UCP phone fails due to secure audio issue

The exact error message is:
[2017-12-01 11:37:46] WARNING[51426][C-00000001]: chan_sip.c:10840 process_sdp: Can’t provide secure audio requested in SDP offer

I am running freepbx from the distro, patched to the latest (non-edge) modules and system updates. CertMan is upgraded to the latest edge in order to get the Let’s Encrypt cert working.

The UCP phone registers and looks fine, but upon dialing any number, I get the above error message. I am logged in via https using chrome and it is happy with the cert, so I think my encryption is working fine. For regular phone extensions I am using pjsip and that is working. The UCP phone appears to be registering as a chan_sip client. Other audio in the browser is working fine (listening to visual voicemail, for instance).

I do notice some weirdness in the sip debugs. There are IP addresses that don’t make sense to me as they don’t exist on my network. I see my local network (a 10. network). The 192.168 network addresses don’t make sense to me as those won’t be on my network. The XXX.YYY.175.2 addresses are a public IP we have, but that is the standard public IP for things that don’t have a 1:1 nat in our firewall. The freepbx box is at XXX.YYY.175.20 and that is what is set in the web interface.

I haven’t included the sip debugs as right now it is blocking me from posting links as I am a new user. I will try to figure out what I need to delete to be able to post them.

Hopefully this isn’t too much info right off the bat. Would love to get this working, but I just can’t see my error. Any tips on what to check would be great.

Oh, I think it will let me post the links now. This is the sip debug:

The 10.3.xxx.yyy addresses are my local network. 192.168.xxx.yyy addresses don’t exist on my network and the XXX.YYY.175.2 address is my obfuscated public IP address for most things, but the pbx is actually at XXX.YYY.175.20.

I have also obfuscated my domain, changing it to my.domain in the logs.

<— SIP read from WS:10.3.10.9:18522 —>
INVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/WSS 9fp14v8h7nbk.invalid;branch=z9hG4bK5239608
Max-Forwards: 70
To: sip:[email protected]
From: sip:[email protected];tag=bjd08b470f
Call-ID: frimpkok3kef466uk3t8
CSeq: 2703 INVITE
Contact: sip:[email protected];transport=wss;ob
Allow: ACK,CANCEL,INVITE,MESSAGE,BYE,OPTIONS,INFO,NOTIFY,REFER
Supported: outbound
User-Agent: SIP.js/0.7.7
Content-Type: application/sdp
Content-Length: 2717

v=0
o=- 8679546475544982994 2 IN IP4 127.0.0.1
s=-
t=0 0
a=group:BUNDLE audio
a=msid-semantic: WMS cXZ9Y3aduLzQgMX296RLCkc4F1f0u17NSsjl
m=audio 62654 UDP/TLS/RTP/SAVPF 111 103 104 9 0 8 106 105 13 110 112 113 126
c=IN IP4 XXX.YYY.175.2
a=rtcp:62657 IN IP4 XXX.YYY.175.2
a=candidate:1649457969 1 udp 2122260223 192.168.118.1 62653 typ host generation 0 network-id 1
a=candidate:3108074105 1 udp 2122194687 10.3.10.9 62654 typ host generation 0 network-id 2
a=candidate:2668124891 1 udp 2122129151 192.168.133.1 62655 typ host generation 0 network-id 3
a=candidate:1649457969 2 udp 2122260222 192.168.118.1 62656 typ host generation 0 network-id 1
a=candidate:3108074105 2 udp 2122194686 10.3.10.9 62657 typ host generation 0 network-id 2
a=candidate:2668124891 2 udp 2122129150 192.168.133.1 62658 typ host generation 0 network-id 3
a=candidate:4224486641 2 udp 1685987070 XXX.YYY.175.2 62657 typ srflx raddr 10.3.10.9 rport 62657 generation 0 network-id 2
a=candidate:4224486641 1 udp 1685987071 XXX.YYY.175.2 62654 typ srflx raddr 10.3.10.9 rport 62654 generation 0 network-id 2
a=candidate:752043969 1 tcp 1518280447 192.168.118.1 9 typ host tcptype active generation 0 network-id 1
a=candidate:4156722825 1 tcp 1518214911 10.3.10.9 9 typ host tcptype active generation 0 network-id 2
a=candidate:3515590187 1 tcp 1518149375 192.168.133.1 9 typ host tcptype active generation 0 network-id 3
a=candidate:752043969 2 tcp 1518280446 192.168.118.1 9 typ host tcptype active generation 0 network-id 1
a=candidate:4156722825 2 tcp 1518214910 10.3.10.9 9 typ host tcptype active generation 0 network-id 2
a=candidate:3515590187 2 tcp 1518149374 192.168.133.1 9 typ host tcptype active generation 0 network-id 3
a=ice-ufrag:kTrU
a=ice-pwd:KXFcYkJO2DfbNdD5FOjWOl/L
a=ice-options:trickle
a=fingerprint:sha-256 1F:50:47:A2:BD:54:91:E5:D2:52:4A:8A:62:3D:0D:C8:CB:CF:D9:77:E0:08:46:3B:84:B2:14:EC:B3:6F:8E:79
a=setup:actpass
a=mid:audio
a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
a=sendrecv
a=rtcp-mux
a=rtpmap:111 opus/48000/2
a=rtcp-fb:111 transport-cc
a=fmtp:111 minptime=10;useinbandfec=1
a=rtpmap:103 ISAC/16000
a=rtpmap:104 ISAC/32000
a=rtpmap:9 G722/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:106 CN/32000
a=rtpmap:105 CN/16000
a=rtpmap:13 CN/8000
a=rtpmap:110 telephone-event/48000
a=rtpmap:112 telephone-event/32000
a=rtpmap:113 telephone-event/16000
a=rtpmap:126 telephone-event/8000
a=ssrc:1488189495 cname:DNEqvTKzwyuGpZcB
a=ssrc:1488189495 msid:cXZ9Y3aduLzQgMX296RLCkc4F1f0u17NSsjl f06e17e1-1e6b-4dcd-9a59-62367b3bb7dc
a=ssrc:1488189495 mslabel:cXZ9Y3aduLzQgMX296RLCkc4F1f0u17NSsjl
a=ssrc:1488189495 label:f06e17e1-1e6b-4dcd-9a59-62367b3bb7dc
<------------->
— (13 headers 51 lines) —
Using INVITE request as basis request - frimpkok3kef466uk3t8
Found peer ‘99518208’ for ‘99518208’ from 10.3.10.9:18522

