Finally fixed it!
There were 2 changes I had to make in the ISR4321, both under the
voice service voip
configuration directive.
First, I had to remove the line:
mode border-element
What this directive actually did was modify the ISR4321 to activate so-called “CUBE” licensing. However, along with doing that, when turned on it (apparently) greatly reduces Cisco debugging output.
When I turned it off, then looked again at the SIP debugging output, I noticed among the much more copious output:
000234: Oct 20 03:08:24.230 PDT: //-1/xxxxxxxxxxxx/SIP/Error/sipSPILocateInviteDialogCCB:
Ip Trust List Authentication failed for Incoming Request, method = OPTIONS
Apparently the so-called “Ip Trust List” thing is a new thing Cisco has added sometime between IOS 12 and IOS 16 to further strengthen security - probably to close a hole preventing people from the outside making free phone calls or something. Not a bad thing - when you know about it.
So, under the
voice service voip
I had to add:
ip address trusted list
ipv4 172.16.160.10
Now the trunk registered into the ISR4321 normally, and I was able to make outbound and inbound calls through it.
Allegedly, supposedly, I can turn back on the mode border-element line - but without really knowing all of the implications of what exactly it does - I’m not really willing to mess around with it.
Apparently not many Cisco people even understand what that line does as witness to this line of questioning:
CUBE: mode border element what really do? - Cisco Community
Something tells me that people who configure these CUBE devices for a living depend a horribly lot on pre-canned templates, or TAC support (that also probably uses pre-canned templates) to get devices configured and working.
As a further note to this - the ip address trusted list is a newer addition - virtually every example out there for connecting FreePBX or Asterisk to one of these devices as either a POTS or SIP gateway lacks this addition - since those examples predate Cisco IOS 15