[asterisk-users] Incoming side of SIP trunk does not work unless I add "insecure=very"

Discussion:

Frank Bulk - iName.com

2009-01-06 00:24:42 UTC

The incoming (Class 5 switch to Asterisk PBX) side of a SIP trunk does not
work unless I add "insecure=very" to my "Outgoing settings", but I don't
want to do that. I do want to authenticate. Outgoing (Asterisk PBX to
Class 5 switch) calls do authenticate and work.

The Nortel CS 1500 I'm using as the PSTN-side of my SIP trunk has a username
and password that it's sending out. But the INVITE is responded by the
Asterisk with "SIP/2.0 403 Forbidden"

I've changed the INVITE message to mask the real telephone numbers, SIP
server, passwords, and IP addresses, but I did that using search and replace
so the structure is intact.

What do I need to configure in the "Incoming Settings" panel for the CS
1500's INVITE to my Asterisk server to work? I've tried all kinds of
combinations of user,username,authname using +15552027020,host with IP
and/or DNS name, but nothing appears to work.

Frank

INVITE message from Wireshark packet capture:

INVITE sip:+***@sip.acme.com SIP/2.0
From:
<sip:***@172.16.10.40>;tag=f76c66d0-c7784528-13c4-2dbba4-767e6552-2db
ba4
To: <sip:+***@sip.acme.com>
Call-ID: f379f62-29173-3895-b14271f5-40802-***@172.16.10.40
CSeq: 5102 INVITE
Via: SIP/2.0/UDP 172.16.10.40:5060;branch=z9hG4bK-2dbba4-b2a4fa3a-7cd7598
User-Agent: Nortel CS1500UA/v02.00.REL01
Accept: application/sdp
P-Asserted-Identity: <sip:***@172.16.10.40;user=phone>
Privacy: none
Remote-Party-ID: <sip:***@172.16.10.40;user=phone>; party=calling;
privacy=off
Max-Forwards: 70
Supported: 100rel,replaces
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, REFER, PRACK
Contact: <sip:***@172.16.10.40>
Authorization: Digest
username="username",realm="asterisk",nonce="118af2b0",uri="sip:+15552027020@
sip.acme.com",response="111e63ec2a1f3ebabefe4f7dae4087a1",algorithm=MD5
Content-Type: application/SDP
Content-Length: 167

v=0
o=- 2973921782 2973921782 IN IP4 172.16.10.65
s=SIP Call
c=IN IP4 172.16.10.65
t=0 0
m=audio 36224 RTP/AVP 0
a=rtpmap:0 PCMU/8000
a=ptime:20
a=sendrecv

Alex Balashov

2009-01-06 01:03:48 UTC

Permalink

Is sip.acme.com actually the domain you want to use?

Keep in mind the domain is part of the digest authentication process and
is a factor in the encoding of the nonce.

Post by Frank Bulk - iName.com
The incoming (Class 5 switch to Asterisk PBX) side of a SIP trunk does not
work unless I add "insecure=very" to my "Outgoing settings", but I don't
want to do that. I do want to authenticate. Outgoing (Asterisk PBX to
Class 5 switch) calls do authenticate and work.
The Nortel CS 1500 I'm using as the PSTN-side of my SIP trunk has a username
and password that it's sending out. But the INVITE is responded by the
Asterisk with "SIP/2.0 403 Forbidden"
I've changed the INVITE message to mask the real telephone numbers, SIP
server, passwords, and IP addresses, but I did that using search and replace
so the structure is intact.
What do I need to configure in the "Incoming Settings" panel for the CS
1500's INVITE to my Asterisk server to work? I've tried all kinds of
combinations of user,username,authname using +15552027020,host with IP
and/or DNS name, but nothing appears to work.
Frank
ba4
CSeq: 5102 INVITE
Via: SIP/2.0/UDP 172.16.10.40:5060;branch=z9hG4bK-2dbba4-b2a4fa3a-7cd7598
User-Agent: Nortel CS1500UA/v02.00.REL01
Accept: application/sdp
Privacy: none
privacy=off
Max-Forwards: 70
Supported: 100rel,replaces
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, REFER, PRACK
Authorization: Digest
sip.acme.com",response="111e63ec2a1f3ebabefe4f7dae4087a1",algorithm=MD5
Content-Type: application/SDP
Content-Length: 167
v=0
o=- 2973921782 2973921782 IN IP4 172.16.10.65
s=SIP Call
c=IN IP4 172.16.10.65
t=0 0
m=audio 36224 RTP/AVP 0
a=rtpmap:0 PCMU/8000
a=ptime:20
a=sendrecv
_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
asterisk-users mailing list
http://lists.digium.com/mailman/listinfo/asterisk-users

