Registation String - Chan_SIP

FreePBX Providers
, , ,
1

I try configure my ISP (Vodafone PT) to work with chan_pjsip using as a reference old working configuration from chan_sip:

OUTBOUND
type=peer
disallow=all
nat=yes
host=ims.vodafone.pt
fromdomain=ims.vodafone.pt
outboundproxy=proxythomson.ims.vodafone.pt
insecure=port,invite
qualify=250
username=+351XXXXXXXXX
fromuser=+351XXXXXXXXX
auth=+351XXXXXXXXX
secret="acesss id"
canreinvite=yes
allow=ulaw,alaw
directmedia=yes
context=from-trunk

INBOUND

Register String : +351XXXXXXXXX:"access id"@ims.vodafone.pt/+351XXXXXXXX

With this I get my Outbound Call working, but when I called back never works I get called failed on my phone after looking at the logs I found out I getting a 401 Unathorized, and also find out that the missing configuration for Inbound might be Register String but the `chan_psjsip not allow to sent that options (or option change name).

Here are the logs part the fails:

<--- Transmitting SIP response (571 bytes) to UDP:ip:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP ip:5060;rport=5060;received=ip;branch=z9hG4bK5lo940200855pjf4i6m0.1
Call-ID: SD7og4401-37ae6e5964042cb3aed019b7c8b516cb-lm7mjd2010
From: <sip:[email protected]>;tag=SD7og4401-688df101-175986433550946232748
To: <sip:[email protected]>;tag=z9hG4bK5lo940200855pjf4i6m0.1
CSeq: 1 INVITE
WWW-Authenticate: Digest realm="asterisk",nonce="1759864335/f07a1f56c68e6e808089a0b23173b0c2",opaque="037bcf65172b2a75",algorithm=MD5,qop="auth"
Server: FPBX-17.0.21(22.5.2)
Content-Length:  0
2

If you are sending 401, either the registration worked, or they don’t need registration. I think you are going to need a new title.

Your log starts too late; it needs to start before the incoming INVITE. Also we really need to see what your configuration is.

You will be sending 401 either because you haven’t recognized them, or because you have recognized them and have inbound authentication enabled; providers just don’t authenticate themselves by SIP means.

3

I changed the subject of the post, PJSIP doesn’t have registration strings and what is shown in a chan_sip peer configuration.

4

Chan_sip doesn’t exist in Asterisk 22. Not sure why you are using that config.

1 Like
5

Ok thanks for the help. Here it goes a the configuration and logs.
I also forget to say. If I disable Inbound the call get reach my can my server, since the operator says “The number you dial is unavailable…” and then Hang up the call.

Trunk Configuration

Trunk Endpoint

[+351XXXXXXXXX]
type=endpoint
transport=0.0.0.0-udp
context=from-ims
disallow=all
allow=ulaw,alaw,gsm,g726,g722,opus
aors=+351XXXXXXXXX
send_connected_line=no
rtp_keepalive=0
language=en_GB
outbound_proxy=sip:proxythomson.ims.vodafone.pt:5060
outbound_auth=+351XXXXXXXXX
auth=+351XXXXXXXXX
from_domain=ims.vodafone.pt
from_user=+351XXXXXXXXX
user_eq_phone=yes
t38_udptl=no
t38_udptl_ec=none
fax_detect=yes
trust_id_inbound=no
t38_udptl_nat=no
identify_by=auth_username
direct_media=no
rtp_symmetric=yes
dtmf_mode=auto

Aor

[+351XXXXXXXXX]
type=aor
qualify_frequency=60
contact=sip:[email protected]:5060
outbound_proxy=sip:proxythomson.ims.vodafone.pt:5060

Auth

[+351XXXXXXXXX]
type=auth
auth_type=userpass
password=access_id
username=+351XXXXXXXXX

