PJSIP settings for two German Telekom products

Hi!

I’d like to present my current PJSIP settings for discussion for two different products offered by the Deutsche Telekom AG. I was struggling a bit with the proper settings, but it seems that I now have something that seems to work.

The background is that chan_sip does not seem to work reliably anymore. The main reason seems to be that the multilevel DNS evaluations via NAPTR and SRV queries now seem to be mandatory. With chan_sip it was sometimes not possible to dial out after a while (minutes to hours) and one ran into various BUSY/CONGESTED and “forbidden” scenarios. After restarting Asterisk everything worked fine again for a while.

Outside Germany the details may not be so interesting, but they might be useful in some other European countries where similar products are sold.

For better reusability I have factored out the (more or less) common part in patterns.

The first settings are for the ALL-IP product, which essentially replaced the older 2 line BRI connections:

[tcom-allip-reg](!)
transport=transport-udp
line=yes
expiration=487
auth_rejection_permanent=yes
server_uri=sip:tel.t-online.de
outbound_proxy=sip:tel.t-online.de\;lr

[tcom-allip-auth](!)
auth_type=userpass
realm=tel.t-online.de
password=very-secret

[tcom-allip-endpoint](!)
transport=transport-udp
context=from-telekom
allow=alaw,ulaw,g722
outbound_proxy=sip:tel.t-online.de\;lr
from_domain=tel.t-online.de
direct_media=no
rewrite_contact=yes
rtp_symmetric=yes
timers=yes          ; updated 2019-04-10: there are always UPDATE requests
dtmf_mode=rfc4733

[tcom-allip-identify](!)
match=tel.t-online.de

[tcom-allip-aor](!)
default_expiration=120
qualify_frequency=67        ; Interval at which to qualify an AoR (default: "0")
qualify_timeout=3.0         ; Qualify timeout in fractional seconds (default: "3.0")
authenticate_qualify=yes    ; Authenticates a qualify request if needed (default: "no")
outbound_proxy=sip:tel.t-online.de\;lr
remove_existing=yes         ; new contacts replace old ones

[tcom_525354_reg](tcom-allip-reg)
type=registration
outbound_auth=tcom_525354_auth
endpoint=tcom_525354_endpoint
contact_user=+492112525354
client_uri=sip:+492112525354@tel.t-online.de

[tcom_525354_auth](tcom-allip-auth)
type=auth
username=+492112525354

[tcom_525354_aor](tcom-allip-aor)
type=aor
contact=sip:+492112525354@tel.t-online.de

[tcom_525354_identify](tcom-allip-identify)
type=identify
endpoint=tcom_525354_endpoint

[tcom_525354_endpoint](tcom-allip-endpoint)
type=endpoint
aors=tcom_525354_aor
outbound_auth=tcom_525354_auth
from_user=02112525354

Contrary to some older settings that are published elsewhere, “qualify” now works, provided “authenticate_qualify” has been affirmed. The setting may even be necessary to catch all DNS updates. I didn’t observe that prior to every call external DNS requests were made. SRV records do rotate every hour and after some time the endpoint identifier lists more than 6 entries. All phone numbers need to be registered separately for ALL-IP connections.

Regardless of the timers settings, there are always UPDATE requests every 1800 seconds, so one can as well enable the session timers.

“Loose routing” must be used, where the details are described here: https://wiki.asterisk.org/wiki/display/AST/PJSIP+with+Proxies . It looks as if the old chan_sip stack did that part implicitly.

The other set of settings is for the DeutschlandLAN SIP-Trunk, which are intended to replace the larger ISDN trunks:

[tcom-trunk-reg](!)
transport=transport-tcp
line=yes
expiration=485
auth_rejection_permanent=yes
server_uri=sip:sip-trunk.telekom.de
outbound_proxy=sip:reg.sip-trunk.telekom.de\;lr

[tcom-trunk-auth](!)
realm=sip-trunk.telekom.de
auth_type=userpass
username=<zugangsnummer>
password=<voip-password>

[tcom-trunk-endpoint](!)
transport=transport-tcp
context=from-telekom
allow=alaw,ulaw,g722
outbound_proxy=sip:reg.sip-trunk.telekom.de\;lr
from_domain=sip-trunk.telekom.de
direct_media=no
rewrite_contact=yes
rtp_symmetric=yes
timers=no
dtmf_mode=rfc4733

