Can't Connect Cisco SPA504G using PJSIP TLS

Hi there,

I’m hoping for a bit of help as I’m struggling to get a Cisco SPA504G to connect to FreePBX 14 using PJSIP TLS and SRTP. The extension wont register at all and I don’t see anything in Asterisk’s console.

  • The PBX has a FQDN and a certificate from Go-Daddy.
  • The certificate has been installed correctly within FreePBX.
  • I get no certificate errors when browsing the HTTPS FreePBX web page.
  • I have updated the Firmware of the Cisco SPA504G to 7.6.2 which I believe is the latest version.

In Asterisk SIP Settings > Chan PJSIP:

  • I have selected the correct certificate
  • SSL Method is set to Default
  • Verify Client is set to Yes
  • Verify Server is set to Yes
  • tls 0.0.0.0 is set to Yes
  • Changed the port to listen on a non-standard port

In the Extension Settings > Advanced Tab:

  • Set the transport to tls
  • Set Media Encryption to SRTP via in-SDP (recommended)
  • Set Allow Non-Encrypted Media to No

I believe FreePBX, the Extension and Firewall etc settings are OK as I am able to successfully connect using Bria with TLS and make/receive encrypted calls. I just can’t get the Cisco SPA504G phone to play ball.

Screenshots from the SPA504G are below:



If I change the SIP Transport back to TCP and port then the phone is able to connect (although I need to enable Allow Non-Encrypted Media)

My first thought as I was reading this was “this only works over TCP”. I don’t remember why, but IIRC, you are going to end up using TCP for this.

I’ve tried changing SIP Transport to TCP, keeping the 5xxxx TLS port however the extension still fails to register.

Any other ideas?

Thanks,
Fraser

I did a quick search for SPA504 and TLS and came up with a couple of articles. Searching for TLS should give you some more insight. I’m pretty sure this topic has come up before.

I did search the forums but I couldn’t find anything.

I may have this working however with the following settings on the Cisco SPA504G:

The extension registers and I am able to make/receive calls. When the call connects, I hear 3 bleeps.

Is there any way I can check in the Asterisk Console that the call and media are encrypted? I’m not very familiar with Wireshark.

