[A] (10.33.3.44) is paired with FreePBX and works in production
[B] (10.33.3.41) is a test node and does not have any GUI. Its version: Asterisk 13.1-cert2
I need a simple thing: set up a PJSIP-trunk between [A] and [B} without any registration or authentication. However, inbound authentication on [B] persists even though it is not enabled.
As you can see, no inbound or outbound auth is configured.
However, it is not actually disabled - node [B] is still trying to authenticate [A].
It replies with “401 Unathorized” to all OPTIONS and INVITE requests coming from [A]:
in order to be able to receive calls with no authentication you need to use on chan sip the option insecure=invite I suggest you send no authenticated calls to an special context
Thank you. However, as you can see from the provided excerpt of pjsip.conf, I do not refer to any auth object in my trunk configuration. What else am I doing wrong?
I dont use pjsip in production yet, but would be good to enable the type=identify it will allow you to indentify the inbound traffic per IP or by pulling the user from the “From:” SIP header in the packet, if you dont have enable it will do it by the from header, but I think you should one to be indentify by IP instead https://wiki.asterisk.org/wiki/display/AST/PJSIP+Configuration+Sections+and+Relationships
Your traffic isn’t being associated with an endpoint. For security reasons we fake an authentication, so that anyone trying to find accounts receives the same response for accounts that both require authentication and don’t exist. You need an identify section to associate the incoming traffic to the endpoint. On the calling side having the from user set to “10-33-3-44” would also allow it to match.
That should be enough. You can use “pjsip set logger on” to see the incoming traffic including where it is coming from, and there are CLI commands that allow you to inspect and see what is configured to ensure the section is there.
Although not related to pjsip, it is sufficient to omit secret. If you need to authenticate the other way, use remotesecret. insecure=invite doesn’t fully disable authentication, even when Asterisk is UAS.
I uncommented identify, restarted asterisk, but this does not resolve the issue.
Information in console logs enabled by ‘pjsip set logger on’ repeats what I see in the packet traces:
Nothing else immediately comes to mind, but it’s definitely something in your configuration. If you enable debug in logger.conf to console, do “core set debug 5”, and then attempt a call or see an OPTIONS coming in do you see any messages about an endpoint being used? (provide the output if possible)
That’s expected. It looks like the identify did work, but the endpoint wasn’t returned. Looking back at it - your endpoint is invalid. “qualify” is not a valid option there. This would have produced a message at load time stating that the option was invalid and the endpoint wasn’t loaded.