--
Alex Balashov
Evariste Systems
Web : http://www.evaristesys.com/
Tel : (+1) (678) 954-0670
Direct : (+1) (678) 954-0671
Mobile : (+1) (678) 237-1775

Frank Bulk

2009-01-06 02:47:18 UTC

Permalink

Well, it's not "acme.com", but another domain. That information about the
encoding process of the nonce is helpful to know.

Do I need to specify the context to be "sip.acme.com"? Where is that
"acme.com" specified in the trunk configuration?

Frank

-----Original Message-----
From: Alex Balashov [mailto:***@evaristesys.com]
Sent: Monday, January 05, 2009 7:04 PM
To: ***@iname.com; Asterisk Users Mailing List - Non-Commercial
Discussion
Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

Is sip.acme.com actually the domain you want to use?

Keep in mind the domain is part of the digest authentication process and
is a factor in the encoding of the nonce.

--
Alex Balashov
Evariste Systems
Web : http://www.evaristesys.com/
Tel : (+1) (678) 954-0670
Direct : (+1) (678) 954-0671
Mobile : (+1) (678) 237-1775

Andres

2009-01-06 01:43:00 UTC

Permalink

Do a sip debug on the asterisk console and see if it is actually is
matching one of your sip.conf entries during an invite from the CS1500.
Look for a line that says something like 'Found Peer....bla bla bla'.
If you dont see that line, then you are not even adding the correct
sip.conf entry to match the invite from the CS1500.

Andres
http://www.telesip.net

Post by Frank Bulk - iName.com
Frank
ba4
CSeq: 5102 INVITE
Via: SIP/2.0/UDP 172.16.10.40:5060;branch=z9hG4bK-2dbba4-b2a4fa3a-7cd7598
User-Agent: Nortel CS1500UA/v02.00.REL01
Accept: application/sdp
Privacy: none
privacy=off
Max-Forwards: 70
Supported: 100rel,replaces
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, REFER, PRACK
Authorization: Digest
sip.acme.com",response="111e63ec2a1f3ebabefe4f7dae4087a1",algorithm=MD5
Content-Type: application/SDP
Content-Length: 167
v=0
o=- 2973921782 2973921782 IN IP4 172.16.10.65
s=SIP Call
c=IN IP4 172.16.10.65
t=0 0
m=audio 36224 RTP/AVP 0
a=rtpmap:0 PCMU/8000
a=ptime:20
a=sendrecv
_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
asterisk-users mailing list
http://lists.digium.com/mailman/listinfo/asterisk-users

Frank Bulk

2009-01-06 03:25:09 UTC

Permalink

This is what I have in my configuration now:

[ACME]
host=sip.acme.com
username=username
secret=password
type=friend

I've done a SIP debug before, but I've done it again with the above
configuration:
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
after which "SIP/2.0 401 Unauthorized" is issued after the un-authenticated
INVITE and "SIP/2.0 403 Forbidden" after the authenticated INVITE.

When I add "insecure=very", this is what the SIP debug shows:
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
Found RTP audio format 0
Peer audio RTP is at port 172.16.10.65:36272
Found audio description format PCMU for ID 0
Capabilities: us - 0xc (ulaw|alaw), peer - audio=0x4
(ulaw)/video=0x0 (nothing)/text=0x0 (nothing), combined - 0x4 (ulaw)
Non-codec capabilities (dtmf): us - 0x1 (telephone-event), peer -
0x0 (nothing), combined - 0x0 (nothing)
Peer audio RTP is at port 172.16.10.65:36272
Looking for +15552127020 in from-sip-external (domain sip.acme.com)
list_route: hop: <sip:***@172.16.10.40>

It isn't very clear (to me) from the success how the "insecure=very" helps.

