Register failed. Failed to authenticate (401) an extension

Hello,
I’m new with Asterisk 20, in my other Asterisk (an older version -16-) I used chan_sip, but now it’s deprecated, and must use pjsip.
It’s a fresh Asterisk 20 installation, and I want to use a softphone (Jami) to use an extension, but when I try to register, I get the 401 Unautorized error:

<--- Received SIP request (549 bytes) from UDP:172.28.12.101:5060 --->
REGISTER sip:172.28.12.58 SIP/2.0
Via: SIP/2.0/UDP 172.28.12.101:5060;rport;branch=z9hG4bKPj7a3a686d-4370-4268-ab37-40efa277f231
Max-Forwards: 70
From: "SIP" <sip:1001@172.28.12.58>;tag=bc2bfad0-3e32-41e6-a416-52d1718a1206
To: "SIP" <sip:1001@172.28.12.58>
Call-ID: e2be94e6-7ca5-4f5f-b098-7459741bab0f
CSeq: 6733 REGISTER
User-Agent: Ring Daemon/7.4.0
Contact: "SIP" <sip:1001@172.28.12.101:5060>
Expires: 60
Allow: PRACK, SUBSCRIBE, NOTIFY, REFER, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, OPTIONS, MESSAGE, PUBLISH
Content-Length:  0


<--- Transmitting SIP response (578 bytes) to UDP:172.28.12.101:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 172.28.12.101:5060;rport=5060;received=172.28.12.101;branch=z9hG4bKPj7a3a686d-4370-4268-ab37-40efa277f231
Call-ID: e2be94e6-7ca5-4f5f-b098-7459741bab0f
From: "SIP" <sip:1001@172.28.12.58>;tag=bc2bfad0-3e32-41e6-a416-52d1718a1206
To: "SIP" <sip:1001@172.28.12.58>;tag=z9hG4bKPj7a3a686d-4370-4268-ab37-40efa277f231
CSeq: 6733 REGISTER
WWW-Authenticate: Digest realm="asterisk",nonce="1675534035/d98a907ccbd6fb5670d7f3153b8649dd",opaque="0402ac6424faa2df",algorithm=MD5,qop="auth"
Server: Asterisk PBX 20.1.0
Content-Length:  0


<--- Received SIP request (840 bytes) from UDP:172.28.12.101:5060 --->
REGISTER sip:172.28.12.58 SIP/2.0
Via: SIP/2.0/UDP 172.28.12.101:5060;rport;branch=z9hG4bKPjd0a2e826-ced7-4b0a-87d3-b3f02c15c4ba
Max-Forwards: 70
From: "SIP" <sip:1001@172.28.12.58>;tag=bc2bfad0-3e32-41e6-a416-52d1718a1206
To: "SIP" <sip:1001@172.28.12.58>
Call-ID: e2be94e6-7ca5-4f5f-b098-7459741bab0f
CSeq: 6734 REGISTER
User-Agent: Ring Daemon/7.4.0
Contact: "SIP" <sip:1001@172.28.12.101:5060>
Expires: 60
Allow: PRACK, SUBSCRIBE, NOTIFY, REFER, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, OPTIONS, MESSAGE, PUBLISH
Authorization: Digest username="1001", realm="asterisk", nonce="1675534035/d98a907ccbd6fb5670d7f3153b8649dd", uri="sip:172.28.12.58", response="5de7628d15bd68ed9ba0ebe8be3553b1", algorithm=MD5, cnonce="5c9c8f33-dd6d-4346-9080-c4eaef336ddc", opaque="0402ac6424faa2df", qop=auth, nc=00000001
Content-Length:  0


