PJSIP failed to authenticate

Hello,
I am setting up a fresh freepbx 17 server.
Some phones cannot connect, error is failed to authenticate.
I had this problem with older freepbx distributions, but there i switched to chan_sip and it worked.
username and password are correct.

can it be, that older sip-phones are incompatible with pjsip? Grandstream GXP1610 for example.

Regards,
Gunther

They should work, do you have a full log from the cli and also can you run this?:

asterisk -x 'pjsip show transports'

See which por are you listening on and be sure you are using the same in your phone.

Hi,
asterisk -x 'pjsip show transports':

Transport:  <TransportId........>  <Type>  <cos>  <tos>  <BindAddress....................>
==========================================================================================

Transport:  0.0.0.0-udp               udp      3     96  0.0.0.0:5060

Objects found: 1

from fail2ban:

[2025-02-04 07:13:45] NOTICE[104579] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '78.XXX.XXX.XXX:16871' (callid: [email protected]) - Failed to authenticate

Asterisk core debug 5 does not show anything for extension 106, but for another telephone (181), which is connected and works:

Event: ChallengeResponseFailed
Privilege: security,all
EventTV: 2025-02-04T07:59:51.826+0000
Severity: Error
Service: PJSIP
EventVersion: 1
AccountID: 181
SessionID: [email protected]
LocalAddress: IPV4/UDP/212.XXX.XXX.XXX/5060
RemoteAddress: IPV4/UDP/78.XXX.XXX.XXX/62645
Challenge: 1738655991/729f079b6744cd9f077c798fd5bf95ba
Response: a08302de8a66308db625ef2232a5a426
ExpectedResponse:


now, that 181 is not working any more as well i ge in sngrep:

2025/02/04 10:28:58.687122 78.142.66.74:63215 -> 212.xxx.xxx.xxx:5060
REGISTER sip:ionos.xxx.at SIP/2.0
Via: SIP/2.0/UDP 192.168.103.120:5060;branch=z9hG4bK42463206770258600;rport
From: 181 <sip:[email protected]>;tag=6350660472
To: 181 <sip:[email protected]>
Call-ID: [email protected]
CSeq: 2 REGISTER
Contact: <sip:[email protected]:5060>
Authorization: Digest username="181", realm="asterisk", nonce="1738664938/cbe1182ebe6599a11fc16a1f0be913b2", uri="sip:ionos.xxx.at", response="5a00d9bd6a412c2b383f69979c3968b5", algorithm=MD5, cn
once="ebcb82d2", opaque="1b2b51637f08b9e2", qop=auth, nc=000adaa7
Max-Forwards: 70
Expires: 60
Supported: path
User-Agent: VoIP IP Phone 2.2.11 00a859eee5ae
Allow: INVITE, ACK, OPTIONS, BYE, CANCEL, REFER, NOTIFY, INFO, PRACK, UPDATE, MESSAGE
Content-Length: 0


2025/02/04 10:28:58.687598 212.227.101.170:5060 -> 78.142.66.74:63215
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.103.120:5060;rport=63215;received=78.142.66.74;branch=z9hG4bK42463206770258600
Call-ID: [email protected]
From: "181" <sip:[email protected]>;tag=6350660472
To: "181" <sip:[email protected]>;tag=z9hG4bK42463206770258600
CSeq: 2 REGISTER
WWW-Authenticate: Digest realm="asterisk",nonce="1738664938/cbe1182ebe6599a11fc16a1f0be913b2",opaque="4d3a47a578a4a531",algorithm=MD5,qop="auth"
Server: FPBX-17.0.19.23(22.1.0)

This shows an attempt to register by a device that has no password configured in it. The 401 is a request to verify knowledge of the password, and should be followed by a new REGISTER with authentication data. The lack of that authentication data indicates the registrant has no data to provide.

Strange. I switzched back to a previous version of asterisk and activated CHAN_SIP, now everything works fine…

I overlooked that you hadn’t provided the whole log. The “initial” request contains an Authentication header, so can’t actually be the initial request.

There is a bogus newline, between “cn” and “once”, in your log of the header, as sent by the phone. I don’t know if that is the result of how you have captured the log, or is real. If it is real, it would explain why Asterisk didn’t think there was a well formed header present, and rechallenged. Maybe the phone is buggy for long challenges.

Headers should only be broken on linear white space, and there should be at least one space, or tab, at the start of a continuation line.