[asterisk-users] 401 Unauthorized with Snom but not with Zoiper softphone

[Jonas Kellens]

Hello,

I'm having difficulty with registering a SIP account in a Snom 320
IP-phone. This is what sip debug tells me :


[Oct 7 13:28:42] VERBOSE[20314] chan_sip.c: [Oct 7 13:28:42]
<--- SIP read from UDP:public_ip:58697 --->
REGISTER sip:sip.domain.tld SIP/2.0
Via: SIP/2.0/UDP 192.168.114.200:2048;branch=z9hG4bK-vj1xvbdnp4dw;rport
From: <sip:***@sip.domain.tld>;tag=sd2b3o74zc
To: <sip:***@sip.domain.tld>
Call-ID: 3c28a76e73cf-gp9nioi8zdci
CSeq: 12 REGISTER
Max-Forwards: 70
Contact:
<sip:***@192.168.114.200:2048;line=nagqjxpx>;reg-id=1;q=1.0;+sip.instance="<urn:uuid:8d4403c1-af97-4139-b535-de7d460a9187>";audio;mobility="fix
ed";duplex="full";description="snom320";actor="principal";events="dialog";methods="INVITE,ACK,CANCEL,BYE,REFER,OPTIONS,NOTIFY,SUBSCRIBE,PRACK,MESSAGE,INFO"
User-Agent: snom320/8.4.18
Allow-Events: dialog
X-Real-IP: 192.168.114.200
Supported: path, gruu
Expires: 3600
Content-Length: 0


<------------->
[Oct 7 13:28:42] VERBOSE[20314] chan_sip.c: [Oct 7 13:28:42] --- (14
headers 0 lines) ---
[Oct 7 13:28:42] VERBOSE[20314] chan_sip.c: [Oct 7 13:28:42] Sending
to 192.168.114.200 : 2048 (no NAT)
[Oct 7 13:28:42] VERBOSE[20314] chan_sip.c: [Oct 7 13:28:42]
<--- Transmitting (NAT) to public_ip:58697 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP
192.168.114.200:2048;branch=z9hG4bK-vj1xvbdnp4dw;received=public_ip;rport=58697
From: <sip:***@sip.domain.tld>;tag=sd2b3o74zc
To: <sip:***@sip.domain.tld>;tag=as6108a7e2
Call-ID: 3c28a76e73cf-gp9nioi8zdci
CSeq: 12 REGISTER
Server: Asterisk PBX 1.6.2.10
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="domain.tld", nonce="398aee1e"
Content-Length: 0


I would expect the Snom to try a second register, this time with some
type of nonce. But there is just 1 REGISTER and 1 Unauthorized and
that's it...

Other Snom phones with SIP-accounts go very well, but at this location
the registration fails.

Another remark : when using a Zoiper softphone, the registration goes
very well :


REGISTER sip:sip.domain.tld;transport=UDP SIP/2.0
Via: SIP/2.0/UDP
192.168.114.20:5060;branch=z9hG4bK-d8754z-fab4a5effbf90a05-1---d8754z-
Max-Forwards: 70
Contact:
<sip:***@public_ip:51363;rinstance=b6fd38105c91b9bf;transport=UDP>
To: <sip:***@sip.domain.tld;transport=UDP>
From: <sip:***@sip.domain.tld;transport=UDP>;tag=db1a5018
Call-ID: NzBlZDMyN2U0YTEzZDk4Y2M2N2NmNzMxYTk4OWUxYTY.
CSeq: 1 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO,
SUBSCRIBE
User-Agent: Zoiper rev.7797
Allow-Events: presence, kpml
Content-Length: 0


<------------->
[Oct 7 13:46:52] VERBOSE[20314] chan_sip.c: [Oct 7 13:46:52] --- (13
headers 0 lines) ---
[Oct 7 13:46:52] VERBOSE[20314] chan_sip.c: [Oct 7 13:46:52] Sending
to 192.168.114.20 : 5060 (no NAT)
[Oct 7 13:46:52] VERBOSE[20314] chan_sip.c: [Oct 7 13:46:52]
<--- Transmitting (NAT) to public_ip:51363 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP
192.168.114.20:5060;branch=z9hG4bK-d8754z-fab4a5effbf90a05-1---d8754z-;received=public_ip
From: <sip:***@sip.domain.tld;transport=UDP>;tag=db1a5018
To: <sip:***@sip.domain.tld;transport=UDP>;tag=as2fcfde3c
Call-ID: NzBlZDMyN2U0YTEzZDk4Y2M2N2NmNzMxYTk4OWUxYTY.
CSeq: 1 REGISTER
Server: Asterisk PBX 1.6.2.10
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="domain.tld", nonce="7833b268"
Content-Length: 0