[tcom-trunk-identify](!)
match=reg.sip-trunk.telekom.de
; or match=217.0.0.0/13

[tcom-trunk-aor](!)
default_expiration=120
qualify_frequency=120         ; Interval at which to qualify an AoR (default: "0") 2019-04-10: OK
qualify_timeout=3.0         ; Qualify timeout in fractional seconds (default: "3.0")
authenticate_qualify=yes    ; Authenticates a qualify request if needed (default: "no")
outbound_proxy=sip:reg.sip-trunk.telekom.de\;lr
remove_existing=yes         ; new contacts replace old ones

[tcomsip_reg](tcom-trunk-reg)
type=registration
outbound_auth=tcomsip_auth
endpoint=tcomsip_endpoint
contact_user=+4931136464646
client_uri=sip:+4931136464646@sip-trunk.telekom.de

[tcomsip_aor](tcom-trunk-aor)
type=aor
contact=sip:+4931136464646@sip-trunk.telekom.de

[tcomsip_identify](tcom-trunk-identify)
type=identify
endpoint=tcomsip_endpoint

[tcomsip_auth](tcom-trunk-auth)
type=auth

[tcomsip_endpoint](tcom-trunk-endpoint)
type=endpoint
outbound_auth=tcomsip_auth
aors=tcomsip_aor
from_user=+4931136464646

Only the main number needs to get registered and the proxy also requires loose routing.

Expiration requires a minimum of 8 minutes and some similar restrictions seem to apply to OPTIONS requests. 120 seconds did not result in a 403, but I still need to look into the details. It may be that different proxies react somewhat differently.

There is also a special mode that allows to register the lines without any credentials, but I did not look into these settings. This would also only apply for internet connections sold by Deutsche Telekom.

Any feedback is welcome.

3 Likes

I am still running occasionally into problems. Last night I captured the traffic on the WAN side and extracted the SIP traffic, which was basically about re-registration processes and qualify packets.

This is a summary of all SIP packets:

 235832 2019-04-14 06:17:24,540075    80.155.144.111        217.0.20.192          SIP      517    Request: OPTIONS sip:+492499887766@tel.t-online.de | 

Frame 235832: 517 bytes on wire (4136 bits), 517 bytes captured (4136 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.20.192
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 235834 2019-04-14 06:17:24,570583    217.0.20.192          80.155.144.111        SIP      501    Status: 200 In Ordnung | 

Frame 235834: 501 bytes on wire (4008 bits), 501 bytes captured (4008 bits)
Internet Protocol Version 4, Src: 217.0.20.192, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 235844 2019-04-14 06:17:26,330431    80.155.144.111        217.0.20.192          SIP      513    Request: OPTIONS sip:+492499887767@tel.t-online.de | 

Frame 235844: 513 bytes on wire (4104 bits), 513 bytes captured (4104 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.20.192
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 235845 2019-04-14 06:17:26,361005    217.0.20.192          80.155.144.111        SIP      499    Status: 200 In Ordnung | 

Frame 235845: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits)
Internet Protocol Version 4, Src: 217.0.20.192, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 235894 2019-04-14 06:17:28,451015    80.155.144.111        217.0.20.192          SIP      512    Request: OPTIONS sip:+492499887768@tel.t-online.de | 

Frame 235894: 512 bytes on wire (4096 bits), 512 bytes captured (4096 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.20.192
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 235895 2019-04-14 06:17:28,481589    217.0.20.192          80.155.144.111        SIP      498    Status: 200 In Ordnung | 

Frame 235895: 498 bytes on wire (3984 bits), 498 bytes captured (3984 bits)
Internet Protocol Version 4, Src: 217.0.20.192, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 235898 2019-04-14 06:17:28,801858    80.155.144.111        217.0.20.192          SIP      509    Request: OPTIONS sip:+492499887769@tel.t-online.de | 

Frame 235898: 509 bytes on wire (4072 bits), 509 bytes captured (4072 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.20.192
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 235899 2019-04-14 06:17:28,832703    217.0.20.192          80.155.144.111        SIP      497    Status: 200 In Ordnung | 