Registration

[+351XXXXXXXXX]
type=registration
transport=0.0.0.0-udp
outbound_auth=+351XXXXXXXXX
retry_interval=90
fatal_retry_interval=30
forbidden_retry_interval=30
max_retries=10000
expiration=3600
auth_rejection_permanent=no
line=yes
endpoint=+351XXXXXXXXX
server_uri=sip:ims.vodafone.pt:5060
client_uri=sip:[email protected]:5060
outbound_proxy=sip:proxythomson.ims.vodafone.pt:5060

Indentify

[+351XXXXXXXXX]
type=identify
endpoint=+351XXXXXXXXX
match=ims.vodafone.pt

Full Logs from a Call

My phone try to establish a call 2 time beforing giving any error (Called Failed).

<--- Transmitting SIP request (573 bytes) to UDP:ip_redated:5060 --->
OPTIONS sip:proxythomson.ims.vodafone.pt:5060 SIP/2.0
Via: SIP/2.0/UDP publicip_redated:5060;rport;branch=z9hG4bKPja8b07b44-1f0a-4631-9f3f-46885a22949f
From: <sip:[email protected]>;tag=a59006dc-557d-4f16-9501-941d35ce7c0b
To: <sip:[email protected]>
Contact: <sip:+351XXXXXXXXX@publicip_redated:5060>
Call-ID: c2aad30a-85ca-4d95-87e7-952531b20990
CSeq: 45970 OPTIONS
Route: <sip:proxythomson.ims.vodafone.pt:5060>
Route: <sip:[email protected]:5060;user=phone>
Max-Forwards: 70
User-Agent: FPBX-17.0.21(22.5.2)
Content-Length:  0


<--- Received SIP response (421 bytes) from UDP:ip_redated:5060 --->
SIP/2.0 405 Method Not Allowed
Via: SIP/2.0/UDP publicip_redated:5060;received=10.7.25.14;branch=z9hG4bKPja8b07b44-1f0a-4631-9f3f-46885a22949f;rport=14601
From: <sip:[email protected]>;tag=a59006dc-557d-4f16-9501-941d35ce7c0b
To: <sip:[email protected]>;tag=aprqngfrt-54b2ub000oc59
Call-ID: c2aad30a-85ca-4d95-87e7-952531b20990
CSeq: 45970 OPTIONS
Allow: INVITE,ACK,BYE,REGISTER,CANCEL,PRACK


<--- Received SIP request (1535 bytes) from UDP:ip_redated:5060 --->
INVITE sip:s@publicip_redated:5060;line=owtmoga SIP/2.0
Via: SIP/2.0/UDP ip_redated:5060;branch=z9hG4bK9r9vaj30e873lur7lq80.1
To: <sip:[email protected]>
From: <sip:<my_number>@ims.vodafone.pt>;tag=SDe8hq301-688df101-175986788238121932757
Call-ID: SDe8hq301-7c7b36929021dcc21646e178952ce3cf-lm7mjd2
CSeq: 1 INVITE
Max-Forwards: 68
Content-Length: 463
Contact: <sip:B2BUA@ip_redated:5060;transport=udp>;+g.3gpp.accesstype="cellular";+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel";+sip.instance="<urn:gsma:imei:35784685-053139-0>"
Content-Type: application/sdp
Allow: ACK, BYE, CANCEL, INFO, INVITE, MESSAGE, NOTIFY, OPTIONS, PRACK, REFER, REGISTER, SUBSCRIBE, UPDATE
Accept-Contact: *;+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel"
Supported: 100rel, path, precondition, replaces, timer
P-Asserted-Identity: <sip:<my_number>@ims.mnc001.mcc268.3gppnetwork.org>
P-Asserted-Identity: <tel:<my_number>>
Session-Expires: 21720
Min-SE: 21720
P-Called-Party-ID: <sip:[email protected]>
P-Early-Media: supported

v=0
o=- 697374990 103278277 IN IP4 ip_redated
s=-
c=IN IP4 ip_redated
t=0 0
a=sendrecv
m=audio 21268 RTP/AVP 9 8 18 100
b=AS:128
b=RS:525
b=RR:1575
a=rtpmap:9 G722/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=yes
a=rtpmap:100 telephone-event/8000
a=fmtp:100 0-15
a=maxptime:40
a=sendrecv
a=des:qos mandatory local sendrecv
a=curr:qos local none
a=des:qos optional remote sendrecv
a=curr:qos remote none
a=ptime:20