REGISTER sip:sip.domain.tld;transport=UDP SIP/2.0
Via: SIP/2.0/UDP
192.168.114.20:5060;branch=z9hG4bK-d8754z-fdd59e394f9c23b9-1---d8754z-
Max-Forwards: 70
Contact:
<sip:***@public_ip:51363;rinstance=b6fd38105c91b9bf;transport=UDP>
To: <sip:***@sip.domain.tld;transport=UDP>
From: <sip:***@sip.domain.tld;transport=UDP>;tag=db1a5018
Call-ID: NzBlZDMyN2U0YTEzZDk4Y2M2N2NmNzMxYTk4OWUxYTY.
CSeq: 2 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO,
SUBSCRIBE
User-Agent: Zoiper rev.7797
Authorization: Digest
username="test3",realm="domain.tld",nonce="7833b268",uri="sip:sip.domain.tld;transport=UDP",response="198f6262248fb11fe6cb55408a1cb8ce",algorithm=MD5
Allow-Events: presence, kpml
Content-Length: 0


SIP/2.0 200 OK
Via: SIP/2.0/UDP
192.168.114.20:5060;branch=z9hG4bK-d8754z-fdd59e394f9c23b9-1---d8754z-;received=public_ip
From: <sip:***@sip.domain.tld;transport=UDP>;tag=db1a5018
To: <sip:***@sip.domain.tld;transport=UDP>;tag=as2fcfde3c
Call-ID: NzBlZDMyN2U0YTEzZDk4Y2M2N2NmNzMxYTk4OWUxYTY.
CSeq: 2 REGISTER
Server: Asterisk PBX 1.6.2.10
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
Expires: 60
Contact:
<sip:***@public_ip:51363;rinstance=b6fd38105c91b9bf;transport=UDP>;expires=60
Date: Thu, 07 Oct 2010 11:46:52 GMT
Content-Length: 0


It's the same account, the same password, but other agent.

Can anyone help me with this please ?! I see no difference but there
must be !!


Kind regards,
Jonas.

[Daniel Tryba]

Post by Jonas Kellens
It's the same account, the same password, but other agent.
Can anyone help me with this please ?! I see no difference but there
must be !!

The difference is the SNOM is using rport and Zoiper isn't. Is nat for
this client set to 'yes' or something else?

[Daniel Tryba]

Post by Daniel Tryba

Post by Jonas Kellens
It's the same account, the same password, but other agent.
Can anyone help me with this please ?! I see no difference but there
must be !!

The difference is the SNOM is using rport and Zoiper isn't. Is nat for
this client set to 'yes' or something else?

Wanted to say more before sending:
this might indicate a broken nat sip helper so the responses never get
to the snom. You should check the inside traffic to the snom.

[Jonas Kellens]

Post by Daniel Tryba

Post by Daniel Tryba

Post by Jonas Kellens
It's the same account, the same password, but other agent.
Can anyone help me with this please ?! I see no difference but there
must be !!

The difference is the SNOM is using rport and Zoiper isn't. Is nat for
this client set to 'yes' or something else?

this might indicate a broken nat sip helper so the responses never get
to the snom. You should check the inside traffic to the snom

And I wanted to add that it is possible to make outbound calls, but
because the phone is not registered receiving calls is not possible...


Jonas.

[Jonas Kellens]

Post by Daniel Tryba

Post by Daniel Tryba

Post by Jonas Kellens
It's the same account, the same password, but other agent.
Can anyone help me with this please ?! I see no difference but there
must be !!

The difference is the SNOM is using rport and Zoiper isn't. Is nat for
this client set to 'yes' or something else?

this might indicate a broken nat sip helper so the responses never get
to the snom. You should check the inside traffic to the snom.