Frame 235899: 497 bytes on wire (3976 bits), 497 bytes captured (3976 bits)
Internet Protocol Version 4, Src: 217.0.20.192, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 235904 2019-04-14 06:17:29,771775    80.155.144.111        217.0.20.192          SIP      509    Request: OPTIONS sip:+492499887770@tel.t-online.de | 

Frame 235904: 509 bytes on wire (4072 bits), 509 bytes captured (4072 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.20.192
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 235905 2019-04-14 06:17:29,802633    217.0.20.192          80.155.144.111        SIP      497    Status: 200 In Ordnung | 

Frame 235905: 497 bytes on wire (3976 bits), 497 bytes captured (3976 bits)
Internet Protocol Version 4, Src: 217.0.20.192, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 236188 2019-04-14 06:18:31,549184    80.155.144.111        217.0.20.192          SIP      517    Request: OPTIONS sip:+492499887766@tel.t-online.de | 

Frame 236188: 517 bytes on wire (4136 bits), 517 bytes captured (4136 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.20.192
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 236189 2019-04-14 06:18:31,580573    217.0.20.192          80.155.144.111        SIP      501    Status: 200 In Ordnung | 

Frame 236189: 501 bytes on wire (4008 bits), 501 bytes captured (4008 bits)
Internet Protocol Version 4, Src: 217.0.20.192, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 236196 2019-04-14 06:18:33,325915    80.155.144.111        217.0.20.192          SIP      513    Request: OPTIONS sip:+492499887767@tel.t-online.de | 

Frame 236196: 513 bytes on wire (4104 bits), 513 bytes captured (4104 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.20.192
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 236197 2019-04-14 06:18:33,356246    217.0.20.192          80.155.144.111        SIP      499    Status: 200 In Ordnung | 

Frame 236197: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits)
Internet Protocol Version 4, Src: 217.0.20.192, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 236206 2019-04-14 06:18:35,445579    80.155.144.111        217.0.20.192          SIP      513    Request: OPTIONS sip:+492499887768@tel.t-online.de | 

Frame 236206: 513 bytes on wire (4104 bits), 513 bytes captured (4104 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.20.192
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 236208 2019-04-14 06:18:35,476857    217.0.20.192          80.155.144.111        SIP      499    Status: 200 In Ordnung | 

Frame 236208: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits)
Internet Protocol Version 4, Src: 217.0.20.192, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 236212 2019-04-14 06:18:35,808161    80.155.144.111        217.0.20.192          SIP      509    Request: OPTIONS sip:+492499887769@tel.t-online.de | 

Frame 236212: 509 bytes on wire (4072 bits), 509 bytes captured (4072 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.20.192
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 236213 2019-04-14 06:18:35,839530    217.0.20.192          80.155.144.111        SIP      497    Status: 200 In Ordnung | 

Frame 236213: 497 bytes on wire (3976 bits), 497 bytes captured (3976 bits)
Internet Protocol Version 4, Src: 217.0.20.192, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 236217 2019-04-14 06:18:36,759915    80.155.144.111        217.0.20.192          SIP      509    Request: OPTIONS sip:+492499887770@tel.t-online.de | 

Frame 236217: 509 bytes on wire (4072 bits), 509 bytes captured (4072 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.20.192
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 236219 2019-04-14 06:18:36,790873    217.0.20.192          80.155.144.111        SIP      497    Status: 200 In Ordnung | 

Frame 236219: 497 bytes on wire (3976 bits), 497 bytes captured (3976 bits)
Internet Protocol Version 4, Src: 217.0.20.192, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 236665 2019-04-14 06:19:38,719451    80.155.144.111        217.0.27.161          SIP      517    Request: OPTIONS sip:+492499887766@tel.t-online.de | 

Frame 236665: 517 bytes on wire (4136 bits), 517 bytes captured (4136 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 236666 2019-04-14 06:19:38,747625    217.0.27.161          80.155.144.111        SIP      429    Status: 403 Forbidden | 

Frame 236666: 429 bytes on wire (3432 bits), 429 bytes captured (3432 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 236672 2019-04-14 06:19:40,331257    80.155.144.111        217.0.27.161          SIP      513    Request: OPTIONS sip:+492499887767@tel.t-online.de | 

