Astersik PJSIP incoming Rejection

Hi All,

I have a few issues which I dont quite know how to address or explain. This is my situation; I have 47 trunks actively working in - out ,but the latest 3 trunk I added are having issues. All config is 1/1 identical but , when an incoming call is received, asterisk rejects via 401 unauthorized.

  1. There are no explicit authentication in place
  2. all other trunks work fine ,as all settings are 1/1 identical

When I enabled logger debug, saw a lot of messages like

" res_pjsip_endpoint_identifier_ip.c: Source address x.x.x.x does not match identify ‘1234567890’

My endpoints aer configured as real time, everything works perfectly except for the latest 3 trunks I added . I know the settings are identical as I checked them one by one , also I have a prepared query that runs when creating the EP 's so I know there are no typos.

This is a successful request ;

and this is a failed request

The only difference between the success and failed attempt is the ; Line = xxx parameter in the invite header , which I have no idea what it is for. The provider was supposed (and is I suppose) sending calls without authentication , and I have to in-auth configured.

Any help / input / advise will be highly appreciated.

Thanks in advance, Ucin

You haven’t shown the configuration of a working and non-working.

The line parameter is enabled on the outbound registration. If enabled then the line parameter is placed in it, which allows incoming calls to be associated with the outbound registration and directed to the dialplan. If the line option is not enabled then it won’t be present. It may also not be present if the provider strips the parameter out.

Hi jcolp, thanks for your reply.

I haven’t because it’s all real-time, and yes the “line” option is enabled on all of my trunk- endpoints.

Then you’d have to look at the outbound REGISTER and see if the line parameter is present. If it is, then the provider is stripping it and you can’t use that. If it isn’t present then you may need to restart Asterisk or something.

is the line option I see in within the trace file related to what I have set? I am I understating it correctly ? If that option is not present could it result to 401 Unauthorized? Will it be better if I just ask my provider to provide authorization when forwarding th incoming call to us, will that help?. But that doesn’t really explain why all of a sudden these issues started to happen . Only 3 trunks are having this issue, all other 45 of them are working perfectly fine.

Thanks jcolp, I appreciate your comments !

If the “line” option is set on an outbound registration then we create a random string and put it in the “line” parameter in the Contact we send to the provider on the REGISTER. The provider is supposed to send this back to us if they send a call to us. If they do, we are able to associate it with the outbound registration and match the endpoint. If they don’t, we can’t.

You haven’t provided a SIP REGISTER of a non-working trunk, so I can’t comment on that.

If line is not supported then generally you have to do IP based matching, and that only works for a single trunk as all incoming calls will be associated with that.

I don’t know why it’s not working for some, but if Asterisk is putting the line parameter in the outbound registration then Asterisk is behaving as it should.

ok, not sure if this is the info you are requesting but here is the full registration and identify sections.

and

all outbound calls are working properly. All inbound is ok except for EP xx87, xx69 and xx68. Other than this, all is well. I’ve been arguing with our provider that it must be related to something / some setting on their end. But because the call is hitting our asterisk and asterisk is rejecting the call, they are kind of throwing the bomb back to us :slight_smile: thanks again, Ucin

That’s configuration. I’m referring to a SIP trace, which is output using “pjsip set logger on”.

<--- Received SIP request (943 bytes) from UDP:212.58.21.221:5060 --->
INVITE sip:02129900068@51.77.67.121:5060 SIP/2.0
Via: SIP/2.0/UDP 212.58.21.221:5060;branch=z9hG4bK0f92.79bef14180ef2121dc4169d751bef5de.0
Via: SIP/2.0/UDP 212.58.21.221:5070;received=212.58.21.221;branch=z9hG4bK18d6a79c781ca5de0187fef97e246a87;rport=5070
Max-Forwards: 69
From: <sip:+000008196663@212.58.21.221>;tag=0d62d503f2289a840bfa2e8040d6ae3f
To: <sip:02129900068@51.77.67.121>
Call-ID: 0212AA45F981400000112402@TS_SOFTSWITCH-onnet_1-b2b_1
CSeq: 200 INVITE
Contact: Anonymous <sip:+000008196663@212.58.21.221:5070>
Expires: 300
User-Agent: Sippy Softswitch v5.2-PRODUCTION.264
cisco-GUID: 3512054200-3189009801-2538854450-1180587592
h323-conf-id: 3512054200-3189009801-2538854450-1180587592
Content-Length: 178
Content-Type: application/sdp

v=0
o=- 21451156 1 IN IP4 212.175.113.54
s=-
c=IN IP4 212.175.113.54
t=0 0
m=audio 38586 RTP/AVP 8 18 96
a=fmtp:18 annexb=no
a=rtpmap:96 telephone-event/8000
a=ptime:20

