Inbound call : No matching endpoint found than Failed to authenticate

Good afternoon guys. I’m facing an issue about inbound calls and is more than one week I’m looking for a solution but still I didn’t get it :pensive: . I’m a newbie and I already setup a working installation of FreePBX, Extensions (sip), Trunk (sip), Outbound routes. Extensions are able to call each other and also the outbound traffic is working great. The only thing doesn’t work is the inbound calls to VOIP numbers (extensions) : asterisk is reached but there is something misconfigured I guess. Here below the messages I got:

[2023-11-01 16:44:00] NOTICE[19919] res_pjsip/pjsip_distributor.c: Request 'INVITE' from '"393382742364" <sip:393382742364@93.41.239.11>' failed for '93.41.239.11:5060' (callid: 1651399221@192.168.1.57) - No matching endpoint found
[2023-11-01 16:44:00] NOTICE[19919] res_pjsip/pjsip_distributor.c: Request 'INVITE' from '"393382742364" <sip:393382742364@93.41.239.11>' failed for '93.41.239.11:5060' (callid: 1651399221@192.168.1.57) - Failed to authenticate
OPTIONS sip:93.41.239.11 SIP/2.0
Via: SIP/2.0/UDP 128.140.66.20:5160;branch=z9hG4bK616ba10a
Max-Forwards: 70
From: "Unknown" <sip:Unknown@128.140.66.20:5160>;tag=as181c94d0
To: <sip:93.41.239.11>
Contact: <sip:Unknown@128.140.66.20:5160>
Call-ID: 4e8458694d38a5eb63af85aa414c0355@128.140.66.20:5160
CSeq: 102 OPTIONS
User-Agent: FPBX-15.0.37.4(16.17.0)
Date: Wed, 01 Nov 2023 16:44:05 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0


---
[2023-11-01 16:44:05] VERBOSE[2535] chan_sip.c:
<--- SIP read from UDP:93.41.239.11:5060 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 128.140.66.20:5160;branch=z9hG4bK616ba10a
From: "Unknown" <sip:Unknown@128.140.66.20:5160>;tag=as181c94d0
To: <sip:93.41.239.11:5060>;tag=1894316084
Call-ID: 4e8458694d38a5eb63af85aa414c0355@128.140.66.20:5160
CSeq: 102 OPTIONS
User-Agent: dble
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REFER, REGISTER, MESSAGE, INFO, SUBSCRIBE
Content-Length: 0

Are these details enough? Please let me know if you need more details. I already (on FreePBX) created an Incoming Route.

This is more of a FreePBX question. Have you tried asking overhere https://community.freepbx.org

Definitely you want the FreePBX people, as Incoming Route has no meaning in Asterisk. In any case the error messages indicate that that the call didn’t get that far.

When you go to the FreePBX people please provide a log of an incoming call request transaction, not an outgoing connectivity test one. The SIP you have logged has no relation to the failed call.

Note that I’d normally assume inbound to mean from a provider, but the reverse lookup on the address and the use of a non-routeable IP address in the call ID don’t look right for that.

Thanks jeroenvip for the reply… But seems not possible register on community.freepbx.org :disappointed:

Thanks david551 for your reply! I confirm log submitted is not related with my issue, my fault. Considering registration on FreePBX forum denied (tested more times but always some issues arose), what asterisks file I could share to get helped by you?

FYI : I have a GoIP GSM Gateway

Assuming FreePBX doesn’t use Asterisk Realtime Architecture, and uses the default directories, the transitive closure of /etc/asterisk/pjsip.conf and everything related by inclusion, together with the protocol logging for a real call.

1 Like

When I call from my own mobile the sim laid into the GSM Gateway, I get the busy signal and don’t have asterisk’s log. It seems GSM Gateway doesn’t arrive to Asterisk. When you said “transitive closure of /etc/asterisk/pjsip.conf and everything related by inclusion” you mean a zip including all pjsip* files ?

I can share with you my Trunk (Outgoing / Incoming) settings:

OUTGOING

type=peer
secret=xxxxxxxx
qualify=yes
port=5060
nat=no
insecure=very&port.invite
host=93.41.239.11
dtmfmode=rfc2833
defaultuser=1111
context=from-trunk
allow=alaw&ulaw

INCOMING

User Context = 1111

secret=xxxxxxxx
type=user
context=from-trunk

Hope this can gives you more details about errors:

[2023-11-01 16:44:00] NOTICE[19919] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘“393382742364” sip:393382742364@93.41.239.11’ failed for ‘93.41.239.11:5060’ (callid: 1651399221@192.168.1.57) - No matching endpoint found
[2023-11-01 16:44:00] NOTICE[19919] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘“393382742364” sip:393382742364@93.41.239.11’ failed for ‘93.41.239.11:5060’ (callid: 1651399221@192.168.1.57) - Failed to authenticate

chan_sip is not longer supported, and has been removed from the source code of the latest version.