Frame 236672: 513 bytes on wire (4104 bits), 513 bytes captured (4104 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 236674 2019-04-14 06:19:40,359945    217.0.27.161          80.155.144.111        SIP      427    Status: 403 Forbidden | 

Frame 236674: 427 bytes on wire (3416 bits), 427 bytes captured (3416 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 236685 2019-04-14 06:19:42,444773    80.155.144.111        217.0.27.161          SIP      513    Request: OPTIONS sip:+492499887768@tel.t-online.de | 

Frame 236685: 513 bytes on wire (4104 bits), 513 bytes captured (4104 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 236686 2019-04-14 06:19:42,473322    217.0.27.161          80.155.144.111        SIP      427    Status: 403 Forbidden | 

Frame 236686: 427 bytes on wire (3416 bits), 427 bytes captured (3416 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 236689 2019-04-14 06:19:42,804859    80.155.144.111        217.0.27.161          SIP      509    Request: OPTIONS sip:+492499887769@tel.t-online.de | 

Frame 236689: 509 bytes on wire (4072 bits), 509 bytes captured (4072 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 236690 2019-04-14 06:19:42,833267    217.0.27.161          80.155.144.111        SIP      425    Status: 403 Forbidden | 

Frame 236690: 425 bytes on wire (3400 bits), 425 bytes captured (3400 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 236695 2019-04-14 06:19:43,771736    80.155.144.111        217.0.27.161          SIP      509    Request: OPTIONS sip:+492499887770@tel.t-online.de | 

Frame 236695: 509 bytes on wire (4072 bits), 509 bytes captured (4072 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 236696 2019-04-14 06:19:43,800216    217.0.27.161          80.155.144.111        SIP      425    Status: 403 Forbidden | 

Frame 236696: 425 bytes on wire (3400 bits), 425 bytes captured (3400 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 237074 2019-04-14 06:20:45,544806    80.155.144.111        217.0.27.161          SIP      517    Request: OPTIONS sip:+492499887766@tel.t-online.de | 

Frame 237074: 517 bytes on wire (4136 bits), 517 bytes captured (4136 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237076 2019-04-14 06:20:45,573235    217.0.27.161          80.155.144.111        SIP      429    Status: 403 Forbidden | 

Frame 237076: 429 bytes on wire (3432 bits), 429 bytes captured (3432 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 237084 2019-04-14 06:20:47,324871    80.155.144.111        217.0.27.161          SIP      513    Request: OPTIONS sip:+492499887767@tel.t-online.de | 

Frame 237084: 513 bytes on wire (4104 bits), 513 bytes captured (4104 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237085 2019-04-14 06:20:47,353109    217.0.27.161          80.155.144.111        SIP      427    Status: 403 Forbidden | 

Frame 237085: 427 bytes on wire (3416 bits), 427 bytes captured (3416 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 237099 2019-04-14 06:20:49,444578    80.155.144.111        217.0.27.161          SIP      513    Request: OPTIONS sip:+492499887768@tel.t-online.de | 

Frame 237099: 513 bytes on wire (4104 bits), 513 bytes captured (4104 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237100 2019-04-14 06:20:49,473438    217.0.27.161          80.155.144.111        SIP      427    Status: 403 Forbidden | 

Frame 237100: 427 bytes on wire (3416 bits), 427 bytes captured (3416 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 237103 2019-04-14 06:20:49,806825    80.155.144.111        217.0.27.161          SIP      509    Request: OPTIONS sip:+492499887769@tel.t-online.de | 

Frame 237103: 509 bytes on wire (4072 bits), 509 bytes captured (4072 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237104 2019-04-14 06:20:49,836117    217.0.27.161          80.155.144.111        SIP      425    Status: 403 Forbidden | 

Frame 237104: 425 bytes on wire (3400 bits), 425 bytes captured (3400 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 237109 2019-04-14 06:20:50,762421    80.155.144.111        217.0.27.161          SIP      509    Request: OPTIONS sip:+492499887770@tel.t-online.de | 

Frame 237109: 509 bytes on wire (4072 bits), 509 bytes captured (4072 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237110 2019-04-14 06:20:50,790234    217.0.27.161          80.155.144.111        SIP      425    Status: 403 Forbidden | 

