Sipura/Linksys 3102 + PJSIP as Device / Extension

[nickpiggott]

Hello,

Here’s my setup:

• Sipura / Linksys / CISCO 3102 ATA
• FreePBX 15.0.16.49
• Asterisk 13.20.0
• Configured in “deviceanduser” mode
• Using chan_pjsip on port 5060 (chan_sip is disabled).

I am trying to configure the Line 1 of the ATA to act as an extension (device). The (relevant) Line 1 settings are:

Auth Invite : YES
Register : YES
Proxy Server : <ip address of my asterisk server>
User ID: 801
Password : <set to the password configured on FreePBX>

In FreePBX I’ve created a Device “801” using chan_pjsip listening on port 5060:

Device name: 801
Password : <set to the password configured on the ATA>
Device type : fixed
Default user : 202
all other settings as default

I am seeing a registration failure reported on the ATA. If I turn on the PJSIP logger on the Asterisk, I see this reported each time the ATA tries to register:

<--- Received SIP request (494 bytes) from UDP:{ata ip address}:5060 ---> 
REGISTER sip:{asterisk ip address} SIP/2.0 
Via: SIP/2.0/UDP {ata ip address}:5060;branch=z9hG4bK-d347b941
From: 202 <sip:801@{asterisk ip address}>;tag=2820ceb8c17ff4cco0 
To: 202 <sip:801@{asterisk ip address}>
Call-ID: 6454802f-d3bb98c3@{ata ip address} 
CSeq: 24423 REGISTER 
Max-Forwards: 70 
Contact: 202 <sip:801@{ata ip address}:5060>;expires=60 
User-Agent: Linksys/SPA3102-5.2.13(GW002)
Content-Length: 0
Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER
Supported: x-sipura, replaces

<--- Transmitting SIP response (364 bytes) to UDP:{ata ip address}:5060 --->
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP {ata ip address}:5060;rport=5060;received={ata ip address};branch=z9hG4bK-d347b941
Call-ID: 6454802f-d3bb98c3@{ata ip address} 
From: "202" <sip:801@{asterisk ip address}>;tag=2820ceb8c17ff4cco0 
To: "202" <sip:801@{asterisk ip address}>;tag=z9hG4bK-d347b941 
CSeq: 24423 REGISTER 
Server: FPBX-15.0.16.49(13.20.0) 
Content-Length:0 

This appears to be reporting (404) that it can’t find the device 801 on the asterisk server? I do note that the “From” and “To” fields are identical.

I also have this ATA configured on it’s PSTN phone side as a trunk to the same asterisk server, and that’s functioning OK (but it’s not trying to register with asterisk or accept registrations from asterisk).

Any ideas on what’s not working, or what I can do to get the ATA to register as a device? Most posts seem to say “give up, use chan_sip”.

Thanks

[cynjut (Dave Burgess)]

@nickpiggott

Most posts seem to say “give up, use chan_sip”.

Since Chan-SIP is destined to be deprecated (not depreciated, since it still has value) finding a way to do this through PJ-SIP is obviously the right choice. Simply relying on an artifact of the old Chan-SIP code doesn’t cut it.

Make sure you are sending the request to the right channel driver. If you are sending the request to the Chan-SIP port (5160, normally) and the device is defined in PJ-SIP, you’ll get a not found error like this.

Also, while the desire to set it up as a device might be strong, you may need to look at it as a trunk device instead of an actual endpoint. I’m not as familiar with the 3102 as I would like (having only watched people configure them here) but it seems to me that most people have had more luck with setting it up as a trunk endpoint.

The “right” way to trouble shoot it would be to connect it once via Chan-SIP and record all of the traffic between the two devices. Decode the conversation with sngrep (for example, there are other tools) so that you can see what each end is sharing back and forth. After that, do the same with PJ-SIP and look at the differences. Once you understand what the delta is, we should be able to help you with the advanced PJ-SIP settings to get you where you want to go.

[Stewart1 (Stewart)]

A limitation of SPA3102 (and similar Linksys, Obihai and Grandstream devices) is that caller ID on the FXO side can only be passed in the user part of the From header. This potentially conflicts with recognizing the FXS side by username. With chan_sip, the logically separate devices can be identified by IP address and port number. Unfortunately, pjsip does not take port number into account when identifying a device. It should be possible to use auth_username (see Endpoint Identifier Order in SIP Settings [chan_pjsip]).

However, I’ve never been able to make this work. There are several credible posts from other users who were successful, but the a**holes didn’t have the courtesy to post the solution.