<--- Transmitting SIP response (568 bytes) to UDP:ip_redated:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP ip_redated:5060;rport=5060;received=ip_redated;branch=z9hG4bK9r9vaj30e873lur7lq80.1
Call-ID: SDe8hq301-7c7b36929021dcc21646e178952ce3cf-lm7mjd2
From: <sip:<my_number>@ims.vodafone.pt>;tag=SDe8hq301-688df101-175986788238121932757
To: <sip:[email protected]>;tag=z9hG4bK9r9vaj30e873lur7lq80.1
CSeq: 1 INVITE
WWW-Authenticate: Digest realm="asterisk",nonce="1759867882/ddccd69e17d1220de697d39335de478b",opaque="002667bb55668ac3",algorithm=MD5,qop="auth"
Server: FPBX-17.0.21(22.5.2)
Content-Length:  0


<--- Received SIP request (396 bytes) from UDP:ip_redated:5060 --->
ACK sip:s@publicip_redated:5060;line=owtmoga SIP/2.0
Via: SIP/2.0/UDP ip_redated:5060;branch=z9hG4bK9r9vaj30e873lur7lq80.1
CSeq: 1 ACK
To: <sip:[email protected]>;tag=z9hG4bK9r9vaj30e873lur7lq80.1
From: <sip:<my_number>@ims.vodafone.pt>;tag=SDe8hq301-688df101-175986788238121932757
Call-ID: SDe8hq301-7c7b36929021dcc21646e178952ce3cf-lm7mjd2
Max-Forwards: 68
Content-Length: 0


<--- Received SIP request (1369 bytes) from UDP:ip_redated:5060 --->
INVITE sip:s@publicip_redated:5060;line=owtmoga SIP/2.0
Via: SIP/2.0/UDP ip_redated:5060;branch=z9hG4bK37g1d9004862v0pp6qg0.1
To: <sip:[email protected]>
From: <sip:<my_number>@ims.vodafone.pt>;tag=SDegi8401-688df101-175986788569435432762
Call-ID: SDegi8401-bb9676505ccf6c37ab8305c66b4ed27f-lm7mjd2
CSeq: 1 INVITE
Max-Forwards: 68
Content-Length: 345
Contact: <sip:B2BUA@ip_redated:5060;transport=udp>;+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel"
Content-Type: application/sdp
Allow: ACK, BYE, CANCEL, INVITE, NOTIFY, OPTIONS, PRACK, REFER, REGISTER, SUBSCRIBE, UPDATE
Accept: application/sdp
Accept-Contact: *;+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel"
Supported: 100rel, histinfo, timer
P-Asserted-Identity: <sip:<my_number>@ims.mnc001.mcc268.3gppnetwork.org>
P-Asserted-Identity: <tel:<my_number>>
Resource-Priority: q735.4
Privacy: none
Session-Expires: 21720
Min-SE: 21720
P-Called-Party-ID: <sip:[email protected]>
P-Early-Media: supported

v=0
o=- 569211161 103608298 IN IP4 ip_redated
s=-
c=IN IP4 ip_redated
t=0 0
a=sendrecv
m=audio 29902 RTP/AVP 9 8 18 100
c=IN IP4 ip_redated
b=RR:1125
b=RS:375
a=rtpmap:9 G722/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:100 telephone-event/8000
a=fmtp:100 0-15
a=maxptime:40
a=ptime:20