Frame 237110: 425 bytes on wire (3400 bits), 425 bytes captured (3400 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 237503 2019-04-14 06:21:49,860452    80.155.144.111        217.0.27.161          SIP      642    Request: REGISTER sip:tel.t-online.de  (1 binding) | 

Frame 237503: 642 bytes on wire (5136 bits), 642 bytes captured (5136 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (REGISTER)

 237504 2019-04-14 06:21:49,958123    217.0.27.161          80.155.144.111        SIP      628    Status: 401 Unauthorized 11030030348 | 

Frame 237504: 628 bytes on wire (5024 bits), 628 bytes captured (5024 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (401)

 237505 2019-04-14 06:21:49,958499    80.155.144.111        217.0.27.161          SIP      910    Request: REGISTER sip:tel.t-online.de  (1 binding) | 

Frame 237505: 910 bytes on wire (7280 bits), 910 bytes captured (7280 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (REGISTER)

 237508 2019-04-14 06:21:50,105679    217.0.27.161          80.155.144.111        SIP      776    Status: 200 OK  (1 binding) | 

Frame 237508: 776 bytes on wire (6208 bits), 776 bytes captured (6208 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 237515 2019-04-14 06:21:51,919877    80.155.144.111        217.0.27.161          SIP      640    Request: REGISTER sip:tel.t-online.de  (1 binding) | 

Frame 237515: 640 bytes on wire (5120 bits), 640 bytes captured (5120 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (REGISTER)

 237516 2019-04-14 06:21:52,004225    217.0.27.161          80.155.144.111        SIP      627    Status: 401 Unauthorized 11030030348 | 

Frame 237516: 627 bytes on wire (5016 bits), 627 bytes captured (5016 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (401)

 237517 2019-04-14 06:21:52,004728    80.155.144.111        217.0.27.161          SIP      907    Request: REGISTER sip:tel.t-online.de  (1 binding) | 

Frame 237517: 907 bytes on wire (7256 bits), 907 bytes captured (7256 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (REGISTER)

 237520 2019-04-14 06:21:52,151094    217.0.27.161          80.155.144.111        SIP      772    Status: 200 OK  (1 binding) | 

Frame 237520: 772 bytes on wire (6176 bits), 772 bytes captured (6176 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 237523 2019-04-14 06:21:52,549381    80.155.144.111        217.0.27.161          SIP      517    Request: OPTIONS sip:+492499887766@tel.t-online.de | 

Frame 237523: 517 bytes on wire (4136 bits), 517 bytes captured (4136 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237524 2019-04-14 06:21:52,577289    217.0.27.161          80.155.144.111        SIP      429    Status: 403 Forbidden | 

Frame 237524: 429 bytes on wire (3432 bits), 429 bytes captured (3432 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 237530 2019-04-14 06:21:53,800539    80.155.144.111        217.0.27.161          SIP      640    Request: REGISTER sip:tel.t-online.de  (1 binding) | 

Frame 237530: 640 bytes on wire (5120 bits), 640 bytes captured (5120 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (REGISTER)

 237531 2019-04-14 06:21:53,901904    217.0.27.161          80.155.144.111        SIP      627    Status: 401 Unauthorized 11030030348 | 

Frame 237531: 627 bytes on wire (5016 bits), 627 bytes captured (5016 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (401)

 237532 2019-04-14 06:21:53,902298    80.155.144.111        217.0.27.161          SIP      907    Request: REGISTER sip:tel.t-online.de  (1 binding) | 

Frame 237532: 907 bytes on wire (7256 bits), 907 bytes captured (7256 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (REGISTER)

 237533 2019-04-14 06:21:54,053675    217.0.27.161          80.155.144.111        SIP      772    Status: 200 OK  (1 binding) | 

Frame 237533: 772 bytes on wire (6176 bits), 772 bytes captured (6176 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 237538 2019-04-14 06:21:54,331187    80.155.144.111        217.0.27.161          SIP      513    Request: OPTIONS sip:+492499887767@tel.t-online.de | 

Frame 237538: 513 bytes on wire (4104 bits), 513 bytes captured (4104 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237539 2019-04-14 06:21:54,361465    217.0.27.161          80.155.144.111        SIP      499    Status: 200 In Ordnung | 