[[email protected] /]# asterisk -vvvvvvvvvvr
Asterisk 13.22.0, Copyright (C) 1999 - 2014, Digium, Inc. and others.
Created by Mark Spencer [email protected]
Asterisk comes with ABSOLUTELY NO WARRANTY; type ‘core show warranty’ for details.
This is free software, with components licensed under the GNU General Public
License version 2 and other licenses; you are welcome to redistribute it under
certain conditions. Type ‘core show license’ for details.
=========================================================================
Connected to Asterisk 13.22.0 currently running on PBX1 (pid = 16876)
PBX1CLI>
PBX1
CLI>
PBX1*CLI>
== Setting global variable ‘SIPDOMAIN’ to ‘pbx.xxxxxxxxxxxx.com
== Using SIP RTP Audio TOS bits 184
== Using SIP RTP Audio TOS bits 184 in TCLASS field.
== Using SIP RTP Audio CoS mark 5
– Executing [[email protected]:1] Macro(“PJSIP/1203-00000882”, “user-callerid,LIMIT,EXTERNAL,”) in new stack
– Executing [[email protected]:1] Set(“PJSIP/1203-00000882”, “TOUCH_MONITOR=1553877727.13473”) in new stack
– Executing [[email protected]:2] Set(“PJSIP/1203-00000882”, “AMPUSER=1203”) in new stack
– Executing [[email protected]:3] GotoIf(“PJSIP/1203-00000882”, “0?report”) in new stack
– Executing [[email protected]:4] ExecIf(“PJSIP/1203-00000882”, “1?Set(REALCALLERIDNUM=1203)”) in new stack
– Executing [[email protected]:5] Set(“PJSIP/1203-00000882”, “AMPUSER=1203”) in new stack
– Executing [[email protected]:6] GotoIf(“PJSIP/1203-00000882”, “0?limit”) in new stack
– Executing [[email protected]:7] Set(“PJSIP/1203-00000882”, “AMPUSERCIDNAME=Fraser Test”) in new stack
– Executing [[email protected]:8] ExecIf(“PJSIP/1203-00000882”, “0?Set(__CIDMASQUERADING=TRUE)”) in new stack
– Executing [[email protected]:9] GotoIf(“PJSIP/1203-00000882”, “0?report”) in new stack
– Executing [[email protected]:10] Set(“PJSIP/1203-00000882”, “AMPUSERCID=1203”) in new stack
– Executing [[email protected]:11] Set(“PJSIP/1203-00000882”, “__DIAL_OPTIONS=HhTtr”) in new stack
– Executing [[email protected]:12] Set(“PJSIP/1203-00000882”, “CALLERID(all)=“Fraser Test” <1203>”) in new stack
– Executing [[email protected]:13] GotoIf(“PJSIP/1203-00000882”, “0?limit”) in new stack
– Executing [[email protected]:14] ExecIf(“PJSIP/1203-00000882”, “1?Set(GROUP(concurrency_limit)=1203)”) in new stack
– Executing [[email protected]:15] ExecIf(“PJSIP/1203-00000882”, “0?Set(CHANNEL(language)=)”) in new stack
– Executing [[email protected]:16] NoOp(“PJSIP/1203-00000882”, “Macro Depth is 1”) in new stack
– Executing [[email protected]:17] GotoIf(“PJSIP/1203-00000882”, “1?report2:macroerror”) in new stack
– Goto (macro-user-callerid,s,18)
– Executing [[email protected]:18] GotoIf(“PJSIP/1203-00000882”, “1?continue”) in new stack
– Goto (macro-user-callerid,s,37)
– Executing [[email protected]:37] Set(“PJSIP/1203-00000882”, “CALLERID(number)=1203”) in new stack
– Executing [[email protected]:38] Set(“PJSIP/1203-00000882”, “CALLERID(name)=Fraser Test”) in new stack
– Executing [[email protected]:39] GotoIf(“PJSIP/1203-00000882”, “0?cnum”) in new stack
– Executing [[email protected]:40] Set(“PJSIP/1203-00000882”, “CDR(cnam)=Fraser Test”) in new stack
– Executing [[email protected]:41] Set(“PJSIP/1203-00000882”, “CDR(cnum)=1203”) in new stack
– Executing [[email protected]:42] Set(“PJSIP/1203-00000882”, “CHANNEL(language)=en”) in new stack
– Executing [[email protected]:2] Gosub(“PJSIP/1203-00000882”, “sub-record-check,s,1(out,0782xxxxxxx,dontcare)”) in new stack
– Executing [[email protected]:1] GotoIf(“PJSIP/1203-00000882”, “0?initialized”) in new stack
– Executing [[email protected]:2] Set(“PJSIP/1203-00000882”, “__REC_STATUS=INITIALIZED”) in new stack
– Executing [[email protected]:3] Set(“PJSIP/1203-00000882”, “NOW=1553877727”) in new stack
– Executing [[email protected]:4] Set(“PJSIP/1203-00000882”, “__DAY=29”) in new stack