Frank

-----Original Message-----
From: Andres [mailto:***@telesip.net]
Sent: Monday, January 05, 2009 7:43 PM
To: ***@iname.com; Asterisk Users Mailing List - Non-Commercial
Discussion
Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

Post by Frank Bulk - iName.com
Frank

Post by Frank Bulk - iName.com
ba4
CSeq: 5102 INVITE
Via: SIP/2.0/UDP 172.16.10.40:5060;branch=z9hG4bK-2dbba4-b2a4fa3a-7cd7598
User-Agent: Nortel CS1500UA/v02.00.REL01
Accept: application/sdp
Privacy: none
privacy=off
Max-Forwards: 70
Supported: 100rel,replaces
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, REFER, PRACK
Authorization: Digest
username="username",realm="asterisk",nonce="118af2b0",uri="sip:+15552027020

Post by Frank Bulk - iName.com
sip.acme.com",response="111e63ec2a1f3ebabefe4f7dae4087a1",algorithm=MD5
Content-Type: application/SDP
Content-Length: 167
v=0
o=- 2973921782 2973921782 IN IP4 172.16.10.65
s=SIP Call
c=IN IP4 172.16.10.65
t=0 0
m=audio 36224 RTP/AVP 0
a=rtpmap:0 PCMU/8000
a=ptime:20
a=sendrecv
_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
asterisk-users mailing list
http://lists.digium.com/mailman/listinfo/asterisk-users

Allan Dib

2009-01-06 03:41:12 UTC

Permalink

Try it by IP address instead of hostname as reverse DNS may not be
resolving. e.g. host=123.123.123.123

Post by Frank Bulk
[ACME]
host=sip.acme.com
username=username
secret=password
type=friend
I've done a SIP debug before, but I've done it again with the above
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
after which "SIP/2.0 401 Unauthorized" is issued after the un-authenticated
INVITE and "SIP/2.0 403 Forbidden" after the authenticated INVITE.
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
Found RTP audio format 0
Peer audio RTP is at port 172.16.10.65:36272
Found audio description format PCMU for ID 0
Capabilities: us - 0xc (ulaw|alaw), peer - audio=0x4
(ulaw)/video=0x0 (nothing)/text=0x0 (nothing), combined - 0x4 (ulaw)
Non-codec capabilities (dtmf): us - 0x1 (telephone-event), peer -
0x0 (nothing), combined - 0x0 (nothing)
Peer audio RTP is at port 172.16.10.65:36272
Looking for +15552127020 in from-sip-external (domain sip.acme.com)
It isn't very clear (to me) from the success how the "insecure=very" helps.
Frank
-----Original Message-----
Sent: Monday, January 05, 2009 7:43 PM
Discussion
Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

username

Post by Frank Bulk - iName.com
and password that it's sending out. But the INVITE is responded by the
Asterisk with "SIP/2.0 403 Forbidden"
I've changed the INVITE message to mask the real telephone numbers, SIP
server, passwords, and IP addresses, but I did that using search and

replace

Post by Frank Bulk - iName.com
so the structure is intact.
What do I need to configure in the "Incoming Settings" panel for the CS
1500's INVITE to my Asterisk server to work? I've tried all kinds of
combinations of user,username,authname using +15552027020,host with IP
and/or DNS name, but nothing appears to work.