Frame 237539: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 237548 2019-04-14 06:21:56,451452    80.155.144.111        217.0.27.161          SIP      513    Request: OPTIONS sip:+492499887768@tel.t-online.de | 

Frame 237548: 513 bytes on wire (4104 bits), 513 bytes captured (4104 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237549 2019-04-14 06:21:56,479905    217.0.27.161          80.155.144.111        SIP      427    Status: 403 Forbidden | 

Frame 237549: 427 bytes on wire (3416 bits), 427 bytes captured (3416 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (403)

 237550 2019-04-14 06:21:56,805193    80.155.144.111        217.0.27.161          SIP      509    Request: OPTIONS sip:+492499887769@tel.t-online.de | 

Frame 237550: 509 bytes on wire (4072 bits), 509 bytes captured (4072 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237551 2019-04-14 06:21:56,835762    217.0.27.161          80.155.144.111        SIP      497    Status: 200 In Ordnung | 

Frame 237551: 497 bytes on wire (3976 bits), 497 bytes captured (3976 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 237552 2019-04-14 06:21:56,997366    80.155.144.111        217.0.27.161          SIP      643    Request: REGISTER sip:tel.t-online.de  (1 binding) | 

Frame 237552: 643 bytes on wire (5144 bits), 643 bytes captured (5144 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (REGISTER)

 237553 2019-04-14 06:21:57,086874    217.0.27.161          80.155.144.111        SIP      629    Status: 401 Unauthorized 11030030348 | 

Frame 237553: 629 bytes on wire (5032 bits), 629 bytes captured (5032 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (401)

 237554 2019-04-14 06:21:57,087286    80.155.144.111        217.0.27.161          SIP      911    Request: REGISTER sip:tel.t-online.de  (1 binding) | 

Frame 237554: 911 bytes on wire (7288 bits), 911 bytes captured (7288 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (REGISTER)

 237557 2019-04-14 06:21:57,231176    217.0.27.161          80.155.144.111        SIP      777    Status: 200 OK  (1 binding) | 

Frame 237557: 777 bytes on wire (6216 bits), 777 bytes captured (6216 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 237560 2019-04-14 06:21:57,770777    80.155.144.111        217.0.27.161          SIP      509    Request: OPTIONS sip:+492499887770@tel.t-online.de | 

Frame 237560: 509 bytes on wire (4072 bits), 509 bytes captured (4072 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237561 2019-04-14 06:21:57,780951    80.155.144.111        217.0.27.161          SIP      643    Request: REGISTER sip:tel.t-online.de  (1 binding) | 

Frame 237561: 643 bytes on wire (5144 bits), 643 bytes captured (5144 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (REGISTER)

 237562 2019-04-14 06:21:57,801440    217.0.27.161          80.155.144.111        SIP      497    Status: 200 In Ordnung | 

Frame 237562: 497 bytes on wire (3976 bits), 497 bytes captured (3976 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 237563 2019-04-14 06:21:57,876956    217.0.27.161          80.155.144.111        SIP      629    Status: 401 Unauthorized 11030030348 | 

Frame 237563: 629 bytes on wire (5032 bits), 629 bytes captured (5032 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (401)

 237564 2019-04-14 06:21:57,877350    80.155.144.111        217.0.27.161          SIP      911    Request: REGISTER sip:tel.t-online.de  (1 binding) | 

Frame 237564: 911 bytes on wire (7288 bits), 911 bytes captured (7288 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (REGISTER)

 237565 2019-04-14 06:21:58,022090    217.0.27.161          80.155.144.111        SIP      777    Status: 200 OK  (1 binding) | 

Frame 237565: 777 bytes on wire (6216 bits), 777 bytes captured (6216 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 237817 2019-04-14 06:22:59,550691    80.155.144.111        217.0.27.161          SIP      517    Request: OPTIONS sip:+492499887766@tel.t-online.de | 

Frame 237817: 517 bytes on wire (4136 bits), 517 bytes captured (4136 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237818 2019-04-14 06:22:59,581130    217.0.27.161          80.155.144.111        SIP      501    Status: 200 In Ordnung | 

Frame 237818: 501 bytes on wire (4008 bits), 501 bytes captured (4008 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 237827 2019-04-14 06:23:01,331204    80.155.144.111        217.0.27.161          SIP      513    Request: OPTIONS sip:+492499887767@tel.t-online.de | 

