Incoming calls on SIP trunk: 403 Forbidden

General Help
1

I am having trouble getting incoming calls to work with my SIP provider.

I have tried any number of settings in the “incoming” section of my trunk definition, all to no avail.

I have tried to set up an inbound route with the DID, I have tried adding the DID to the extension, all to no avail.

The Asterisk box is has its own official external IP address, so there should be no NAT issues.

I get absolutely NO output in the CLI (despite verbosity=110) unless I turn SIP debugging on; then I get the following:

pbx*CLI>
<— SIP read from 196.17.242.198:5060 —>
INVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 196.17.242.198:5060;branch=z9hG4bK6fa65e89;rport
From: “06649662860” sip:[email protected];tag=as090ae269
To: sip:[email protected]
Contact: sip:[email protected]
Call-ID: [email protected]
CSeq: 102 INVITE
User-Agent: Asterisk PBX
Max-Forwards: 70
Date: Wed, 23 Jul 2008 12:26:08 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Content-Type: application/sdp
Content-Length: 218

v=0
o=root 2854 2854 IN IP4 196.17.242.198
s=session
c=IN IP4 196.17.242.198
t=0 0
m=audio 17534 RTP/AVP 8 101
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=silenceSupp:off - - - -

<------------->
— (13 headers 10 lines) —
Sending to 196.17.242.198 : 5060 (NAT)
Using INVITE request as basis request - [email protected]
Found peer ‘voipco-vcs’

<— Reliably Transmitting (NAT) to 196.17.242.198:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 196.17.242.198:5060;branch=z9hG4bK6fa65e89;received=196.17.242.198;rport=5060
From: “06649662860” sip:[email protected];tag=as090ae269
To: sip:[email protected];tag=as5b68b468
Call-ID: [email protected]
CSeq: 102 INVITE
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="5e5b4a4e"
Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘[email protected]’ in 6400 ms (Method: INVITE)
pbx*CLI>
<— SIP read from 196.17.242.198:5060 —>
ACK sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 196.17.242.198:5060;branch=z9hG4bK6fa65e89;rport
From: “06649662860” sip:[email protected];tag=as090ae269
To: sip:[email protected];tag=as5b68b468
Contact: sip:[email protected]
Call-ID: [email protected]
CSeq: 102 ACK
User-Agent: Asterisk PBX
Max-Forwards: 70
Content-Length: 0

<------------->
— (10 headers 0 lines) —
pbx*CLI>
<— SIP read from 196.17.242.198:5060 —>
INVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 196.17.242.198:5060;branch=z9hG4bK7f227b73;rport
From: “06649662860” sip:[email protected];tag=as090ae269
To: sip:[email protected]
Contact: sip:[email protected]
Call-ID: [email protected]
CSeq: 103 INVITE
User-Agent: Asterisk PBX
Max-Forwards: 70
Proxy-Authorization: Digest username=“7682253”, realm=“asterisk”, algorithm=MD5, uri="sip:[email protected]", nonce=“5e5b4a4e”, response=“7d62c9c9c86f02fb14dfe41e43258f51”, opaque=""
Date: Wed, 23 Jul 2008 12:26:08 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Content-Type: application/sdp
Content-Length: 218

v=0
o=root 2854 2855 IN IP4 196.17.242.198
s=session
c=IN IP4 196.17.242.198
t=0 0
m=audio 17534 RTP/AVP 8 101
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=silenceSupp:off - - - -

<------------->
— (14 headers 10 lines) —
Sending to 196.17.242.198 : 5060 (NAT)
Using INVITE request as basis request - [email protected]
Found peer ‘voipco-vcs’