<--- Transmitting SIP response (712 bytes) to UDP:212.58.21.221:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 212.58.21.221:5060;rport=5060;received=212.58.21.221;branch=z9hG4bK0f92.79bef14180ef2121dc4169d751bef5de.0
Via: SIP/2.0/UDP 212.58.21.221:5070;rport=5070;received=212.58.21.221;branch=z9hG4bK18d6a79c781ca5de0187fef97e246a87
Call-ID: 0212AA45F981400000112402@TS_SOFTSWITCH-onnet_1-b2b_1
From: <sip:+000008196663@212.58.21.221>;tag=0d62d503f2289a840bfa2e8040d6ae3f
To: <sip:02129900068@51.77.67.121>;tag=z9hG4bK0f92.79bef14180ef2121dc4169d751bef5de.0
CSeq: 200 INVITE
WWW-Authenticate: Digest realm="asterisk",nonce="1620325046/8ef5d17558d0ffa84531df109f4dbd54",opaque="7b0b1d7b6a9d7a29",algorithm=md5,qop="auth"
Server: Asterisk PBX 18.3.0
Content-Length:  0


<--- Received SIP request (588 bytes) from UDP:212.58.21.221:5060 --->
ACK sip:02129900068@51.77.67.121:5060 SIP/2.0
Via: SIP/2.0/UDP 212.58.21.221:5060;branch=z9hG4bK0f92.79bef14180ef2121dc4169d751bef5de.0
Via: SIP/2.0/UDP 212.58.21.221:5070;received=212.58.21.221;rport=5070;branch=z9hG4bK18d6a79c781ca5de0187fef97e246a87
Max-Forwards: 69
From: <sip:+000008196663@212.58.21.221>;tag=0d62d503f2289a840bfa2e8040d6ae3f
To: <sip:02129900068@51.77.67.121>;tag=z9hG4bK0f92.79bef14180ef2121dc4169d751bef5de.0
Call-ID: 0212AA45F981400000112402@TS_SOFTSWITCH-onnet_1-b2b_1
CSeq: 200 ACK
User-Agent: Sippy Softswitch v5.2-PRODUCTION.264
Content-Length: 0or paste code here

This is te failed incoming call. Registration, outbound …etc everything else is working fine.

As I’ve stated, it does not contain the line parameter so it can’t match the configured endpoint in the outbound registration. As you haven’t provided the outbound registration, I can’t say if it’s their fault or not.

Please don’t get me wrong bu how can I provide the outbound registration from pjsip logger when registration has already been established?

You either have to wait for it to re-register, or there are CLI commands to initiate a register (pjsip send register).

<--- Transmitting SIP request (461 bytes) to UDP:212.58.21.221:5060 --->
REGISTER sip:212.58.21.221 SIP/2.0
Via: SIP/2.0/UDP 51.77.67.121:5060;rport;branch=z9hG4bKPj45aa54cf-944a-4f23-92e9-bc97f0a768a2
From: <sip:02129900068@212.58.21.221>;tag=1beb51a0-6f61-4cd1-8f09-82243d0e5c66
To: <sip:02129900068@212.58.21.221>
Call-ID: cc58ed13-1556-4e11-b777-dc1f48809fb1
CSeq: 22195 REGISTER
Contact: <sip:02129900068@51.77.67.121:5060;line=qefqptc>
Expires: 0
Max-Forwards: 70
User-Agent: Asterisk PBX 18.3.0
Content-Length:  0