[Feb  4 19:07:15] NOTICE[593]: res_pjsip/pjsip_distributor.c:676 log_failed_request: Request 'REGISTER' from '"SIP" <sip:1001@172.28.12.58>' failed for '172.28.12.101:5060' (callid: e2be94e6-7ca5-4f5f-b098-7459741bab0f) - Failed to authenticate
<--- Transmitting SIP response (578 bytes) to UDP:172.28.12.101:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 172.28.12.101:5060;rport=5060;received=172.28.12.101;branch=z9hG4bKPjd0a2e826-ced7-4b0a-87d3-b3f02c15c4ba
Call-ID: e2be94e6-7ca5-4f5f-b098-7459741bab0f
From: "SIP" <sip:1001@172.28.12.58>;tag=bc2bfad0-3e32-41e6-a416-52d1718a1206
To: "SIP" <sip:1001@172.28.12.58>;tag=z9hG4bKPjd0a2e826-ced7-4b0a-87d3-b3f02c15c4ba
CSeq: 6734 REGISTER
WWW-Authenticate: Digest realm="asterisk",nonce="1675534035/d98a907ccbd6fb5670d7f3153b8649dd",opaque="5b08d90e7005fa40",algorithm=MD5,qop="auth"
Server: Asterisk PBX 20.1.0
Content-Length:  0

I only add to the pjsip.conf file:

;=============TEMPLATES TEST===================

[endpoint-basic](!)
type=endpoint
context=extensions
;transport=transport-udp
disallow=all
allow=all

[auth-userpass](!)
type=auth
auth_type=userpass

[aor-single-reg](!)
type=aor
max_contacts=1

;=============TEST===================

[1001](endpoint-basic)
auth=1001
aors=1001

[1001](auth-userpass)
password=1001
username=1001

[1001](aor-single-reg)

I put the username (1001) and the password (1001) in the softphone, but I don’t understand why is unauthorized. It’s strange to see in the logs “algorithm=MD5”, but I’m reading the official documentation and don’t see nothing about to hash the password.
I tried too with the pjsip examples with same result…
I have Asterisk 20 in a fresh vm (VirtualBox), first connected to a NAT network, but now directly to bridge.
I’m a noob with pjsip, but after read the wiki (too the migrating from SIP to PJSIP) i’m totally stucked.
Someone can guide me about my error (i’m sure that’s trivial, but I don’t find it).
Regards

401 is not an error; it is a normal part of authentication, handshake. algorithm=MD5 is also normal. Your logs do not show any errors or failure to authenticate.

allow=all will break some versions of Asterisk, but not in this way. It may also break elsewhere in the network, but for INVITE, not REGISTER.

Hello @david551, first of all, thank you for your reply.
Well, really it’s client failure response (error in registration), however the result is that the user can’t register.
I don’t see nothing strange, but I’m sure that my error is so trivial that I don’t know where is…
If I change the allow to: allow = !all,g722,ulaw I get the same error…
Regards

If the registrant is failing to authenticate, that is because it doesn’t know how to, e.g. it doesn’t have a password to give. Only the registrant will really know what went wrong.

On the other hand, if it had tried with authentication, and got a 403, or 603, that would indicate it sent the wrong password.

Codecs aren’t included in REGISTER.

@david551 thank you one more time for your help and patience.
Yes, I know, that’s the reason because I created this message, because because I’m noob with pjsip and can’t find what happens with the authentication, I’m really very stuck.
I activate logs with:

core set verbose 4
core set debug 4
pjsip set logger on

That’s I saw in the guide: Asterisk PJSIP Troubleshooting Guide - Asterisk Project - Asterisk Project Wiki
But I don’t know if I can get a more detailed logs. If I could see in the logs the user and the password for the register action, maybe I could do something more… But with a 401 I think there is a problem with the username or password (not bad credentials maybe empty fields), but I can’t check it.
It’s possible to have a more detailed logs?
One more time, thanks for your reply, and sorry for my english or/and my lack of knowledge of pjsip.
Regards

There are no user or password values in the 401. The nonce and opaque values are combined with the user and password, hashed and returned when the actual authentication happens. If the registrant doesn’t have those values, it cannot act on the challenge in the 401.

I wonder if your chan_sip configuration had, effectively, disabled authentication, e.g. by overuse of insecure=invite.