This is gibberish. very was deprecated a very long time ago, and has been completely removed in supported versions of Asterisk. Neither “&”, nor “.|” are valid delimiters. This could cause failed to authenticate, except that it hasn’t got that far.

Also, if you need this, you are matching the OUTGOING section for incoming calls, so don’t need an INCOMING one.

This is a FreePBX concept. What is the actual context name? (The INCOMING/OUTGOING hack shouldn’t be needed for simple mobile air interface gateway box, and isn’t needed, on the supported channel driver.)

This doesn’t do anything when you have an explicit host.

You are looking for 1111, but they are sending 393382742364.

The INCOMING context is incomplete.

None of this being used, as the message indicates that chan_pjsip is the one that is listening on port 5060.

Thanks david551 for your kindly replies. I removed the INCOMING settings and updated the “insecure” param like you suggested (insecure=port.invite). Outgoing calls keeps on working fine but incoming call still busy. Errors are still the same:

[2023-11-06 10:24:54] NOTICE[10935] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘“393382742364” sip:393382742364@128.140.66.20’ failed for ‘93.41.239.11:5060’ (callid: 236768969@192.168.1.57) - No matching endpoint found
[2023-11-06 10:24:54] NOTICE[10935] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘“393382742364” sip:393382742364@128.140.66.20’ failed for ‘93.41.239.11:5060’ (callid: 236768969@192.168.1.57) - Failed to authenticate

The number 393382742364 is the one calling the sim locatend into the GoIP and it’s forwarded to asterisk (Setting on GoIP is “Use CID as SIP Caller ID”… Other options are “Disable” and “Use Remote Party ID”).

For both “Use Remote Party ID” and “Disable” the error messages are the following:

[2023-11-06 10:29:54] NOTICE[10935] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘“P2P” sip:192.168.1.57@128.140.66.20;user=phone’ failed for ‘93.41.239.11:5060’ (callid: 1050726095@192.168.1.57) - No matching endpoint found
[2023-11-06 10:29:54] NOTICE[10935] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘“P2P” sip:192.168.1.57@128.140.66.20;user=phone’ failed for ‘93.41.239.11:5060’ (callid: 1050726095@192.168.1.57) - Failed to authenticate

There is no indication that you need insecure=port, and I think insecure=invite may be dangerous, in this case, but it depends on how the gateway is configured.

You are still using sip.conf, when port 5060 is being handle by chan_pjsip, so nothing in sip.conf is relevant to your calls, which are arriving on 5060. You can’t have both bound to the same port, and, rumour has it that FreePBX prefers chan_pjsip for 5060 and uses a different default number for chan_sip, if both are enabled.

Thanks david551 again for your help. Here below my GW settings (Basic, Advanced, Call IN):

advanced
callin
sipconfig

Do you suggest some changes?

For security, you should enable outbound authentication

You haven’t provided your pjsip.conf information yet.

DTMF inband seem questionable for a “GSM” gateway. Also note that GSM only supports DTMF outbound. Inbound DTMF will be garbled, as the codec will not support inband over the air interface and the air interface only supports out of band in the expected direction from phone to network.

Some of the options are not self explanatory. They may well not even be adequately documented, so you might have to try them to understand what they really do, unless someone familiar with the device comes along.

Thanks david551. Here below what you requested (tarball).

pjsip.tar.gz.txt (1.7 KB)

There’s no type=identify for the IP address, nor is there a type=endpoint for 1111 set to match on authorisation user name. There is no type=auth for username=1111.

Basically you are sending the call to chan_pjsip without having told chan_pjsip about the gateway.

My preference would be to use type=identify on the IP address.

For security reasons, I’d also suggest using outbound-auth, as well as, or instead of auth, and to make the corresponding changes on the gateway, as it is outbound calls which will provide the payback for toll fraud and you don’t want an attacker to be making them by directly accessing the gateway.

Many thanks again david551. Maybe what you mean was in another config file. I found some configurations about trunk GSM-trunk-1 here:

sip.tar.gz.txt (41.5 KB)

That’s an incomplete configuration for chan_sip. As chan_pjsip is listening on port 5060, chan_sip cannot do the same. I believe FreePBX sets it to listen on a different port number, although if it didn’t the first one to claim 5060 would win, and the other would fail.

Moved GoIP’s port from 5060 to 5050 …same result

[2023-11-08 16:08:02] NOTICE[30573] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘“P2P” sip:192.168.1.51@128.140.66.20;user=phone’ failed for ‘93.41.239.11:5050’ (callid: 1415336865@192.168.1.51) - No matching endpoint found

[2023-11-08 16:08:02] NOTICE[30573] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘“P2P” sip:192.168.1.51@128.140.66.20;user=phone’ failed for ‘93.41.239.11:5050’ (callid: 1415336865@192.168.1.51) - Failed to authenticate

Let me gather more details to get you able to help me. Keep you posted

The correct solution is to throw chan_sip in the bin and do a purely chan_pjsip configuration.

The GoIP port number is the wrong end.

Thanks a lot david 551. Solved. Switching from sip to pjsip everything worked fine! Both calls inbound and outbound works great!