Pjsip Endpoint Invite get 401 Unathorized for outgoing calls

hashim447 · May 4, 2020, 4:45pm

Hi I have a problem with my telephony, PJSIP endpoint registration is succesfuly, but when the user tries to make an outgoing call from the softphone I see 401 unathorized for the invite. I dont see anything in console logs like call rejected due to etc etc.
Below is the SIP debug log and endpoint configuration.

INVITE sip:+95070452765@sip.mydomain.com;offnet SIP/2.0
Via: SIP/2.0/UDP 197.229.2.221:26993;branch=z9hG4bKJPDy0XZF3sgU66Q1;rport
Contact: sip:45312599@197.229.2.221:26993
Max-Forwards: 70
From: “+27 (0870) 550-700” sip:45312599@sip.mydomain.com;tag=0547B41E8F0CA89CBDAA5B9100E0B283
Allow: ACK, BYE, CANCEL, INFO, INVITE, MESSAGE, NOTIFY, OPTIONS, REFER
Supported: replaces, path
To: sip:+27659507045@sip.mydomain.com;offnet
Content-Type: application/sdp
Call-ID: 693B3D687A53959A47585165144351E15FB004C6
CSeq: 1 INVITE
User-Agent: My agent
Content-Length: 586

v=0
o=- 3117386837 27603 IN IP4 172.26.170.170
s=llqztko
c=IN IP4 197.229.2.221
t=0 0
a=msid-semantic:WMS 18a17f0f-8bb3-4116-b661-f67f85bb5f44
m=audio 26980 RTP/AVP 8 0 9 102 3 101
a=rtcp-mux
a=rtpmap:101 telephone-event/8000
a=rtpmap:102 iLBC/8000
a=fmtp:101 0-15
a=fmtp:102 mode=30
a=ptime:30
a=sendrecv
a=ssrc:2177994147 cname:aVknaekuKpA7Ip5C
a=ssrc:2177994147 msid:18a17f0f-8bb3-4116-b661-f67f85bb5f44 5133927c-9f61-4b93-b9ce-d3afb8e8e9cd
a=ssrc:2177994147 mslabel:18a17f0f-8bb3-4116-b661-f67f85bb5f44
a=ssrc:2177994147 label:5133927c-9f61-4b93-b9ce-d3afb8e8e9cd

<— Transmitting SIP response (578 bytes) to UDP:197.229.2.221:26993 —>
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 197.229.2.221:26993;rport=26993;received=197.229.2.221;branch=z9hG4bKJPDy0XZF3sgU66Q1
Call-ID: 693B3D687A53959A47585165144351E15FB004C6
From: “+27 (0870) 550-700” sip:45312599@sip.mydomain.com;tag=0547B41E8F0CA89CBDAA5B9100E0B283
To: sip:+27659507045@sip.mydomain.com;offnet;tag=z9hG4bKJPDy0XZF3sgU66Q1
CSeq: 1 INVITE
WWW-Authenticate: Digest realm=“asterisk”,nonce=“1588606988/76144bb7e0292bcb974f7dd58b0a05ca”,opaque=“313063325e3d6027”,algorithm=md5,qop=“auth”
Server: “Asterisk”
Content-Length: 0

<— Received SIP request (439 bytes) from UDP:197.229.2.221:26993 —>
ACK sip:+27659507045@sip.mydomain.com;offnet SIP/2.0
Via: SIP/2.0/UDP 197.229.2.221:26993;branch=z9hG4bKJPDy0XZF3sgU66Q1;rport
Max-Forwards: 70
Call-ID: 693B3D687A53959A47585165144351E15FB004C6
From: “+27 (0870) 550-700” sip:45312599@sip.mydomain.com;tag=0547B41E8F0CA89CBDAA5B9100E0B283
To: sip:+27659507045@sip.mydomain.com;offnet;tag=z9hG4bKJPDy0XZF3sgU66Q1
CSeq: 1 ACK
User-Agent: My agent
Content-Length: 0

<— Transmitting SIP request (484 bytes) to UDP:197.229.2.221:26993 —>
OPTIONS sip:45312599@197.229.2.221:26993;rinstance=C665318B SIP/2.0
Via: SIP/2.0/UDP 41.87.205.94:5060;rport;branch=z9hG4bKPj2f029c8c-3cfd-4437-a779-06fcdf620829
From: sip:45312599@41.87.205.94;tag=a576b2c0-c046-462f-89c1-525143011472
To: sip:45312599@197.229.2.221;rinstance=C665318B
Contact: sip:45312599@41.87.205.94:5060
Call-ID: 862ad0d9-1287-4113-a310-5a50a1f29c52
CSeq: 54336 OPTIONS
Max-Forwards: 70
User-Agent: “My agent”
Content-Length: 0

<— Received SIP response (553 bytes) from UDP:197.229.2.221:26993 —>
SIP/2.0 200 OK
Via: SIP/2.0/UDP 41.87.205.94:5060;rport=5060;branch=z9hG4bKPj2f029c8c-3cfd-4437-a779-06fcdf620829;received=41.87.205.94
Contact: sip:45312599@197.229.2.221:26993
From: sip:45312599@41.87.205.94;tag=a576b2c0-c046-462f-89c1-525143011472
Call-ID: 862ad0d9-1287-4113-a310-5a50a1f29c52
CSeq: 54336 OPTIONS
To: sip:45312599@197.229.2.221;rinstance=C665318B
Allow: ACK, BYE, CANCEL, INFO, INVITE, MESSAGE, NOTIFY, OPTIONS, REFER
Supported: replaces, path
Accept: application/sdp
User-Agent: My agent
Content-Length: 0

[45312599]
type=aor
max_contacts=5
qualify_frequency=10

[45312599]
type=auth
username=45312599
password=0d322902-5

[45312599]
type=endpoint
context=from-user1
message_context=from-user-text
disallow=all
allow=alaw,ulaw,vp8,h264
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
direct_media=no
auth=45312599
outbound_auth=45312599
aors=45312599

jsmith · May 4, 2020, 7:40pm

A 401 response to an INVITE message means that the the other side has rejected the call. If you continue to see 401 messages, check to make sure that you’re authenticating correctly to the other side.

(On a side note, please know that a 401 is also typically part of a successful INVITE too. You’ll typically see an INVITE without authentication, with a 401 response. Part of that 401 response is the data needed,such as the nonce, to authenticate. The caller will respond with to the 401, then send a second INVITE – but this time the INVITE contains authentication information. If you get a 401 from this second INVITE, then you’re really got a problem with your username, password,etc.)

hashim447 · May 4, 2020, 7:58pm

Hi Thats exactly the problem is: apologies I missed the part.

the fact is the once this 401 is sent i dont get the next invite with authentication digest. I suppose their are two reasons for this

the 200 OK for the first Cseq1 Invite 401 was never received by endpoint
the endpoint configuration is problematic and it never sends the seconds invite instead keeps trying on the first one.

david551 · May 5, 2020, 10:09am

It send ACK, so it saw the response. That leaves option (2).

hashim447 · May 5, 2020, 11:19am

okay i further took some traces today and what I observed is that the flow is fine apart from the fact that the second invite with authorization details never arrives on the asterisk server.
The interesting thing is this specific scenario is only happening when use Mobile Data internet.
When i switch to WiFi internet everything works fine. but on mobile data the second invite never arrives.

Any thoughts?

system · June 4, 2020, 11:19am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.