Post by Frank Bulk - iName.com
Frank
;tag=f76c66d0-c7784528-13c4-2dbba4-767e6552-2d

Post by Frank Bulk - iName.com
ba4
CSeq: 5102 INVITE
Via: SIP/2.0/UDP 172.16.10.40:5060;branch=z9hG4bK-2dbba4-b2a4fa3a-7cd7598
User-Agent: Nortel CS1500UA/v02.00.REL01
Accept: application/sdp

;user=phone>

Post by Frank Bulk - iName.com
Privacy: none

party=calling;

Post by Frank Bulk - iName.com
privacy=off
Max-Forwards: 70
Supported: 100rel,replaces
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, REFER, PRACK
Authorization: Digest
username="username",realm="asterisk",nonce="118af2b0",uri="sip:+15552027020

--
Personal Development Without The Silly Stuff: http://AllanDib.com

Frank Bulk

2009-01-06 03:50:51 UTC

Permalink

I tried that before, but I just tried it again. Unfortunately, the same
thing:

No user '5551236049' in SIP users list

Found peer 'ACME' for '5551236049' from 172.16.10.40:5060

[ACME]
host=172.16.10.40
username=username
secret=password
type=friend

Frank

From: asterisk-users-***@lists.digium.com
[mailto:asterisk-users-***@lists.digium.com] On Behalf Of Allan Dib
Sent: Monday, January 05, 2009 9:41 PM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

Try it by IP address instead of hostname as reverse DNS may not be
resolving. e.g. host=123.123.123.123

On Tue, Jan 6, 2009 at 2:25 PM, Frank Bulk <***@iname.com> wrote:

This is what I have in my configuration now:

[ACME]
host=sip.acme.com
username=username
secret=password
type=friend

I've done a SIP debug before, but I've done it again with the above
configuration:
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
after which "SIP/2.0 401 Unauthorized" is issued after the un-authenticated
INVITE and "SIP/2.0 403 Forbidden" after the authenticated INVITE.

When I add "insecure=very", this is what the SIP debug shows:
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
Found RTP audio format 0
Peer audio RTP is at port 172.16.10.65:36272
Found audio description format PCMU for ID 0
Capabilities: us - 0xc (ulaw|alaw), peer - audio=0x4
(ulaw)/video=0x0 (nothing)/text=0x0 (nothing), combined - 0x4 (ulaw)
Non-codec capabilities (dtmf): us - 0x1 (telephone-event), peer -
0x0 (nothing), combined - 0x0 (nothing)
Peer audio RTP is at port 172.16.10.65:36272
Looking for +15552127020 in from-sip-external (domain sip.acme.com)
list_route: hop: <sip:***@172.16.10.40
<mailto:sip%***@172.16.10.40> >

It isn't very clear (to me) from the success how the "insecure=very" helps.

Frank

-----Original Message-----
From: Andres [mailto:***@telesip.net]
Sent: Monday, January 05, 2009 7:43 PM
To: ***@iname.com; Asterisk Users Mailing List - Non-Commercial
Discussion

Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

Post by Frank Bulk - iName.com
Frank
;tag=f76c66d0-c7784528-13c4-2dbba4-767e6552-2d

--
Personal Development Without The Silly Stuff: http://AllanDib.com

Grygoriy Dobrovolskyy

2009-01-06 08:12:02 UTC

Permalink

try do add

fromdomain=acme.com/sip.acme.com
fromhost=acme.com/sip.acme.com

Post by Frank Bulk
I tried that before, but I just tried it again. Unfortunately, the same
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
[ACME]
host=172.16.10.40
username=username
secret=password
type=friend
Frank
*Sent:* Monday, January 05, 2009 9:41 PM
*To:* Asterisk Users Mailing List - Non-Commercial Discussion
*Subject:* Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"
Try it by IP address instead of hostname as reverse DNS may not be
resolving. e.g. host=123.123.123.123
[ACME]
host=sip.acme.com
username=username
secret=password
type=friend
I've done a SIP debug before, but I've done it again with the above
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
after which "SIP/2.0 401 Unauthorized" is issued after the un-authenticated
INVITE and "SIP/2.0 403 Forbidden" after the authenticated INVITE.
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
Found RTP audio format 0
Peer audio RTP is at port 172.16.10.65:36272
Found audio description format PCMU for ID 0
Capabilities: us - 0xc (ulaw|alaw), peer - audio=0x4
(ulaw)/video=0x0 (nothing)/text=0x0 (nothing), combined - 0x4 (ulaw)
Non-codec capabilities (dtmf): us - 0x1 (telephone-event), peer -
0x0 (nothing), combined - 0x0 (nothing)
Peer audio RTP is at port 172.16.10.65:36272
Looking for +15552127020 in from-sip-external (domain sip.acme.com)
It isn't very clear (to me) from the success how the "insecure=very" helps.
Frank
-----Original Message-----
Sent: Monday, January 05, 2009 7:43 PM
Discussion
Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

username

replace

Post by Frank Bulk - iName.com
Frank
;tag=f76c66d0-c7784528-13c4-2dbba4-767e6552-2d