<--- Received SIP response (549 bytes) from UDP:212.58.21.221:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 51.77.67.121:5060;received=51.77.67.121;rport=5060;branch=z9hG4bKPj45aa54cf-944a-4f23-92e9-bc97f0a768a2
From: <sip:02129900068@212.58.21.221>;tag=1beb51a0-6f61-4cd1-8f09-82243d0e5c66
To: <sip:02129900068@212.58.21.221>;tag=b73fa26f609a7c3ed634ad62b91b6dfe-bda5
Call-ID: cc58ed13-1556-4e11-b777-dc1f48809fb1
CSeq: 22195 REGISTER
WWW-Authenticate: Digest realm="sippysoft.com", nonce="609438eb00005e94e76027b574c4a65022a17c1de737c3a1"
Server: Sippy Softswitch v5.2-PRODUCTION.264
Content-Length: 0


<--- Transmitting SIP request (658 bytes) to UDP:212.58.21.221:5060 --->
REGISTER sip:212.58.21.221 SIP/2.0
Via: SIP/2.0/UDP 51.77.67.121:5060;rport;branch=z9hG4bKPj4b0af4b3-35e9-4bb4-8e01-5e68e4cf6982
From: <sip:02129900068@212.58.21.221>;tag=1beb51a0-6f61-4cd1-8f09-82243d0e5c66
To: <sip:02129900068@212.58.21.221>
Call-ID: cc58ed13-1556-4e11-b777-dc1f48809fb1
CSeq: 22196 REGISTER
Contact: <sip:02129900068@51.77.67.121:5060;line=qefqptc>
Expires: 0
Max-Forwards: 70
User-Agent: Asterisk PBX 18.3.0
Authorization: Digest username="02129900068", realm="sippysoft.com", nonce="609438eb00005e94e76027b574c4a65022a17c1de737c3a1", uri="sip:212.58.21.221", response="a787c8169f9c7b143f0bf5f66b654c3d"
Content-Length:  0


<--- Received SIP response (433 bytes) from UDP:212.58.21.221:5060 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 51.77.67.121:5060;received=51.77.67.121;rport=5060;branch=z9hG4bKPj4b0af4b3-35e9-4bb4-8e01-5e68e4cf6982
From: <sip:02129900068@212.58.21.221>;tag=1beb51a0-6f61-4cd1-8f09-82243d0e5c66
To: <sip:02129900068@212.58.21.221>;tag=b73fa26f609a7c3ed634ad62b91b6dfe-adf7
Call-ID: cc58ed13-1556-4e11-b777-dc1f48809fb1
CSeq: 22196 REGISTER
Server: Sippy Softswitch v5.2-PRODUCTION.264
Content-Length: 0

That’s an unregistration and not a registration, but the line parameter is there so it’s most likely something going on with the provider.

You can either see if they’ll fix it, or you’d have to do IP based matching.

thanks, I thought the command does what is intended to

pjsip send register <registration> | *all
       Unregisters the specified (or all) outbound registration(s) then starts registration(s) and schedules re-registrations.

un-registers and re-registers. So I guess the provider is not using the registration information correctly or is removing part of it as I understand. Since the line option is present, they should be using it for any communication request (maybe only for inbound perhaps ? )

IP based matching wont work as far as I know (I read a couple of your previous posts regarding this topic) all trunks are from the same provider,same single IP, and when I tried to add math IP value, calls started to hit the wrong match header and resulting in 404 not found because it was trying to send 1111 > 11122 because of the IP

honestly I’m open to all other suggestions. Currently we’re in a ping pong situation where they keep throwing the ball to me and I’m doing the same. all trunks are working fine with 1/1 identical settings, same provider ,same IP ,really everything is exactly the same :slight_smile:

Why do you have multiple trunks? That suggests you are using service that is intended for use by small businesses and individuals, directly connecting phones to the service. A service oriented at businesses of any size should be providing you with trunks that support multiple calls and multiple called numbers.

unfortunately, thats how things are here. One customer 10 numbers 10 separate registrations. I have a total of 40+ from the same provider all with same IP, at some point it’s bound to conflict . I’m puzzled…

Did you test these trunks on a sip phone ? Do they work as expected . Dont blame a working asterisk before testing the new trunks.

Did you do a pjsip show endpoint X
and compare it with a show endpoint Y ?

Are they completely similar ? I really think it might be you application not providing correct parameters … you can also test modify one working trunk put ip of malfunctioning trunk in it anf reload. See what happens.
You can also add the trunks manually and see.
You czn install a vm and test them too