This is a REGISTER from the sip trace of the Snom 320 IP-phone :

REGISTER sip:sip.domain.tld SIP/2.0
Via: SIP/2.0/UDP 192.168.114.200:2049;branch=z9hG4bK-od9b7c0ekamp;rport
From: <sip:***@sip.domain.tld>;tag=vub2zjtmv2
To: <sip:***@sip.domain.tld>
Call-ID: 3c26701f88d8-6i37fwkca22u
CSeq: 46 REGISTER
Max-Forwards: 70
Contact:
<sip:***@192.168.114.200:2049;line=c38yvjnm>;reg-id=1;q=1.0;+sip.instance="<urn:uuid:0c5bc641-5821-4562-a514-f9e81d97c118>";audio;mobility="fixed";duplex="full";description="snom320";actor="principal";events="dialog";methods="INVITE,ACK,CANCEL,BYE,REFER,OPTIONS,NOTIFY,SUBSCRIBE,PRACK,MESSAGE,INFO"

User-Agent: snom320/8.4.18
Allow-Events: dialog
X-Real-IP: 192.168.114.200
Supported: path, gruu
Expires: 3600
Content-Length: 0


and indeed there is no ACK or 200 OK to this REGISTER...

Kind regards,

Jonas.

[Jonas Kellens]

Post by Daniel Tryba

Post by Jonas Kellens
It's the same account, the same password, but other agent.
Can anyone help me with this please ?! I see no difference but there
must be !!

The difference is the SNOM is using rport and Zoiper isn't. Is nat for
this client set to 'yes' or something else?

Even when I mark the option in the Zoiper softphone to use rport, the
registration still goes fine... With or without rport... Registration
succeeds. But meanwhile, the Snom is still not registering...


Jonas.

[Jonas Kellens]

Hello !

Thank you very much for your quick answer !!

nat=yes is set as a global parameter and also in the realtime MySQL
sip_buddies database I have for every peer nat=yes.

I then find it very strange that when placing these Snom phones in my
environment (for configuration) work very well, and then when I hook
them up at the site there is trouble with nat. I'm also behind nat here...

I do not find an rport-parameter in the snom's webinterface...


Jonas.

Post by Daniel Tryba

Post by Jonas Kellens
It's the same account, the same password, but other agent.
Can anyone help me with this please ?! I see no difference but there
must be !!

The difference is the SNOM is using rport and Zoiper isn't. Is nat for
this client set to 'yes' or something else?

[Daniel Tryba]

Post by Jonas Kellens
nat=yes is set as a global parameter and also in the realtime MySQL
sip_buddies database I have for every peer nat=yes.
I then find it very strange that when placing these Snom phones in my
environment (for configuration) work very well, and then when I hook
them up at the site there is trouble with nat. I'm also behind nat here...

I have never seen this problem before with Snom M3 and different routers
(Linux/Cisco or stupid SpeedTouches) without any
connection NAT helpers for SIP enabled. I'd say you should try the
difference values for nat to see if one works with the NAT gateway or
use STUN like suggested elsewhere.

[Jonas Kellens]

Post by Daniel Tryba

Post by Jonas Kellens
nat=yes is set as a global parameter and also in the realtime MySQL
sip_buddies database I have for every peer nat=yes.
I then find it very strange that when placing these Snom phones in my
environment (for configuration) work very well, and then when I hook
them up at the site there is trouble with nat. I'm also behind nat here...

I have never seen this problem before with Snom M3 and different routers
(Linux/Cisco or stupid SpeedTouches) without any
connection NAT helpers for SIP enabled. I'd say you should try the
difference values for nat to see if one works with the NAT gateway or
use STUN like suggested elsewhere.

What STUN-server can I use then ?! Asterisk is no STUN-server I guess
and is there then something like a public STUN-server ?!

I have never experienced problems with NAT...

The different options for nat are :
nat=yes|no|never|route
Correct ?!

Some extra information : when using TELNET to my public Asterisk server
on port 5060, then there is no response. This means that the answer is
blocked somewhere, right ?! Maybe on ISP-level ?! Is that plausible ?!


Jonas.

[Jonas Kellens]

Hello,

there is a really great difference in the Via-header of the
REGISTER-message between the Zoiper and the Snom.
Also the Zoiper has a Contact-header, and the Snom REGISTER has not...