Post by Frank Bulk - iName.com
ba4
CSeq: 5102 INVITE
Via: SIP/2.0/UDP 172.16.10.40:5060;branch=z9hG4bK-2dbba4-b2a4fa3a-7cd7598
User-Agent: Nortel CS1500UA/v02.00.REL01
Accept: application/sdp

;user=phone>

Post by Frank Bulk - iName.com
Privacy: none

party=calling;

_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
asterisk-users mailing list
http://lists.digium.com/mailman/listinfo/asterisk-users
--
Personal Development Without The Silly Stuff: http://AllanDib.com
_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
asterisk-users mailing list
http://lists.digium.com/mailman/listinfo/asterisk-users

Frank Bulk

2009-01-06 13:29:39 UTC

Permalink

That's a good suggestion, but I tried that and it didn't work.

I think you need an '&' in-between, so I tried that, too. I also tried
adding the IP address of the CS 1500, too, and that didn't help.

Frank

From: asterisk-users-***@lists.digium.com
[mailto:asterisk-users-***@lists.digium.com] On Behalf Of Grygoriy
Dobrovolskyy
Sent: Tuesday, January 06, 2009 2:12 AM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

try do add

fromdomain=acme.com/sip.acme.com
fromhost=acme.com/sip.acme.com

2009/1/6 Frank Bulk <***@iname.com>

I tried that before, but I just tried it again. Unfortunately, the same
thing:

No user '5551236049' in SIP users list

Found peer 'ACME' for '5551236049' from 172.16.10.40:5060

[ACME]
host=172.16.10.40

username=username
secret=password
type=friend

Frank

From: asterisk-users-***@lists.digium.com
[mailto:asterisk-users-***@lists.digium.com] On Behalf Of Allan Dib
Sent: Monday, January 05, 2009 9:41 PM
To: Asterisk Users Mailing List - Non-Commercial Discussion

Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

Try it by IP address instead of hostname as reverse DNS may not be
resolving. e.g. host=123.123.123.123

On Tue, Jan 6, 2009 at 2:25 PM, Frank Bulk <***@iname.com> wrote:

This is what I have in my configuration now:

[ACME]
host=sip.acme.com
username=username
secret=password
type=friend

I've done a SIP debug before, but I've done it again with the above
configuration:
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
after which "SIP/2.0 401 Unauthorized" is issued after the un-authenticated
INVITE and "SIP/2.0 403 Forbidden" after the authenticated INVITE.

When I add "insecure=very", this is what the SIP debug shows:
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
Found RTP audio format 0
Peer audio RTP is at port 172.16.10.65:36272
Found audio description format PCMU for ID 0
Capabilities: us - 0xc (ulaw|alaw), peer - audio=0x4
(ulaw)/video=0x0 (nothing)/text=0x0 (nothing), combined - 0x4 (ulaw)
Non-codec capabilities (dtmf): us - 0x1 (telephone-event), peer -
0x0 (nothing), combined - 0x0 (nothing)
Peer audio RTP is at port 172.16.10.65:36272
Looking for +15552127020 in from-sip-external (domain sip.acme.com)
list_route: hop: <sip:***@172.16.10.40
<mailto:sip%***@172.16.10.40> >

It isn't very clear (to me) from the success how the "insecure=very" helps.

