected]
User-Agent: Cisco-CUCM10.5
Max-Forwards: 70
CSeq: 101 ACK
Allow-Events: presence
Content-Length: 0

<------------->

======================================================================================

But according to Asterisk, the call was not getting completed because of SECRET configuration in the extensions. As soon i removed the SECRET configuration on the Extension (being called) on the Asterisk, the call completed just fine without any issue. I also did not have to configure “insecure=invite,port” attributes on the SIP trunk.

Below is the final configuration, with which the calls worked :-

  1. On the SIP trunk :- ((I am also not sure, if all the attributes are needed in the trunk, since those were added on hit and trial basis just make it work for the call, but yes we do not need insecure=invite,port. )

disallow=all
host=20.1.1.170
type=friend
port=5060
nat=no
allow=ulaw,alaw
qualify=yes
canreinvite=yes
context=from-trunk-sip-cucm

  1. The extensions were configured with secret field as empty :- (just a snippet of the config)

[2723]
deny=0.0.0.0/0.0.0.0
secret=
dtmfmode=rfc2833

======================================================================================

Thanks a lot to you people.

Happy Day !