Also, IMO you are pushing your luck with Asterisk 13, which is bundled with a pretty old version of pjsip. Try upgrading to 16 or 17.

And, device and user mode is not well supported and might also be contributing to your problem. As a test, try disabling Line 1 on the SPA, configuring another device as extension 801 and confirm that it registers and works properly.

If you can somehow find a working configuration for SPA3000, OBi110, OBi212, HT503 or HT813, the same concepts should apply to your device.

[nickpiggott]

Thanks for the tips, here’s what I’ve found:

• I can login 801 from a different device (softphone on laptop) so I’m fairly confident that the basic configuration on the asterisk side is correct
• I’ve changed the ordering of endpoint identifier to be auth-username / ip / username / anonymous / header, and set the 3102 to use “Auth-ID” in preference to User ID.

That hasn’t fixed the problem. I’m going to try a version bump of Asterisk to 17, and try again.

[nickpiggott]

SOLVED

So that I’m not that a**h*le who doesn’t share solutions, here’s an update.

As predicted, through some more grepping and debug, I noticed that the pjsip was spotting the IP address of the SPA3102 and assuming it was the trunk (FXO) trying to register, not the FXS

I have fixed the problem, by doing this:

In FreePBX / Trunk:

• Set the Authentication to “BOTH”
• Set the Registration to “RECEIVE”
• Set Match Inbound Authentication to “Auth_Username”

In FreePBX / SIP Settings / Chan_pjsip

• Set the Endpoint Identification Order to be auth_username, ip, username, anonymous, header

In the SPA3102 / PSTN Line :

• Set the Proxy to the Asterisk server IP address
• Set the Port to 5062
• Set Register to “YES”
• Set User ID and Auth ID to the name of the trunk in asterisk/FreePBX
• Set the Password to match the Secret in asterisk/FreePBX
• Set User Auth ID to YES

This forces the SPA3102 to register using a username with asterisk, and removes the IP address of the SPA3102 from the pjsip identify configuration. It won’t be looking for the IP address of the SPA3102 any more. You’ll see the PSTN section of the SPA3102 saying it’s registered.

In the FreePBX/Extension (or Device):

• Don’t do anything special. The “out of the box” config seems to work.

In the SPA 3102 Line 1 Configuration:

• In the Proxy put the address of the asterisk server
• Set the port to 5060
• Set Auth INVITE to NO
• Set Register to YES
• Set the User ID and Auth ID to be the same as the Extension / Device number
• Set the Password to be the same as the Secret in FreePBX/asterisk
• Set Use Auth ID to YES

Essentially this is not telling asterisk the IP address of the SPA3102, but forcing the SPA3102 to register both the trunk (FXO) and extension (FXS) separately with asterisk, and telling asterisk it needs to send auth to the SPA3102 when it wants to create an outbound session.

Now I can:

• Receive calls from the PSTN (FXO) into Asterisk
• Send calls to the PSTN (FXO) from Asterisk
• Send calls from the Extension (FXS) into Asterisk
• Receive calls from Asterisk onto the Extension (FXS)

There was an outstanding problem, which was fixed directly after I posted this. For context, I’ll leave the description of the problem here:

When I try and call the extension (the FXS) from Asterisk, I get this error:

res_pjsip_outbound_authenticator_digest.c: Endpoint: '801': Unable to create request with auth. No auth credentials for realm(s) '<asterisk server IP>' in challenge.

I don’t know what to do to rectify that, but I’ll keep looking and update here if I find it.

[Stewart1 (Stewart)]

@nickpiggott

res_pjsip_outbound_authenticator_digest.c: Endpoint: ‘801’: Unable to create request with auth. No auth credentials for realm(s) ‘<asterisk server IP>’ in challenge.

Many thanks for the update.

Interesting. If I take that at face value, the PBX got a 401 or 407 response to an INVITE sent to the SPA. But AFAIK the SPA doesn’t even have an option to authenticate incoming INVITEs on Line 1.

At the Asterisk command prompt, type
pjsip set logger on
make a test call to the extension, paste the relevant portion of the Asterisk log at https://pastebin.freepbx.org and post the link here.

[nickpiggott]

That was the hint I needed to find a fix.

There’s a setting on Line 1 called “Auth INVITE”, which was set to YES. I changed that to NO, and now I can dial that extension.

Thank you. It’s all working - calls originating and terminating on both the FXS as a device, and FXO as a trunk, both using pjsip.

I’ll update the details in my earlier posting to give the whole solution.