Frank

-----Original Message-----
From: Andres [mailto:***@telesip.net]
Sent: Monday, January 05, 2009 7:43 PM
To: ***@iname.com; Asterisk Users Mailing List - Non-Commercial
Discussion

Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

Post by Frank Bulk - iName.com
Frank
;tag=f76c66d0-c7784528-13c4-2dbba4-767e6552-2d

_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users
--
Personal Development Without The Silly Stuff: http://AllanDib.com

_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

Andres

2009-01-06 17:18:54 UTC

Permalink

Post by Frank Bulk
[ACME]
host=sip.acme.com
username=username
secret=password
type=friend

Your problem is you are trying to do authenticate by host and by
username at the same time. That does not work in asterisk. You should
be seeing a Warning message in the console saying something like:

check_auth: username mismatch, have <ACME>, digest has <username>

That means you already matched to sip.conf entry ACME, but the digest
has a different username, so it fails. You can fix it by setting the
paramters in the CS1500 to have the username = ACME. That way the
digest will come in as:

Digest username="ACME" ...bla bla bla

Andres
http://www.telesip.net

Post by Frank Bulk
I've done a SIP debug before, but I've done it again with the above
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
after which "SIP/2.0 401 Unauthorized" is issued after the un-authenticated
INVITE and "SIP/2.0 403 Forbidden" after the authenticated INVITE.
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
Found RTP audio format 0
Peer audio RTP is at port 172.16.10.65:36272
Found audio description format PCMU for ID 0
Capabilities: us - 0xc (ulaw|alaw), peer - audio=0x4
(ulaw)/video=0x0 (nothing)/text=0x0 (nothing), combined - 0x4 (ulaw)
Non-codec capabilities (dtmf): us - 0x1 (telephone-event), peer -
0x0 (nothing), combined - 0x0 (nothing)
Peer audio RTP is at port 172.16.10.65:36272
Looking for +15552127020 in from-sip-external (domain sip.acme.com)
It isn't very clear (to me) from the success how the "insecure=very" helps.
Frank
-----Original Message-----
Sent: Monday, January 05, 2009 7:43 PM
Discussion
Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

username

replace

Post by Frank Bulk - iName.com
Frank

Frank Bulk - iName.com

2009-01-06 17:28:13 UTC

Permalink

You're the miracle worker! Thanks!

Frank

From: Andres [mailto:***@telesip.net]
Sent: Tuesday, January 06, 2009 11:19 AM
To: Frank Bulk
Cc: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

Frank Bulk wrote:

This is what I have in my configuration now:

[ACME]
host=sip.acme.com
username=username
secret=password
type=friend

Your problem is you are trying to do authenticate by host and by username at
the same time. That does not work in asterisk. You should be seeing a
Warning message in the console saying something like:

check_auth: username mismatch, have <ACME>, digest has <username>

That means you already matched to sip.conf entry ACME, but the digest has a
different username, so it fails. You can fix it by setting the paramters in
the CS1500 to have the username = ACME. That way the digest will come in
as:

Digest username="ACME" ...bla bla bla

Andres
http://www.telesip.net

I've done a SIP debug before, but I've done it again with the above
configuration:
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
after which "SIP/2.0 401 Unauthorized" is issued after the un-authenticated
INVITE and "SIP/2.0 403 Forbidden" after the authenticated INVITE.

When I add "insecure=very", this is what the SIP debug shows:
No user '5551236049' in SIP users list
Found peer 'ACME' for '5551236049' from 172.16.10.40:5060
Found RTP audio format 0
Peer audio RTP is at port 172.16.10.65:36272
Found audio description format PCMU for ID 0
Capabilities: us - 0xc (ulaw|alaw), peer - audio=0x4
(ulaw)/video=0x0 (nothing)/text=0x0 (nothing), combined - 0x4 (ulaw)
Non-codec capabilities (dtmf): us - 0x1 (telephone-event), peer -
0x0 (nothing), combined - 0x0 (nothing)
Peer audio RTP is at port 172.16.10.65:36272
Looking for +15552127020 in from-sip-external (domain sip.acme.com)
list_route: hop: <sip:***@172.16.10.40>
<sip:***@172.16.10.40>

It isn't very clear (to me) from the success how the "insecure=very" helps.