<--- Transmitting SIP response (568 bytes) to UDP:ip_redated:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP ip_redated:5060;rport=5060;received=ip_redated;branch=z9hG4bK37g1d9004862v0pp6qg0.1
Call-ID: SDegi8401-bb9676505ccf6c37ab8305c66b4ed27f-lm7mjd2
From: <sip:<my_number>@ims.vodafone.pt>;tag=SDegi8401-688df101-175986788569435432762
To: <sip:[email protected]>;tag=z9hG4bK37g1d9004862v0pp6qg0.1
CSeq: 1 INVITE
WWW-Authenticate: Digest realm="asterisk",nonce="1759867885/a845a9c246a8822b34fd0d7d32319b9f",opaque="486651ae2c4bf5d7",algorithm=MD5,qop="auth"
Server: FPBX-17.0.21(22.5.2)
Content-Length:  0


<--- Received SIP request (396 bytes) from UDP:ip_redated:5060 --->
ACK sip:s@publicip_redated:5060;line=owtmoga SIP/2.0
Via: SIP/2.0/UDP ip_redated:5060;branch=z9hG4bK37g1d9004862v0pp6qg0.1
CSeq: 1 ACK
To: <sip:[email protected]>;tag=z9hG4bK37g1d9004862v0pp6qg0.1
From: <sip:<my_number>@ims.vodafone.pt>;tag=SDegi8401-688df101-175986788569435432762
Call-ID: SDegi8401-bb9676505ccf6c37ab8305c66b4ed27f-lm7mjd2
Max-Forwards: 68
Content-Length: 0
6

I know it dosen’t exist :slight_smile:.
But the only working configuration that I have available as guide is from 2020.
Here is the source (in portuguese): https://forum.zwame.pt/threads/freepbx-vodafone.1056382/post-16704816

7

You’re trying to auth the inbound calls. You don’t use auth and outbound_auth on the same endpoint because it can cause problems like this. Remove the inbound auth and try again.

8

Decide to duplicate the endpoints in and one for inbound and other for outbound but have the same problem.

9

This will force Asterisk to send 401, but no normal ITSP will act on it. No normal ITSP will use your account number in the authorisation, because they won’t send an authorisation, so there is no reason for them to even know a auth userid in your direction

For a normal ITSP, you would need a type=identify that matches by IP address on ip_redated.

Also, the direct translation of outbound proxy from chan_sip is to prepend it with “sip:” and append “\;lr\;hide”. chan_pjsip handles this parameter as though it had arrived in a Record-Route header, hence the “;lr”, for loose routing. The “;hide” is a hack to stop actual Route headers being sent, and the "\"s are because this ends up in an Asterisk .conf file, where a bare semicolon starts a comment.. This will only hit you when you start making outbound calls, unless they actually support the old style Route headers.

10

This will also force the sending of 401, and again no normal ITSP will authenticate to you in SIP (they may do in TLS), although, in this case, it won’t get that far; it will just know that at least one endpoint needs to authenticate before the actual endpoint can be selected.

Your current type=identify won’t work, because you have told Asterisk only to use auth userid for identification. Also, for it to work, id_redated would have to be 213.30.59.131. There is generally no point in redacting ITSP source addresses, as they have to be public knowledge for people to be able to set up firewalls correctly.

11

Yes you assumption is mostly correct the IP is 213.30.59.133.
Being fare I a bit new to Voip stuff so I just redacted the IP just to be safe.
What options you would recommend to solve this problem.
I even try set the authentication method to Receive/None and this time I get the Operator voice of my ISP saying the number you are tying to call is not available.

Funny enough my FreePBX server fully disable my phone that is directly connect to my isp router (I have a double NAT setup in my home no bridge mode available)

12

Add this to the match field in the pjsip settings

13

And remove the setting to match on auth_userid.

14

Can you please let me know when you resolve this? I also have an Vodafone phone line in Cascais that is on SIP that I’ll need to convert to PJSIP. Obrigado.