– Executing [[email protected]:5] Set(“PJSIP/1203-00000882”, “__MONTH=03”) in new stack
– Executing [[email protected]:6] Set(“PJSIP/1203-00000882”, “__YEAR=2019”) in new stack
– Executing [[email protected]:7] Set(“PJSIP/1203-00000882”, “__TIMESTR=20190329-164207”) in new stack
– Executing [[email protected]:8] Set(“PJSIP/1203-00000882”, “__FROMEXTEN=1203”) in new stack
– Executing [[email protected]:9] Set(“PJSIP/1203-00000882”, “__MON_FMT=wav”) in new stack
– Executing [[email protected]:10] NoOp(“PJSIP/1203-00000882”, “Recordings initialized”) in new stack
– Executing [[email protected]:11] ExecIf(“PJSIP/1203-00000882”, “0?Set(ARG3=dontcare)”) in new stack
– Executing [[email protected]:12] Set(“PJSIP/1203-00000882”, “REC_POLICY_MODE_SAVE=”) in new stack
– Executing [[email protected]:13] ExecIf(“PJSIP/1203-00000882”, “0?Set(REC_STATUS=NO)”) in new stack
– Executing [[email protected]:14] GotoIf(“PJSIP/1203-00000882”, “3?checkaction”) in new stack
– Goto (sub-record-check,s,17)
– Executing [[email protected]:17] GotoIf(“PJSIP/1203-00000882”, “1?sub-record-check,out,1”) in new stack
– Goto (sub-record-check,out,1)
– Executing [[email protected]:1] NoOp(“PJSIP/1203-00000882”, “Outbound Recording Check from 1203 to 0782xxxxxxx”) in new stack
– Executing [[email protected]:2] Set(“PJSIP/1203-00000882”, “RECMODE=force”) in new stack
– Executing [[email protected]:3] ExecIf(“PJSIP/1203-00000882”, “0?Goto(routewins)”) in new stack
– Executing [[email protected]:4] ExecIf(“PJSIP/1203-00000882”, “0?Goto(routewins)”) in new stack
– Executing [[email protected]:5] Gosub(“PJSIP/1203-00000882”, “recordcheck,1(force,out,0782xxxxxxx)”) in new stack
– Executing [[email protected]:1] NoOp(“PJSIP/1203-00000882”, “Starting recording check against force”) in new stack
– Executing [[email protected]:2] Goto(“PJSIP/1203-00000882”, “force”) in new stack
– Goto (sub-record-check,recordcheck,5)
– Executing [[email protected]:5] Set(“PJSIP/1203-00000882”, “__REC_POLICY_MODE=FORCE”) in new stack
– Executing [[email protected]:6] GotoIf(“PJSIP/1203-00000882”, “1?startrec”) in new stack
– Goto (sub-record-check,recordcheck,16)
– Executing [[email protected]:16] NoOp(“PJSIP/1203-00000882”, “Starting recording: out, 0782xxxxxxx”) in new stack
– Executing [[email protected]:17] Set(“PJSIP/1203-00000882”, “__CALLFILENAME=out-0782xxxxxxx-1203-20190329-164207-1553877727.13473”) in new stack
– Executing [[email protected]:18] MixMonitor(“PJSIP/1203-00000882”, “2019/03/29/out-0782xxxxxxx-1203-20190329-164207-1553877727.13473.wav,abi(LOCAL_MIXMON_ID),”) in new stack
– Executing [[email protected]:19] Set(“PJSIP/1203-00000882”, “__MIXMON_ID=0x7efecc002140”) in new stack
== Begin MixMonitor Recording PJSIP/1203-00000882
– Executing [[email protected]:20] Set(“PJSIP/1203-00000882”, “__RECORD_ID=PJSIP/1203-00000882”) in new stack
– Executing [[email protected]:21] Set(“PJSIP/1203-00000882”, “__REC_STATUS=RECORDING”) in new stack
– Executing [[email protected]:22] Set(“PJSIP/1203-00000882”, “CDR(recordingfile)=out-0782xxxxxxx-1203-20190329-164207-1553877727.13473.wav”) in new stack
– Executing [[email protected]:23] Return(“PJSIP/1203-00000882”, “”) in new stack
– Executing [[email protected]:6] Return(“PJSIP/1203-00000882”, “”) in new stack
– Executing [[email protected]:3] ExecIf(“PJSIP/1203-00000882”, “0 ?Set(CDR(accountcode)=)”) in new stack
– Executing [[email protected]:4] Set(“PJSIP/1203-00000882”, “MOHCLASS=default”) in new stack
– Executing [[email protected]:5] Set(“PJSIP/1203-00000882”, “_NODEST=”) in new stack
– Executing [[email protected]:6] Macro(“PJSIP/1203-00000882”, “dialout-trunk,1,0782xxxxxxx,off”) in new stack
– Executing [[email protected]:1] Set(“PJSIP/1203-00000882”, “DIAL_TRUNK=1”) in new stack