Frank

-----Original Message-----
From: Andres [mailto:***@telesip.net]
Sent: Monday, January 05, 2009 7:43 PM
To: ***@iname.com; Asterisk Users Mailing List - Non-Commercial
Discussion
Subject: Re: [asterisk-users] Incoming side of SIP trunk does not work
unless I add "insecure=very"

Frank Bulk - iName.com wrote:

The incoming (Class 5 switch to Asterisk PBX) side of a SIP trunk does not
work unless I add "insecure=very" to my "Outgoing settings", but I don't
want to do that. I do want to authenticate. Outgoing (Asterisk PBX to
Class 5 switch) calls do authenticate and work.

The Nortel CS 1500 I'm using as the PSTN-side of my SIP trunk has a

username

and password that it's sending out. But the INVITE is responded by the
Asterisk with "SIP/2.0 403 Forbidden"

I've changed the INVITE message to mask the real telephone numbers, SIP
server, passwords, and IP addresses, but I did that using search and

replace

so the structure is intact.

What do I need to configure in the "Incoming Settings" panel for the CS
1500's INVITE to my Asterisk server to work? I've tried all kinds of
combinations of user,username,authname using +15552027020,host with IP
and/or DNS name, but nothing appears to work.

Do a sip debug on the asterisk console and see if it is actually is
matching one of your sip.conf entries during an invite from the CS1500.
Look for a line that says something like 'Found Peer....bla bla bla'.
If you dont see that line, then you are not even adding the correct
sip.conf entry to match the invite from the CS1500.

Andres
http://www.telesip.net

Frank

INVITE message from Wireshark packet capture:

INVITE sip:+***@sip.acme.com SIP/2.0
From:
<sip:***@172.16.10.40>
<sip:***@172.16.10.40>;tag=f76c66d0-c7784528-13c4-2dbba4-767e6552-2d

b

ba4
To: <sip:+***@sip.acme.com> <sip:+***@sip.acme.com>
Call-ID: f379f62-29173-3895-b14271f5-40802-***@172.16.10.40
CSeq: 5102 INVITE
Via: SIP/2.0/UDP 172.16.10.40:5060;branch=z9hG4bK-2dbba4-b2a4fa3a-7cd7598
User-Agent: Nortel CS1500UA/v02.00.REL01
Accept: application/sdp
P-Asserted-Identity: <sip:***@172.16.10.40;user=phone>
<sip:***@172.16.10.40;user=phone>
Privacy: none
Remote-Party-ID: <sip:***@172.16.10.40;user=phone>
<sip:***@172.16.10.40;user=phone>; party=calling;
privacy=off
Max-Forwards: 70
Supported: 100rel,replaces
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, REFER, PRACK
Contact: <sip:***@172.16.10.40> <sip:***@172.16.10.40>
Authorization: Digest
username="username",realm="asterisk",nonce="118af2b0",uri="sip:+15552027020

@

sip.acme.com",response="111e63ec2a1f3ebabefe4f7dae4087a1",algorithm=MD5
Content-Type: application/SDP
Content-Length: 167

v=0
o=- 2973921782 2973921782 IN IP4 172.16.10.65
s=SIP Call
c=IN IP4 172.16.10.65
t=0 0
m=audio 36224 RTP/AVP 0
a=rtpmap:0 PCMU/8000
a=ptime:20
a=sendrecv

_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

Frank Bulk - iName.com

2009-01-06 18:19:06 UTC

Permalink

After many hours of fiddling around, Andres gave me the final piece.

For those looking to implement SIP Trunks on a CS-1500 with Asterisk, here
are the pieces:

Diagram:
CS-1500 ------ customer PBX
(172.16.10.40) (172.16.10.195)

HOST: should be the DNS name assigned to the CS-1500's SIP interface. e.g.
sip.acme.com
NUSR: user name used for the CS 1500 to login into the customer PBX. Needs
to match up FreePBX's "Trunk Name". For those who use the CLI, this section
in sip.conf is encased in square brackets. i.e. [customername]
NPSW: password used for the CS 1500 to login into the customer PBX. Needs
to match up with the secret= line. i.e. secret=password
IP: IP address of the customer PBX. i.e. 172.16.10.195
LUSR: user name used for the customer PBX to login into the CS 1500. Needs
to match up with the username= line. i.e. username=customername
LPSW: password used for the customer PBX to login into the CS 1500. Needs to
match up with the secret= line. i.e. secret=password.

