Then make sure you have set your sip.conf correctly
add
alwaysauthreject = yes
[quote]It is possible to determine if a peer with a specific name is configured in Asterisk
by sending a specially crafted REGISTER message twice. The username that is to
be checked is put in the user portion of the URI in the To header. A bogus nonmatching
value is put into the username portion of the Digest in the Authorization
header. If the peer does exist the second REGISTER will receive a response of
“403 Authentication user name does not match account name”. If the peer does
not exist the response will be “404 Not Found” if alwaysauthreject is disabled and
“401 Unauthorized” if alwaysauthreject is enabled.[/quote]
also use acl permit and deny for handsets that reside inside and those outside.