It’s a fresh installation of Asterisk 20 in a fresh installation of Debian 11, I’ve not installed the chan_sip.
It’s a testing vm for Asterisk 20, but neither I can’t register an extension…
I tried too with zoiper (another softphone), but same result (simply for discard problems with the SIP client).
Thanks for your help @david551

This is the full log:

<--- Received SIP request (550 bytes) from UDP:172.28.12.101:5060 --->
REGISTER sip:172.28.12.58 SIP/2.0
Via: SIP/2.0/UDP 172.28.12.101:5060;rport;branch=z9hG4bKPjb769770d-72da-43f1-91b8-5bdd750f4162
Max-Forwards: 70
From: "SIP" <sip:1001@172.28.12.58>;tag=4cce6291-0db7-4e44-99d3-c1c530c78322
To: "SIP" <sip:1001@172.28.12.58>
Call-ID: dbd47479-1b35-4102-9934-49b1d89e1ee5
CSeq: 14277 REGISTER
User-Agent: Ring Daemon/7.4.0
Contact: "SIP" <sip:1001@172.28.12.101:5060>
Expires: 60
Allow: PRACK, SUBSCRIBE, NOTIFY, REFER, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, OPTIONS, MESSAGE, PUBLISH
Content-Length:  0


<--- Transmitting SIP response (579 bytes) to UDP:172.28.12.101:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 172.28.12.101:5060;rport=5060;received=172.28.12.101;branch=z9hG4bKPjb769770d-72da-43f1-91b8-5bdd750f4162
Call-ID: dbd47479-1b35-4102-9934-49b1d89e1ee5
From: "SIP" <sip:1001@172.28.12.58>;tag=4cce6291-0db7-4e44-99d3-c1c530c78322
To: "SIP" <sip:1001@172.28.12.58>;tag=z9hG4bKPjb769770d-72da-43f1-91b8-5bdd750f4162
CSeq: 14277 REGISTER
WWW-Authenticate: Digest realm="asterisk",nonce="1675534015/89032bd9d35dda734f8a36e99ad17ee1",opaque="23b8e76467a06122",algorithm=MD5,qop="auth"
Server: Asterisk PBX 20.1.0
Content-Length:  0


<--- Received SIP request (841 bytes) from UDP:172.28.12.101:5060 --->
REGISTER sip:172.28.12.58 SIP/2.0
Via: SIP/2.0/UDP 172.28.12.101:5060;rport;branch=z9hG4bKPjad7b081d-3ecd-45af-b1fd-ea545ec7f44a
Max-Forwards: 70
From: "SIP" <sip:1001@172.28.12.58>;tag=4cce6291-0db7-4e44-99d3-c1c530c78322
To: "SIP" <sip:1001@172.28.12.58>
Call-ID: dbd47479-1b35-4102-9934-49b1d89e1ee5
CSeq: 14278 REGISTER
User-Agent: Ring Daemon/7.4.0
Contact: "SIP" <sip:1001@172.28.12.101:5060>
Expires: 60
Allow: PRACK, SUBSCRIBE, NOTIFY, REFER, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, OPTIONS, MESSAGE, PUBLISH
Authorization: Digest username="1001", realm="asterisk", nonce="1675534015/89032bd9d35dda734f8a36e99ad17ee1", uri="sip:172.28.12.58", response="c0cf650169612cc09f6971fe6a325a86", algorithm=MD5, cnonce="d248ff63-5b0e-4711-b74a-6d0942c04ad4", opaque="23b8e76467a06122", qop=auth, nc=00000001
Content-Length:  0


[Feb  4 19:06:55] NOTICE[593]: res_pjsip/pjsip_distributor.c:676 log_failed_request: Request 'REGISTER' from '"SIP" <sip:1001@172.28.12.58>' failed for '172.28.12.101:5060' (callid: dbd47479-1b35-4102-9934-49b1d89e1ee5) - Failed to authenticate
<--- Transmitting SIP response (579 bytes) to UDP:172.28.12.101:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 172.28.12.101:5060;rport=5060;received=172.28.12.101;branch=z9hG4bKPjad7b081d-3ecd-45af-b1fd-ea545ec7f44a
Call-ID: dbd47479-1b35-4102-9934-49b1d89e1ee5
From: "SIP" <sip:1001@172.28.12.58>;tag=4cce6291-0db7-4e44-99d3-c1c530c78322
To: "SIP" <sip:1001@172.28.12.58>;tag=z9hG4bKPjad7b081d-3ecd-45af-b1fd-ea545ec7f44a
CSeq: 14278 REGISTER
WWW-Authenticate: Digest realm="asterisk",nonce="1675534015/89032bd9d35dda734f8a36e99ad17ee1",opaque="399a94fb353aad0b",algorithm=MD5,qop="auth"
Server: Asterisk PBX 20.1.0
Content-Length:  0