<— Reliably Transmitting (no NAT) to 10.3.10.9:5060 —>
SIP/2.0 401 Unauthorized
Via: SIP/2.0/WSS 9fp14v8h7nbk.invalid;branch=z9hG4bK5239608;received=10.3.10.9
From: sip:[email protected];tag=bjd08b470f
To: sip:[email protected];tag=as20fb3f9f
Call-ID: frimpkok3kef466uk3t8
CSeq: 2703 INVITE
Server: FPBX-14.0.1.20(13.18.1)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="26215776"
Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘frimpkok3kef466uk3t8’ in 6400 ms (Method: INVITE)

<— SIP read from WS:10.3.10.9:18522 —>
ACK sip:[email protected] SIP/2.0
Via: SIP/2.0/WSS 9fp14v8h7nbk.invalid;branch=z9hG4bK5239608
To: sip:[email protected];tag=as20fb3f9f
From: sip:[email protected];tag=bjd08b470f
Call-ID: frimpkok3kef466uk3t8
Content-Length: 0
CSeq: 2703 ACK

<------------->
— (7 headers 0 lines) —

<— SIP read from WS:10.3.10.9:18522 —>
INVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/WSS 9fp14v8h7nbk.invalid;branch=z9hG4bK3956648
Max-Forwards: 70
To: sip:[email protected]
From: sip:[email protected];tag=bjd08b470f
Call-ID: frimpkok3kef466uk3t8
CSeq: 2704 INVITE
Authorization: Digest algorithm=MD5, username=“99518208”, realm=“asterisk”, nonce=“26215776”, uri=“sip:[email protected]”, response="f796e64c23c7b0eb019f25ca04546d2a"
Contact: sip:[email protected];transport=wss;ob
Allow: ACK,CANCEL,INVITE,MESSAGE,BYE,OPTIONS,INFO,NOTIFY,REFER
Supported: outbound
User-Agent: SIP.js/0.7.7
Content-Type: application/sdp
Content-Length: 2717

