PJSIP 407 proxy authentication required due multiple IP addresses

Asterisk Asterisk SIP
1

Hello,

I am trying to use my ISP SIP trunk with Asterisk. My pjsip.conf looks like this:

[sfr_auth]
type=auth
auth_type=userpass
password=XXXXXXX
username=NDIXXXXXX.BTG.THD@sfr.fr
realm=sfr.fr

[sfr]
type=registration
outbound_auth=sfr
server_uri=sip:+339XXXXXXXXX@ims.mnc010.mcc208.3gppnetwork.org
client_uri=sip:+339XXXXXXXXX@ims.mnc010.mcc208.3gppnetwork.org
retry_interval=60
;outbound_proxy=sip:trappes.p-cscf.sfr.net:5062\;lr\;hide
outbound_proxy=sip:[2a02:8400:20:23a::8]:5062\;lr\;hide
transport=transport-udp-ipv6
contact_user=sfr-in
outbound_auth=sfr_auth

[sfr]
type=endpoint
auth=sfr
;outbound_proxy=sip:trappes.p-cscf.sfr.net:5062\;lr\;hide
outbound_proxy=sip:[2a02:8400:20:23a::8]:5062\;lr\;hide
100rel=yes
aors=sfr
context=extern
direct_media=no
force_rport=yes
from_domain=ims.mnc010.mcc208.3gppnetwork.org
from_user=+339XXXXXXXXX
ice_support=yes
outbound_auth=sfr_auth
rewrite_contact=yes
rtp_symmetric=yes
transport=transport-udp-ipv6
disallow=all
allow=alaw
allow=g722
allow=ulaw

This is working but I add to comment out the FQDN of the proxy and use one of its IP, otherwise I would get a 407 proxy authentication required most of the time when making calls.

What is happening is that most of the time the INVITE is sent to a different IP than the one where Asterisk is registered, and thus Asterisk is not registered at this proxy.

Does someone knows if there is a way to make Asterisk make calls using the same IP address as the one where it is registered?

Note: there are many threads about 407 issues but I couldn’t find one related to this particular problem. Sorry if this has already been answered.

Thank you in advance

2

No. There isn’t a way. Asterisk follows the specification, while the provider is expecting different behavior. Noone has implemented an option to change the behavior.

3

OK that’s what I thought, thank you for the quick answer.

4

What happens after the “proxy authentication required” packet?
I am just curious, because usually asterisk then should send the outbound auth and call should work.

If your provider really only accepts calls from registered devices, he should take care that all of his hosts know about your registration state.

5

Asterisk just sends an ACK, nothing else.
You can find the packets here

6

An ACK after the 407 is normal. Asterisk should then send the invite again with the Authorization. Unfortunately at the moment I don’t understand why yours doesn’t do that.

7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.