Frame 237827: 513 bytes on wire (4104 bits), 513 bytes captured (4104 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237828 2019-04-14 06:23:01,362042    217.0.27.161          80.155.144.111        SIP      499    Status: 200 In Ordnung | 

Frame 237828: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

 237837 2019-04-14 06:23:03,448726    80.155.144.111        217.0.27.161          SIP      513    Request: OPTIONS sip:+492499887768@tel.t-online.de | 

Frame 237837: 513 bytes on wire (4104 bits), 513 bytes captured (4104 bits)
Internet Protocol Version 4, Src: 80.155.144.111, Dst: 217.0.27.161
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (OPTIONS)

 237838 2019-04-14 06:23:03,479739    217.0.27.161          80.155.144.111        SIP      499    Status: 200 In Ordnung | 

Frame 237838: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits)
Internet Protocol Version 4, Src: 217.0.27.161, Dst: 80.155.144.111
User Datagram Protocol, Src Port: 5060, Dst Port: 5060
Session Initiation Protocol (200)

Everything is fine until packet 236665. Before that the external IP was 217.0.20.192 and then it changed to 217.0.27.161. Subsequently the OPTIONS requests were answered with Forbidden and the next re-registration failed as well. After a couple of minutes everything was smooth again. I guess that in between calls to myself would have failed.

A superficial interpretation would be to say that a new IP was announced and that exactly this IP was used by Asterisk, but the servers on the provider side were initially not informed. This could be some kind of cache-related or synchronization problem.

On the other hand the associated Telekom endpoint lists 6 or more IPs, so I wonder why they were not used by Asterisk after the first OPTION request failed. It seems that pjsip also only uses the first IP when SRV DNS requests are resolved. I do not know how I can influence this by changing some settings.

Has someone seen something like this before?

IP is not designed to work with unsable IP addresses!

Do you think that this is the service provider’s problem? As far as I am concerned, I don’t see that Asterisk is doing anything wrong here.

I think the problem is that you are using an ISP that arbitrarily changes IP addresses.

They are allowed to change them, provided they work. What I think is happening is that Asterisk correctly evaluates the multilevel DNS structure, but when the IP for _sip._udp… with the highest weight changes, this server does initially not know what it has to do. A couple of minutes later everything works as expected.

The problem is, how can one describe this to someone who works at a hotline?

Postscript

I explained my problem to the technical hotline and two days later the problem was gone, though I am still waiting for some feedback.

I think they switched my DSL line to a newer product. Previously it was an Annex B line, now it is Annex J with VLAN tagging using the new “Broadband Network Gateway” technology. This would imply that the service provider uses various kinds of DSLAMs at the customer periphery (older and newer technology) and depending on the problem some cables may get connected differently resulting in more reliable connections. Other customers, who rarely use the landline phone, might not even notice the problem. This may explain why not everything gets updated right away. I wonder whether one can experience these things in other countries, too.

In all fairness, that describes every ISP out there as DHCP leased IPs are the most common thing in consumer/business level connections. People just don’t notice as much because the leases can last for months or over a year.

However, there are still plenty that when you reboot the modem, etc. DHCP will push a new lease and IP.

Well, the IPs on the customer side are static here. The “contact IPs” of the telephony network change on an almost hourly basis. It’s actually not really the IPs, but what gets announced to be the highest priority proxy server, which is honored by Asterisk.

I have seen the same behavior with my SIP-Trunk of Deutsche Telekom. As far as I understand it Asterisk sends the outgoing call to a server that is not the server it registered with.

It seems that Telekom uses separate servers that do not know each others’ registered users. So if you place an outgoing call to (or otherwise try to communicate with) a server you did not register with, that server will give you the “forbidden” answer.

According to the PJSIP documentation it should always use the SRV entry with highest priority for a call. However, it looks as if it actually uses the first entry. I am not sure whether this actually happens and if so whether that is the intended behavior. Nevertheless, the order of these entries changes with almost every request to the Telekom DNS Server. If your local resolver caches them for the max time of an hour, they change every hour. Or they don’t, depending on when you query and which of the three entires happens to be on top. So might take some time before calls get blocked.