– Executing [[email protected]:2] ExecIf(“PJSIP/1203-00000882”, “0?Set(DIAL_OPTIONS=Hhtr)”) in new stack
– Executing [[email protected]:3] GosubIf(“PJSIP/1203-00000882”, “0?sub-pincheck,s,1()”) in new stack
– Executing [[email protected]:4] ExecIf(“PJSIP/1203-00000882”, “0?Set(CALLERID(num)=1203)”) in new stack
– Executing [[email protected]:5] GotoIf(“PJSIP/1203-00000882”, “0?disabletrunk,1”) in new stack
– Executing [[email protected]:6] Set(“PJSIP/1203-00000882”, “DIAL_NUMBER=0782xxxxxxx”) in new stack
– Executing [[email protected]:7] Set(“PJSIP/1203-00000882”, “DIAL_TRUNK_OPTIONS=HhTtr”) in new stack
– Executing [[email protected]:8] Set(“PJSIP/1203-00000882”, “OUTBOUND_GROUP=OUT_1”) in new stack
– Executing [[email protected]:9] Set(“PJSIP/1203-00000882”, “DIAL_TRUNK_OPTIONS=T”) in new stack
– Executing [[email protected]:10] GotoIf(“PJSIP/1203-00000882”, “1?nomax”) in new stack
– Goto (macro-dialout-trunk,s,12)
– Executing [[email protected]:12] GotoIf(“PJSIP/1203-00000882”, “0?skipoutcid”) in new stack
– Executing [[email protected]:13] Macro(“PJSIP/1203-00000882”, “outbound-callerid,1”) in new stack
– Executing [[email protected]:1] NoOp(“PJSIP/1203-00000882”, “1203”) in new stack
– Executing [[email protected]:2] NoOp(“PJSIP/1203-00000882”, “”) in new stack
– Executing [[email protected]:3] NoOp(“PJSIP/1203-00000882”, “off”) in new stack
– Executing [[email protected]:4] ExecIf(“PJSIP/1203-00000882”, “0?Set(CALLERPRES(name-pres)=)”) in new stack
– Executing [[email protected]:5] ExecIf(“PJSIP/1203-00000882”, “0?Set(CALLERPRES(num-pres)=)”) in new stack
– Executing [[email protected]:6] ExecIf(“PJSIP/1203-00000882”, “0?Set(REALCALLERIDNUM=1203)”) in new stack
– Executing [[email protected]:7] ExecIf(“PJSIP/1203-00000882”, “0?Set(AMPUSER=1203)”) in new stack
– Executing [[email protected]:8] GotoIf(“PJSIP/1203-00000882”, “1?normcid”) in new stack
– Goto (macro-outbound-callerid,s,12)
– Executing [[email protected]:12] Set(“PJSIP/1203-00000882”, “USEROUTCID=“0141xxxxxxx””) in new stack
– Executing [[email protected]:13] Set(“PJSIP/1203-00000882”, “EMERGENCYCID=”) in new stack
– Executing [[email protected]:14] Set(“PJSIP/1203-00000882”, “TRUNKOUTCID=”) in new stack
– Executing [[email protected]:15] GotoIf(“PJSIP/1203-00000882”, “1?trunkcid”) in new stack
– Goto (macro-outbound-callerid,s,20)
– Executing [[email protected]:20] ExecIf(“PJSIP/1203-00000882”, “0?Set(CALLERID(all)=)”) in new stack
– Executing [[email protected]:21] ExecIf(“PJSIP/1203-00000882”, “1?Set(CALLERID(all)=“0141xxxxxxx”)”) in new stack
– Executing [[email protected]:22] ExecIf(“PJSIP/1203-00000882”, “0?Set(CALLERID(all)=)”) in new stack
– Executing [[email protected]:23] ExecIf(“PJSIP/1203-00000882”, “0?Set(CALLERPRES(name-pres)=prohib_passed_screen)”) in new stack
– Executing [[email protected]:24] ExecIf(“PJSIP/1203-00000882”, “0?Set(CALLERPRES(num-pres)=prohib_passed_screen)”) in new stack
– Executing [[email protected]:25] Set(“PJSIP/1203-00000882”, “CDR(outbound_cnum)=”) in new stack
– Executing [[email protected]:26] Set(“PJSIP/1203-00000882”, “CDR(outbound_cnam)=0141xxxxxxx”) in new stack
– Executing [[email protected]:14] GosubIf(“PJSIP/1203-00000882”, “0?sub-flp-1,s,1()”) in new stack
– Executing [[email protected]:15] Set(“PJSIP/1203-00000882”, “OUTNUM=0782xxxxxxx”) in new stack
– Executing [[email protected]:16] Set(“PJSIP/1203-00000882”, “custom=SIP/SipTrunk”) in new stack
– Executing [[email protected]:17] ExecIf(“PJSIP/1203-00000882”, “0?Set(DIAL_TRUNK_OPTIONS=M(setmusic^default)T)”) in new stack
– Executing [[email protected]:18] ExecIf(“PJSIP/1203-00000882”, “0?Set(DIAL_TRUNK_OPTIONS=TM(confirm))”) in new stack
– Executing [[email protected]:19] Macro(“PJSIP/1203-00000882”, “dialout-trunk-predial-hook,”) in new stack
– Executing [[email protected]:1] MacroExit(“PJSIP/1203-00000882”, “”) in new stack