<— Reliably Transmitting (NAT) to 196.17.242.198:5060 —>
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP 196.17.242.198:5060;branch=z9hG4bK7f227b73;received=196.17.242.198;rport=5060
From: “06649662860” sip:[email protected];tag=as090ae269
To: sip:[email protected];tag=as5b68b468
Call-ID: [email protected]
CSeq: 103 INVITE
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Supported: replaces
Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘[email protected]’ in 6400 ms (Method: INVITE)
pbx*CLI>
<— SIP read from 196.17.242.198:5060 —>
ACK sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 196.17.242.198:5060;branch=z9hG4bK7f227b73;rport
From: “06649662860” sip:[email protected];tag=as090ae269
To: sip:[email protected];tag=as5b68b468
Contact: sip:[email protected]
Call-ID: [email protected]
CSeq: 103 ACK
User-Agent: Asterisk PBX
Max-Forwards: 70
Content-Length: 0

<------------->
— (10 headers 0 lines) —
pbx*CLI> Reliably Transmitting (NAT) to 196.17.242.198:5060:
OPTIONS sip:bsip02.voipco.net SIP/2.0
Via: SIP/2.0/UDP 196.17.247.227:5060;branch=z9hG4bK7691ac01;rport
From: “Unknown” sip:[email protected];tag=as1caddd31
To: sip:bsip02.voipco.net
Contact: sip:[email protected]
Call-ID: [email protected]
CSeq: 102 OPTIONS
User-Agent: Asterisk PBX
Max-Forwards: 70
Date: Wed, 23 Jul 2008 12:24:27 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Supported: replaces
Content-Length: 0

pbx*CLI>
<— SIP read from 196.17.242.198:5060 —>
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 196.17.247.227:5060;branch=z9hG4bK7691ac01;received=196.17.247.227;rport=5060
From: “Unknown” sip:[email protected];tag=as1caddd31
To: sip:bsip02.voipco.net;tag=as137178c8
Call-ID: [email protected]
CSeq: 102 OPTIONS
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Accept: application/sdp
Content-Length: 0

<------------->
— (10 headers 0 lines) —
pbxCLI> Really destroying SIP dialog ‘[email protected]’ Method: OPTIONS
pbxCLI>

2

HI,
I am having the same issue.I have incoming and outgoing from the same provider i mean iam using same trunk for incoming and outgoing.If i delete the trunk then i can recieve the call without any issues,but if i add the trunk in trunks section then i get forbidden error.Any help would be appreciated.

thank you

3

Try allowing anonymous sip and set up an Any/Any inbound route. Then call in, watching the CLI. That should show you what DID info is being sent. Then create a inbound route for that DID and turn off the Any/Any route. Call in again and see if it works.

4

Anonymous sip calls are allowed, and I set up an Any/Any inbound route. Calls never showed up on the CLI, unless I turned on SIP debugging, then all I could see was the sip debug info.

I can see the DID, it is countrycode+citycode+subscribercode (+extension if one has been dialled).

But setting up an inbound route with that info changes nothing, nor does setting it as the DID for an extension.

Here in Austria (also in Germany, I believe) DID’s are not complete subscriber numbers, rather, you have a single subscriber number, for example, +43123456.

If someone dials that number by itself or with a 0 appended, it will typically go to the switchboard/operator; if someone appends a valid extension number that number will be provided by the telco either by itself or prepended with the subscriber number – the incumbent telco just supplies the extension number while my sip provider provides the whole thing.

I have a line in from-trunk-custom “exten => _43123456.,Goto(ext-local,${EXTEN:8},1)” to match that.

Anyway, following the first reply to this query I deleted all of the trunk definition except the name and the registration line, and suddenly calls were coming in to the from-trunk context. But now I could not make outgoing calls over that trunk.

My next step will be adding bits back into the trunk definition until I can make outgoing calls again, or figure out exactly which parameter is causing incoming calls to fail.

I wish Asterisk produced some intelligible CLI output for SIP calls it doesn’t know how to handle, instead of just quietly failing.

5

wolf,

I have to agree with you about the lack of CLI activity when a SIP call is rebuffed. Let us know what made this work.

6

Solved my problem. Adding “insecure=very” to the trunk definition permitted incoming calls to get through.