Please let me know if you know how to fix this in asterisk. I know that 3CX for example has a specific configuration option in their web interface to force their proprietary pbx to place outgoing calls only to the server IP that it previously registered with. Sounds like a hack to deal with Telekom style DNS and server behavior.

In my case I was not able to solve the problem directly in my Asterisk 15.5.0 / freepbx 14.0.5.25. I ended up hacking DNS and having my bind dns server/resolver pose as authoritative for the Telekom zone and serve only a single DNS SRV entry to my Asterisk. Since then there have been no more problems.

I think using the first SRV record is fine. If this machine is dead, I guess the lower priority entries are used. If the first entry says “forbidden”, there is no point to to test the other entries. Someone else here already said that we need to rely on correct data. Despite similar settings, the Telekom SIP trunk behaves significantly different than the simpler ALL-IP product (the trunk always maintains 2 active tcp connections to Telekom proxies, whereas the ALL-IP maintains only a single udp one; the description may be incomplete as the behavior may depend on the router behavior as well (full cone in my case)). I might come back in a couple of weeks with updated settings and better descriptions of the products.

Currently I have very little problems with the Telekom ALL-IP accounts. I never lose the registrations, but occasionally the OPTIONS authorization. This can be dealt with " pjsip reload qualify aor/endpoint", but after the next registration everything is fine again. It seems that if OPTIONS are unauthorized, one cannot dial out, but receive calls (need to test that, but that happens only maybe once or twice a week).

Someone on a German VoIP board described that the transition from Asterisk 15 to 16 basically solved his DNS problems, pjsip being used in both cases. I cannot say anything about that, but in my case Asterisk 16/pjsip behaves almost normally when compared to Asterisk 16/chan_sip.

That said, there seem to be a lot of net problems these days and I see also a lot of Q.850 reason codes (very often 3) which usually come from the PSTN side.

When I compare Asterisk 13 with chan_sip and Asterisk 16 with chan_pjsip, the latter one is definitively more reliable.

I was wrong about it being a bug. I tested it and my calls get blocked by Telekom once the priorities in DNS change, i.e. a different server has highest priority when the call is made compared to when asterisk registered.

I am aware that using the highest priority server for an outgoing call is valid behavior. I do not know whether Telekom’s requirement that outgoing calls must go to the server one is registered with conforms 100% to any standard. Nevertheless, they do require that and won’t change it.

To rephrase my questions: Is there any way in asterisk to configure the Telekom required behavior. So is there a way to use SRV records for registration but use the cached IP of the server one registered with for outgoing calls?

It’s not standard behavior to use the same server that you are registered to, at least I’ve never seen an RFC/draft as such and never experienced it at SIPit. That seems to be some behavior/requirement of theirs. There’s also no way to configure PJSIP to act the way you mention. I’m not even sure how difficult it would be to alter the code to do so…

Technically, the NAPTR lookups are not needed when you specify the transport. chan_sip does only SRV lookups, but this does not work reliably with the Telekom lines (but currently with 1&1, Sipgate, Versatel, …).

I am not sure whether your description fits to my experiences. Basically, Telekom switches servers, Asterisk gets the new IP, or IPs, then Telekom denies re-registration and qualification. A couple of minutes later, the new IP works as if nothing has happened. My explanation was that there could be an internal Telekom problem as far as the synchronisation of some data is concerned.

The problem is significantly worse in case of the older ALL-IP connections with Annex B DSL connections. The newer BNG/Annex J connections are a lot better, even with chan_sip.

BTW, forget about the 2 states of the SIP trunk. That is not always valid. I need to study under what circumstances this happens.

Not a solution but perhaps a workaround:
Telekom Deutschland not only allows SIP over UDP but also SIP over TLS. In that case, you have one persistent connection and do not go for DNS anymore. Therefore, not every call but just your initial registration is load-balanced via DNS-SRV.

However, because Telekom Deutschland offers only TLS 1.2, you have to go for method=sslv23 in your pjsip.conf (if you still use OpenSSL 1.0.2 or lower). There is a deticated thread for more options/details about that…

Registration works for me with the TCP/TLS transport, but I can’t get the media to work right now. It would make sense to enable TLS, but keep the audio unencrypted.