For simplicity we made NUSR/LUSR the same and NPSW/LPSW the same. Since you
need to define a trunk per customer, it makes the most sense and it easiest
to support and implement.

Here's what you need to add to Asterisk's sip.conf (yes, just those few
lines!)

[customername]
host=sip.acme.com
type=friend
username=customername
secret=password

And the CS-1500 output:
TYP TG
NUM 1234
TGTP 2WAY
TGNM SIP
MG NO
SIGT SIP
STSI 0
HNPA 555
RC 0
RTP 0
TRNL PRFX
PRFX 24
APFX NONE
TRFC NONE
4XCD YES
ACKA NO
TYPC NOCO
NXX UNKN
LATA 000
CMCT NO
TGID NONE
SIT NO
CNAR NO
LRN NONE
TNDM NO
LDAT NO
TRFC NONE
EOAT NO
ATIC NO
CMCO NO
TGMU NO
HOST sip.acme.com
NUSR customername
NPSW password
IP 172.16.10.195
PORT 5060
PROT UDP
T38F NO
AUTH YES
LUSR customername
LPSW password
CLIM 7
CPBY 0

Frank

-----Original Message-----
From: asterisk-users-***@lists.digium.com
[mailto:asterisk-users-***@lists.digium.com] On Behalf Of Frank Bulk -
iName.com
Sent: Monday, January 05, 2009 6:25 PM
To: asterisk-***@lists.digium.com
Subject: [asterisk-users] Incoming side of SIP trunk does not work unless I
add "insecure=very"

The incoming (Class 5 switch to Asterisk PBX) side of a SIP trunk does not
work unless I add "insecure=very" to my "Outgoing settings", but I don't
want to do that. I do want to authenticate. Outgoing (Asterisk PBX to
Class 5 switch) calls do authenticate and work.

The Nortel CS 1500 I'm using as the PSTN-side of my SIP trunk has a username
and password that it's sending out. But the INVITE is responded by the
Asterisk with "SIP/2.0 403 Forbidden"

I've changed the INVITE message to mask the real telephone numbers, SIP
server, passwords, and IP addresses, but I did that using search and replace
so the structure is intact.

What do I need to configure in the "Incoming Settings" panel for the CS
1500's INVITE to my Asterisk server to work? I've tried all kinds of
combinations of user,username,authname using +15552027020,host with IP
and/or DNS name, but nothing appears to work.

Frank

INVITE message from Wireshark packet capture:

INVITE sip:+***@sip.acme.com SIP/2.0
From:
<sip:***@172.16.10.40>;tag=f76c66d0-c7784528-13c4-2dbba4-767e6552-2db
ba4
To: <sip:+***@sip.acme.com>
Call-ID: f379f62-29173-3895-b14271f5-40802-***@172.16.10.40
CSeq: 5102 INVITE
Via: SIP/2.0/UDP 172.16.10.40:5060;branch=z9hG4bK-2dbba4-b2a4fa3a-7cd7598
User-Agent: Nortel CS1500UA/v02.00.REL01
Accept: application/sdp
P-Asserted-Identity: <sip:***@172.16.10.40;user=phone>
Privacy: none
Remote-Party-ID: <sip:***@172.16.10.40;user=phone>; party=calling;
privacy=off
Max-Forwards: 70
Supported: 100rel,replaces
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, REFER, PRACK
Contact: <sip:***@172.16.10.40>
Authorization: Digest
username="username",realm="asterisk",nonce="118af2b0",uri="sip:+15552027020@
sip.acme.com",response="111e63ec2a1f3ebabefe4f7dae4087a1",algorithm=MD5
Content-Type: application/SDP
Content-Length: 167

v=0
o=- 2973921782 2973921782 IN IP4 172.16.10.65
s=SIP Call
c=IN IP4 172.16.10.65
t=0 0
m=audio 36224 RTP/AVP 0
a=rtpmap:0 PCMU/8000
a=ptime:20
a=sendrecv

_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users