15

@david55

So I added 213.30.59.133/24 to the match field:

#include pjsip.identify_custom.conf
[+351XXXXXXXXX]
type=identify
endpoint=+351XXXXXXXXX
match=213.30.59.133/24

and remove the auth_username from identify_by but still getting unathorized.
Sorry for the long time to answer back.

This is the debug output when I call from my mobile phone to it, the same debug logs repeat two times before the call fail:

<--- Received SIP request (1539 bytes) from UDP:213.30.59.133:5060 --->
INVITE sip:s@myip:5060;line=senkois SIP/2.0
Via: SIP/2.0/UDP 213.30.59.133:5060;branch=z9hG4bKme8v0t103g4dc1etlvk0.1
To: <sip:[email protected]>
From: <sip:[email protected]>;tag=SD8h1i601-67da11d2-176167531212612830951
Call-ID: SD8h1i601-4d05e09176b7d48ad388c47ab777ae02-lm7mjd2000
CSeq: 1 INVITE
Max-Forwards: 68
Content-Length: 464
Contact: <sip:[email protected]:5060;transport=udp>;+g.3gpp.accesstype="cellular";+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel";+sip.instance="<urn:gsma:imei:35784685-053139-0>"
Content-Type: application/sdp
Allow: ACK, BYE, CANCEL, INFO, INVITE, MESSAGE, NOTIFY, OPTIONS, PRACK, REFER, REGISTER, SUBSCRIBE, UPDATE
Accept-Contact: *;+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel"
Supported: 100rel, path, precondition, replaces, timer
P-Asserted-Identity: <sip:[email protected]>
P-Asserted-Identity: <tel:XXXXXXXXX>
Session-Expires: 21720
Min-SE: 21720
P-Called-Party-ID: <sip:[email protected]>
P-Early-Media: supported

v=0
o=- 3922421779 157624469 IN IP4 213.30.59.133
s=-
c=IN IP4 213.30.59.133
t=0 0
a=sendrecv
m=audio 26206 RTP/AVP 9 8 18 100
b=AS:128
b=RS:525
b=RR:1575
a=rtpmap:9 G722/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=yes
a=rtpmap:100 telephone-event/8000
a=fmtp:100 0-15
a=maxptime:40
a=sendrecv
a=des:qos mandatory local sendrecv
a=curr:qos local none
a=des:qos optional remote sendrecv
a=curr:qos remote none
a=ptime:20

<--- Transmitting SIP response (573 bytes) to UDP:213.30.59.133:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 213.30.59.133:5060;rport=5060;received=213.30.59.133;branch=z9hG4bKme8v0t103g4dc1etlvk0.1
Call-ID: SD8h1i601-4d05e09176b7d48ad388c47ab777ae02-lm7mjd2000
From: <sip:[email protected]>;tag=SD8h1i601-67da11d2-176167531212612830951
To: <sip:[email protected]>;tag=z9hG4bKme8v0t103g4dc1etlvk0.1
CSeq: 1 INVITE
WWW-Authenticate: Digest realm="asterisk",nonce="1761675312/29f0d53a6d8f36b52fff804cb5af30d1",opaque="54d0e6a25915e5f7",algorithm=MD5,qop="auth"
Server: FPBX-17.0.21.2(22.5.2)
Content-Length:  0


<--- Received SIP request (399 bytes) from UDP:213.30.59.133:5060 --->
ACK sip:s@myip:5060;line=senkois SIP/2.0
Via: SIP/2.0/UDP 213.30.59.133:5060;branch=z9hG4bKme8v0t103g4dc1etlvk0.1
CSeq: 1 ACK
To: <sip:[email protected]>;tag=z9hG4bKme8v0t103g4dc1etlvk0.1
From: <sip:[email protected]>;tag=SD8h1i601-67da11d2-176167531212612830951
Call-ID: SD8h1i601-4d05e09176b7d48ad388c47ab777ae02-lm7mjd2000
Max-Forwards: 68
Content-Length: 0
16

This is asking it to authenticate itself, but I don’t know of any provider that will actually do that. As a result you are sending 401, but the provider has nothing it can give you.

