I installed FreePBX 17, and I’m trying to connect a pjsip trunk to Swisscom (Swiss telecom). I’m getting these error messages.
<<<<<
Connected to Asterisk 21.4.3 currently running on FreePBX17 (pid = 1685)
[2024-10-03 13:24:24] WARNING[15401]: res_pjsip_outbound_registration.c:1079 schedule_retry: No response received from ‘sip:swisscom.ch:5060’ on registration attempt to ‘sip:[email protected]:5060’, retrying in ‘60’
[2024-10-03 13:24:27] ERROR[15401]: res_pjsip.c:1419 create_out_of_dialog_request: Unable to apply outbound proxy on request OPTIONS to endpoint Swisscom_sip as outbound proxy URI ‘fs1.ims.swisscom.ch’ is not valid
[2024-10-03 13:24:27] ERROR[15401]: res_pjsip/pjsip_options.c:879 sip_options_qualify_contact: Unable to create request to qualify contact sip:[email protected]:5060 on AOR Swisscom_sip
Has anyone had some experience with a sip trunk for Swisscom?
I created another trunk for Peoplefone, another provider in Switzerland. The trunk registered within seconds, so I think everything is in good shape with my FreePBX.
I don’t know whether this applies to Swisscom, but with most IMS systems, you would put in the Outbound Proxy field for the trunk (in the GUI): sip:fs1.ims.swisscom.ch\;lr\;hide
The normal answer for bogus failed to authenticates is that you have inadequate firewaling. However the fact that they are originating from the internal address of your router, and a non-standard port number, makes me think you have a SIP ALG (application level gatway) running on the router. These are normally broken, and should be disabled.
The next question is whether extension 2071 exists and should be trying to access from outside. If not, you probably also have inadequate firewalling. Unless you actually have a need for another arrangement, you should be rejecting all SIP requests from outside, unless they come from the addresses that Swiss Telecom say they use.
Swisscom requires a user name (+41mynumber) and auth name, which I provided in the trunk GUI. However, in the log, I don’t see that the auth name is transmitted.
The Web-GUI in asterisk info returns a “registered” for the trunk.
The auth name will only be transmitted if they send a 401 response, it’s part of the authentication data requested by the 401. They have rejected the OPTIONS before it reaches that point.
Note that a rejected OPTIONS is a good response for Asterisk. It means that there is something there and responding, which is all that it is looking for.
You appear to have the user name set to Swisscom_sip, not to the value you say it should be.
They are probably expecting from user to be set, which can be set specifically, but also through the caller ID.
It’s up to you to decide what is sensitive. You haven’t transmitted anything based on your password, but some people are sensitive about account names, public IP addresses, and PSTN numbers. It is probably too late to remove all trace, but you would have to ask a moderator to assist, if you wanted to try that.
You are showing the provider sending OPTIONS to the PBX and that is what is being challenged. By default chan_pjsip will challenge incoming OPTIONS just like incoming INVITES. Unfortunately, FreePBX doesn’t have this setting exposed to disable. You would need to put this in this the pjsip.endpoint_custom_post.conf file.
A 403 response to options should not cause the endpoint to go unreachable. If it is able to get 403 back, it has connectivity both ways, so is considered reachable.
There is a risk that far side treats this as an attack and, eventually, blocks traffic from you.
If OPTIONS is failing, INVITE may fail for the same reason, but there is no evidence of this in the OP’s log.
It can be anything, as long as type=auth context with the name contains the right information. The information will not be used unless you receive a 401, or 407, response.
Someone from Swisscom support sent me this picture. On the left side, it shows how a proper registration should look, and on the right, you see what my FreePBX 17 sends.
Well, according to Swisscom documentation second picture
under general
Username: 4144XXXXX
Author username: I received by Swisscom starting with [email protected]
I assume that I don’t need to enter @swisscom.ch in the author username field
SIP server: swisscom.ch
Port: 5060
Strange. Assuming that in the GUI you have Outbound Proxy set to sip:fs1.ims.swisscom.ch\;lr\;hide
I would expect the lr and hide parameters to propagate to pjsip.endpoint.conf, which should result in the name fs1.ims.swisscom.ch not appearing in any transmitted SIP packets.
Possibly you do, but if you can register and make calls, what you have must be correct.
That is ambiguous, because the forum may have deleted the backslash characters.
Assuming that you did enter them into the Outbound Proxy field of the GUI, I don’t understand why the lr and hide parameters aren’t being honored.