v=0
o=- 8679546475544982994 2 IN IP4 127.0.0.1
s=-
t=0 0
a=group:BUNDLE audio
a=msid-semantic: WMS cXZ9Y3aduLzQgMX296RLCkc4F1f0u17NSsjl
m=audio 62654 UDP/TLS/RTP/SAVPF 111 103 104 9 0 8 106 105 13 110 112 113 126
c=IN IP4 XXX.YYY.175.2
a=rtcp:62657 IN IP4 XXX.YYY.175.2
a=candidate:1649457969 1 udp 2122260223 192.168.118.1 62653 typ host generation 0 network-id 1
a=candidate:3108074105 1 udp 2122194687 10.3.10.9 62654 typ host generation 0 network-id 2
a=candidate:2668124891 1 udp 2122129151 192.168.133.1 62655 typ host generation 0 network-id 3
a=candidate:1649457969 2 udp 2122260222 192.168.118.1 62656 typ host generation 0 network-id 1
a=candidate:3108074105 2 udp 2122194686 10.3.10.9 62657 typ host generation 0 network-id 2
a=candidate:2668124891 2 udp 2122129150 192.168.133.1 62658 typ host generation 0 network-id 3
a=candidate:4224486641 2 udp 1685987070 XXX.YYY.175.2 62657 typ srflx raddr 10.3.10.9 rport 62657 generation 0 network-id 2
a=candidate:4224486641 1 udp 1685987071 XXX.YYY.175.2 62654 typ srflx raddr 10.3.10.9 rport 62654 generation 0 network-id 2
a=candidate:752043969 1 tcp 1518280447 192.168.118.1 9 typ host tcptype active generation 0 network-id 1
a=candidate:4156722825 1 tcp 1518214911 10.3.10.9 9 typ host tcptype active generation 0 network-id 2
a=candidate:3515590187 1 tcp 1518149375 192.168.133.1 9 typ host tcptype active generation 0 network-id 3
a=candidate:752043969 2 tcp 1518280446 192.168.118.1 9 typ host tcptype active generation 0 network-id 1
a=candidate:4156722825 2 tcp 1518214910 10.3.10.9 9 typ host tcptype active generation 0 network-id 2
a=candidate:3515590187 2 tcp 1518149374 192.168.133.1 9 typ host tcptype active generation 0 network-id 3
a=ice-ufrag:kTrU
a=ice-pwd:KXFcYkJO2DfbNdD5FOjWOl/L
a=ice-options:trickle
a=fingerprint:sha-256 1F:50:47:A2:BD:54:91:E5:D2:52:4A:8A:62:3D:0D:C8:CB:CF:D9:77:E0:08:46:3B:84:B2:14:EC:B3:6F:8E:79
a=setup:actpass
a=mid:audio
a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
a=sendrecv
a=rtcp-mux
a=rtpmap:111 opus/48000/2
a=rtcp-fb:111 transport-cc
a=fmtp:111 minptime=10;useinbandfec=1
a=rtpmap:103 ISAC/16000
a=rtpmap:104 ISAC/32000
a=rtpmap:9 G722/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:106 CN/32000
a=rtpmap:105 CN/16000
a=rtpmap:13 CN/8000
a=rtpmap:110 telephone-event/48000
a=rtpmap:112 telephone-event/32000
a=rtpmap:113 telephone-event/16000
a=rtpmap:126 telephone-event/8000
a=ssrc:1488189495 cname:DNEqvTKzwyuGpZcB
a=ssrc:1488189495 msid:cXZ9Y3aduLzQgMX296RLCkc4F1f0u17NSsjl f06e17e1-1e6b-4dcd-9a59-62367b3bb7dc
a=ssrc:1488189495 mslabel:cXZ9Y3aduLzQgMX296RLCkc4F1f0u17NSsjl
a=ssrc:1488189495 label:f06e17e1-1e6b-4dcd-9a59-62367b3bb7dc
<------------->
— (14 headers 51 lines) —
Using INVITE request as basis request - frimpkok3kef466uk3t8
Found peer ‘99518208’ for ‘99518208’ from 10.3.10.9:18522
Found RTP audio format 111
Found RTP audio format 103
Found RTP audio format 104
Found RTP audio format 9
Found RTP audio format 0
Found RTP audio format 8
Found RTP audio format 106
Found RTP audio format 105
Found RTP audio format 13
Found RTP audio format 110
Found RTP audio format 112
Found RTP audio format 113
Found RTP audio format 126
Found audio description format opus for ID 111
Found unknown media description format ISAC for ID 103
Found unknown media description format ISAC for ID 104
Found audio description format G722 for ID 9
Found audio description format PCMU for ID 0
Found audio description format PCMA for ID 8
Found unknown media description format CN for ID 106
Found unknown media description format CN for ID 105
Found audio description format CN for ID 13
Found unknown media description format telephone-event for ID 110
Found unknown media description format telephone-event for ID 112
Found unknown media description format telephone-event for ID 113
Found audio description format telephone-event for ID 126
[2017-12-01 11:37:46] WARNING[51426][C-00000001]: chan_sip.c:10840 process_sdp: Can’t provide secure audio requested in SDP offer

<— Reliably Transmitting (no NAT) to 10.3.10.9:5060 —>
SIP/2.0 488 Not acceptable here
Via: SIP/2.0/WSS 9fp14v8h7nbk.invalid;branch=z9hG4bK3956648;received=10.3.10.9
From: sip:[email protected];tag=bjd08b470f
To: sip:[email protected];tag=as20fb3f9f
Call-ID: frimpkok3kef466uk3t8
CSeq: 2704 INVITE
Server: FPBX-14.0.1.20(13.18.1)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘frimpkok3kef466uk3t8’ in 6400 ms (Method: INVITE)

<— SIP read from WS:10.3.10.9:18522 —>
ACK sip:[email protected] SIP/2.0
Via: SIP/2.0/WSS 9fp14v8h7nbk.invalid;branch=z9hG4bK3956648
To: sip:[email protected];tag=as20fb3f9f
From: sip:[email protected];tag=bjd08b470f
Call-ID: frimpkok3kef466uk3t8
Content-Length: 0
CSeq: 2704 ACK

<------------->
— (7 headers 0 lines) —
Really destroying SIP dialog ‘frimpkok3kef466uk3t8’ Method: ACK