FreePBX | Register | Issues | Wiki | Portal | Support

SIP Call without Authorization Header

asterisk
Tags: #<Tag:0x00007f749c689670>

(Daniel B) #1

Hello FreePBX community,
first of all, I would like to wish you all a happy new year!

And now to my problem.
I installed FreePBX to test some old SIP devices.

First of all, I created 2 Extensions (PJSIP) for X-Lite, to test the general function of my new PBX.
-> Works perfect!

My next goal was, to install the old SIP devices. The first challenge was, that they do not support a password.
-> I created a new PJSIP Extension without a “Secret”.

It still didn’t work, so I analyzed the TCP Dumps on my PBX.

When one X-Lite Notebook calls the other X-Lite Notebook, it looks like that:

  1. X-Lite sends INVITE without Authorization Header
  2. PBX answers 401 Unauthorized
  3. X-Lite ACKS the 401 Unauthorized and sends a new INVITE with Authorization Header
    -> Other side rings. As far as I understand SIP, this is absolutely normal.

Next step was, that I analyzed the TCP Dump of a call from my old SIP device. This looks like that:

  1. Device sends INVITE without Authorization Header
  2. PBX answers 401 Unauthorized
  3. Device ACKS the 401 Unauthorized
    -> Call does not work because device does not send the second INVITE.

I guess this means, that my device does not support a second INVITE.
So my question is, if it is possible, to make a call without the Authorization Header, since my device does not support that.

Thank you!


(Lorne Gaetz) #2

If you use chan_sip extensions without a SIP secret, they should work for you.

Until now, I had never tested a pjsip extension without a SIP secret, and I see the same thing. FreePBX generates an auth line for the endpoint even tho the secret is null, which causes the call to fail. Removing the auth line from the endpoint definition resolves this, but it’s not easily done by the end user. Since there are a non-zero quantity of SIP endpoints that don’t support authorization, so you may want to file a feature request for pjsip to support this.


(Daniel B) #3

I managed to do it by deleting the auth-part in the pjsip.endpoint.conf file.

I think this is really bad practice because it gets overwritten whenever I press the “Reload Config” button on the web interface.
I hope somebody knows a better way. the CHAN_SIP possibility did not work.


#4

What goes wrong? Did you remember to have the device send to port 5160 (or whatever you have bind port set to)?

Other options:
Set up your device as a pjsip trunk w/no registration or authentication. You’ll be able to make and receive calls, but you won’t have voicemail, follow-me, forwarding, DND, etc. What kind of device is this? A trunk might be more suitable.

Set it up as a custom extension and put the config in the pjsip custom config files.

Possibly, you can modify the existing config as shown in


(Daniel B) #5

What goes wrong? Did you remember to have the device send to port 5160 (or whatever you have bind port set to)?

The problem is, my device can’t change the port from 5060 to 5160.

Other options:
Set up your device as a pjsip trunk w/no registration or authentication.

That’s actually not the correct way. My devices are normal SIP telephones - They are just really old and they run bad firmware (No Authentication, not many options,…)

Set it up as a custom extension and put the config in the pjsip custom config files.
Possibly, you can modify the existing config as shown in

That sounds good! I will try that way.
Thank you!


(Daniel Friedman) #6

Hello @Daniel95,

Just reverse your PJSIP and SIP ports back to normal.
In that way The SIP will listen to port 5060 and the PJSIP will listen to port 5160.

This will solve your integration problems with your old devices.

Thank you,

Daniel Friedman
Trixton LTD.


(system) closed #7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.


(Lorne Gaetz) opened #8

(Daniel B) #9

Hello guys,

I now managed to switch CHAN_SIP to port 5060 now and configurated my extensions from PJSIP to CHAN_SIP.
I am actually able to call FROM the devices now. But I can’t call TO them.
I always get “503 service unavailable” with reason “Subscriber absent”. Do you know how I can fix that?

Thank you very much!


(Daniel B) #10

Sorry guys, I got it.
Just switched Qualify to “no”.

Thank you anyways!