– Executing [[email protected]:20] GotoIf(“PJSIP/1203-00000882”, “0?bypass,1”) in new stack
– Executing [[email protected]:21] ExecIf(“PJSIP/1203-00000882”, “1?Set(CONNECTEDLINE(num,i)=0782xxxxxxx)”) in new stack
– Executing [[email protected]:22] GotoIf(“PJSIP/1203-00000882”, “0?customtrunk”) in new stack
– Executing [[email protected]:23] Dial(“PJSIP/1203-00000882”, “SIP/SipTrunk/0782xxxxxxx,300,Tb(func-apply-sipheaders^s^1,(1))”) in new stack
== Using SIP RTP TOS bits 184
== Using SIP RTP CoS mark 5
– SIP/SipTrunk-000003de Internal Gosub(func-apply-sipheaders,s,1(1)) start
– Executing [[email protected]:1] NoOp(“SIP/SipTrunk-000003de”, “Applying SIP Headers to channel SIP/SipTrunk-000003de”) in new stack
– Executing [[email protected]:2] Set(“SIP/SipTrunk-000003de”, “TECH=SIP”) in new stack
– Executing [[email protected]:3] Set(“SIP/SipTrunk-000003de”, “SIPHEADERKEYS=”) in new stack
– Executing [[email protected]:4] While(“SIP/SipTrunk-000003de”, “0”) in new stack
– Jumping to priority 11
– Executing [[email protected]:12] Return(“SIP/SipTrunk-000003de”, “”) in new stack
== Spawn extension (from-trunk-sip-SipTrunk, 0782xxxxxxx, 1) exited non-zero on ‘SIP/SipTrunk-000003de’
– SIP/SipTrunk-000003de Internal Gosub(func-apply-sipheaders,s,1(1)) complete GOSUB_RETVAL=
– Called SIP/SipTrunk/0782xxxxxxx
0x7efecc033ee0 – Strict RTP learning after remote address set to: 185.x.x.x:14876
– SIP/SipTrunk-000003de is making progress passing it to PJSIP/1203-00000882
0x7eff200afea0 – Strict RTP learning after remote address set to: 192.168.x.x:16458
0x7eff200afea0 – Strict RTP qualifying stream type: audio
0x7eff200afea0 – Strict RTP switching source address to 84.xx.xx.xx:36842
0x7efecc033ee0 – Strict RTP switching to RTP target address 185.x.x.x:14876 as source
0x7eff200afea0 – Strict RTP learning complete - Locking on source address 84.xx.xx.xx:36842
0x7efecc033ee0 – Strict RTP learning complete - Locking on source address 185.x.x.x:14876
– SIP/SipTrunk-000003de answered PJSIP/1203-00000882
– Channel SIP/SipTrunk-000003de joined ‘simple_bridge’ basic-bridge
– Channel PJSIP/1203-00000882 joined ‘simple_bridge’ basic-bridge
– Channel PJSIP/1203-00000882 left ‘simple_bridge’ basic-bridge
– Channel SIP/SipTrunk-000003de left ‘simple_bridge’ basic-bridge
== Spawn extension (macro-dialout-trunk, s, 23) exited non-zero on ‘PJSIP/1203-00000882’ in macro ‘dialout-trunk’
== Spawn extension (from-internal, 0782xxxxxxx, 6) exited non-zero on ‘PJSIP/1203-00000882’
– Executing [[email protected]:1] Macro(“PJSIP/1203-00000882”, “hangupcall”) in new stack
– Executing [[email protected]:1] GotoIf(“PJSIP/1203-00000882”, “1?theend”) in new stack
– Goto (macro-hangupcall,s,3)
– Executing [[email protected]:3] ExecIf(“PJSIP/1203-00000882”, “0?Set(CDR(recordingfile)=)”) in new stack
– Executing [[email protected]:4] NoOp(“PJSIP/1203-00000882”, “SIP/SipTrunk-000003de monior file= /var/spool/asterisk/monitor/2019/03/29/out-0782xxxxxxx-1203-20190329-164207-1553877727.13473.wav”) in new stack
– Executing [[email protected]:5] AGI(“PJSIP/1203-00000882”, “attendedtransfer-rec-restart.php,SIP/SipTrunk-000003de,/var/spool/asterisk/monitor/2019/03/29/out-0782xxxxxxx-1203-20190329-164207-1553877727.13473.wav”) in new stack
– Launched AGI Script /var/lib/asterisk/agi-bin/attendedtransfer-rec-restart.php
– <PJSIP/1203-00000882>AGI Script attendedtransfer-rec-restart.php completed, returning 0
– Executing [[email protected]:6] Hangup(“PJSIP/1203-00000882”, “”) in new stack
== Spawn extension (macro-hangupcall, s, 6) exited non-zero on ‘PJSIP/1203-00000882’ in macro ‘hangupcall’
== Spawn extension (from-internal, h, 1) exited non-zero on ‘PJSIP/1203-00000882’
== MixMonitor close filestream (mixed)
== End MixMonitor Recording PJSIP/1203-00000882

Thanks,
Fraser

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.