17

But I having a problem, even if I remove it and manually restart freepbx from cli the auth comes back. Maybe I doing something wrong, because im the gui auth and auth_username are grey out and are using the trunk name (I using the same trunk for inbound and outbound).

18

Normally this would be in a file that only FreePBX has the right to update. If you are getting both it will because you have set the trunk to bothway authentication, when providers need either outbound only, or none.

19

Ok that makes sense. I try to use the pjsip_custom_post.conf to add inbound manually.
This is the config I use:

; =========================
; VodafonePT Inbound
; =========================

[+351XXXXXXXXX]
type=endpoint
context=from-ims
disallow=all
allow=ulaw,alaw,gsm,g726,g722,opus
aors=+351XXXXXXXXX
send_connected_line=no
rtp_keepalive=0
language=en_GB
user_eq_phone=yes
t38_udptl=no
t38_udptl_ec=none
fax_detect=yes
trust_id_inbound=yes
direct_media=no
rtp_symmetric=yes
dtmf_mode=auto
identify_by=ip

[+351XXXXXXXXX]
type=aor
max_contacts=1
qualify_frequency=60

[+351XXXXXXXXX]
type=identify
endpoint=+351XXXXXXXXX
match=213.30.59.133

But still no luck the endpoint says unavailable:

 Endpoint:  +351XXXXXXXXX                                        Unavailable   0 of inf
        Aor:  +351XXXXXXXXX                                      1
   Identify:  +351XXXXXXXXX/+351XXXXXXXXX
        Match: 213.30.59.133/32
20

Ok get everthing working, setting the trunk only authentication to outbound in the solve it, (I miss-understanding everything. Weird enough I need to reboot my freepbx VM after applying the config.
I also need to change the context to from-pstn-toheader for inbound route, since the INVITE with from-trunk send my public ip instead of the number.

I really want to thanks @BlazeStudios and @david55 for the help, and sorry for all my confusion during the configuration.

Here is the working configuration(@GGCoffee):

Trunk Endpoint

type=endpoint
transport=0.0.0.0-udp
context=from-pstn-toheader
disallow=all
allow=opus,ulaw,alaw,gsm,g726,g722
aors=+351XXXXXXXXX
send_connected_line=no
rtp_keepalive=0
language=en_GB
outbound_proxy=sip:proxythomson.ims.vodafone.pt:5060\;lr\;hide
outbound_auth=+351XXXXXXXXX
from_domain=ims.vodafone.pt
from_user=+351XXXXXXXXX
user_eq_phone=no
t38_udptl=no
t38_udptl_ec=none
fax_detect=yes
trust_id_inbound=no
t38_udptl_nat=no
rewrite_contact=yes
rtp_symmetric=yes
dtmf_mode=auto

Aor

[+351XXXXXXXXX]
type=aor
qualify_frequency=250
contact=sip:[email protected]:5060
outbound_proxy=sip:proxythomson.ims.vodafone.pt:5060

Registration

[+351XXXXXXXXX]
type=registration
transport=0.0.0.0-udp
outbound_auth=+351215854072
retry_interval=90
fatal_retry_interval=30
forbidden_retry_interval=30
max_retries=10000
expiration=3600
auth_rejection_permanent=no
line=yes
endpoint=+351XXXXXXXXX
server_uri=sip:ims.vodafone.pt:5060
client_uri=sip:[email protected]:5060
outbound_proxy=sip:proxythomson.ims.vodafone.pt:5060\;lr\;hide

Indentify

[+351XXXXXXXXX]
type=identify
endpoint=+351XXXXXXXXX
match=213.30.59.133

Inbound Rule

image