Snom :

REGISTER sip:sip.domain.tld SIP/2.0
_*Via: SIP/2.0/UDP 192.168.114.200:2049;branch=z9hG4bK-p4ayhthezdr6;rport*_
From: <sip:***@sip.domain.tld>;tag=d85nzjmkpk
To: <sip:***@sip.domain.tld>
Call-ID: 3c26701f88d8-6i37fwkca22u
CSeq: 9 REGISTER
Max-Forwards: 70
Contact:
<sip:***@192.168.114.200:2049;line=c38yvjnm>;reg-id=1;q=1.0;+sip.instance="<urn:uuid:0c5bc641-5821-4562-a514-f9e81d97c118>";audio;mobility="fixed";duplex="full";description="snom320";actor="principal";events="dialog";methods="INVITE,ACK,CANCEL,BYE,REFER,OPTIONS,NOTIFY,SUBSCRIBE,PRACK,MESSAGE,INFO"
User-Agent: snom320/8.4.18
Allow-Events: dialog
X-Real-IP: 192.168.114.200
Supported: path, gruu
Expires: 3600
Content-Length: 0


SIP/2.0 401 Unauthorized
_*Via: SIP/2.0/UDP
192.168.114.200:2049;branch=z9hG4bK-p4ayhthezdr6;received=public_ip;rport=64646*_
From: <sip:***@sip.domain.tld>;tag=d85nzjmkpk
To: <sip:***@sip.domain.tld>;tag=as21294ace
Call-ID: 3c26701f88d8-6i37fwkca22u
CSeq: 9 REGISTER
Server: Asterisk PBX 1.6.2.10
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="domain.tld", nonce="120e4f10"
Content-Length: 0


Zoiper :

REGISTER sip:sip.domain.tld;transport=UDP SIP/2.0
_*Via: SIP/2.0/UDP
public_ip:59096;branch=z9hG4bK-d8754z-83ebdbc32d0fb2e0-1---d8754z-;rport*_
Max-Forwards: 70
_*Contact:
<sip:***@public_ip:59096;rinstance=d6dc257201b6ffa2;transport=UDP>*_
To: <sip:***@sip.domain.tld;transport=UDP>
From: <sip:***@sip.domain.tld;transport=UDP>;tag=5a50ca11
Call-ID: NjY2MmY3NjRkNDRlOWJhOGQ2NzgyNzg4Y2M5ZGFlZjE.
CSeq: 1 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO,
SUBSCRIBE
User-Agent: Zoiper rev.7797
Allow-Events: presence, kpml
Content-Length: 0


SIP/2.0 401 Unauthorized
_*Via: SIP/2.0/UDP
public_ip:59096;branch=z9hG4bK-d8754z-83ebdbc32d0fb2e0-1---d8754z-;received=public_ip;rport=59095*_
From: <sip:***@sip.domain.tld;transport=UDP>;tag=5a50ca11
To: <sip:***@sip.domain.tld;transport=UDP>;tag=as1640cd46
Call-ID: NjY2MmY3NjRkNDRlOWJhOGQ2NzgyNzg4Y2M5ZGFlZjE.
CSeq: 1 REGISTER
Server: Asterisk PBX 1.6.2.10
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="domain.tld", nonce="08277195"
Content-Length: 0


Is that why Asterisk is not able to send the 401 or the 200 ??

Anyone knows if there is a special setting in the Snom 320 or Asterisk
itself to overcome this issue ?!


Jonas.

[Philipp von Klitzing]

Hi!

I'm having difficulty with registering a SIP account in a Snom 320 IP-
phone.

Do a SIP trace on your SNOM phone, and you will most probably see that
the 401 reply of Asterisk does not arrive on the phone. Then check your
STUN/ICE settings on the phone in combination with the nat= settings in
sip.conf on Asterisk.

BTW: Are you happy with firmware 8.4.18? I still stick to 7.3.30 for the
3xx models.

Philipp

[Jonas Kellens]

Post by Philipp von Klitzing
Hi!

I'm having difficulty with registering a SIP account in a Snom 320 IP-
phone.

Do a SIP trace on your SNOM phone, and you will most probably see that
the 401 reply of Asterisk does not arrive on the phone. Then check your
STUN/ICE settings on the phone in combination with the nat= settings in
sip.conf on Asterisk.
BTW: Are you happy with firmware 8.4.18? I still stick to 7.3.30 for the
3xx models.
Philipp

Hello,

I don't really need the version 8 firmware, but I install it because it
is the most recent...

The SIP trace of the SNOM indeed does not show any answer to the
REGISTER being sent (the SIP trace consists of only REGISTER-statements...)


I have no STUN/ICE settings filled in.

Is it possible I need STUN/ICE for the Snom 320 but not for the Zoiper
softphone ???

The strange thing in this story is : Snom 320 receives no 200OK, but
registration with the Zoiper softphone on a computer on the same LAN
(connected to the PC port of the SNOM) works fine !!


Jonas.