OK. There are two cycles. It did try to authenticate, but for some reason got re-challenged.

The nonce doesn’t seem to be stale, so I don’t understand why. I’d turn up the logging and see if it gives a reason.

I’m not familiar with the handling of cnonce, but I assume that isn’t a problem.

Hello,
I tried now with my hardphone (Yealink T22P), and with the same configuration works (there are some errors with extensions *98 and *99 because don’t exist in this Asterisk context):

<--- Received SIP request (548 bytes) from UDP:172.28.12.121:5062 --->
REGISTER sip:172.28.12.58 SIP/2.0
Via: SIP/2.0/UDP 172.28.12.121:5062;branch=z9hG4bK2965467645
From: "Pruebas" <sip:1001@172.28.12.58>;tag=1134127850
To: "Pruebas" <sip:1001@172.28.12.58>
Call-ID: 114966780@172.28.12.121
CSeq: 1 REGISTER
Contact: <sip:1001@172.28.12.121:5062>
Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE
Max-Forwards: 70
User-Agent: Yealink SIP-T22P 7.73.0.50
Expires: 3600
Allow-Events: talk,hold,conference,refer,check-sync
Content-Length: 0


<--- Transmitting SIP response (488 bytes) to UDP:172.28.12.121:5062 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 172.28.12.121:5062;rport=5062;received=172.28.12.121;branch=z9hG4bK2965467645
Call-ID: 114966780@172.28.12.121
From: "Pruebas" <sip:1001@172.28.12.58>;tag=1134127850
To: "Pruebas" <sip:1001@172.28.12.58>;tag=z9hG4bK2965467645
CSeq: 1 REGISTER
WWW-Authenticate: Digest realm="asterisk",nonce="1675595372/d90f425554916379b9a857029cc85c31",opaque="423e41bc3f4b5398",algorithm=MD5,qop="auth"
Server: Asterisk PBX 20.1.0
Content-Length:  0


<--- Received SIP request (810 bytes) from UDP:172.28.12.121:5062 --->
REGISTER sip:172.28.12.58 SIP/2.0
Via: SIP/2.0/UDP 172.28.12.121:5062;branch=z9hG4bK100776375
From: "Pruebas" <sip:1001@172.28.12.58>;tag=1134127850
To: "Pruebas" <sip:1001@172.28.12.58>
Call-ID: 114966780@172.28.12.121
CSeq: 2 REGISTER
Contact: <sip:1001@172.28.12.121:5062>
Authorization: Digest username="1001", realm="asterisk", nonce="1675595372/d90f425554916379b9a857029cc85c31", uri="sip:172.28.12.58", response="3a3f5a4ef70d665ed404ae05593efca6", algorithm=MD5, cnonce="0a4f113b", opaque="423e41bc3f4b5398", qop=auth, nc=00000001
Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE
Max-Forwards: 70
User-Agent: Yealink SIP-T22P 7.73.0.50
Expires: 3600
Allow-Events: talk,hold,conference,refer,check-sync
Content-Length: 0


    -- Added contact 'sip:1001@172.28.12.121:5062' to AOR '1001' with expiration of 3600 seconds
<--- Transmitting SIP response (435 bytes) to UDP:172.28.12.121:5062 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 172.28.12.121:5062;rport=5062;received=172.28.12.121;branch=z9hG4bK100776375
Call-ID: 114966780@172.28.12.121
From: "Pruebas" <sip:1001@172.28.12.58>;tag=1134127850
To: "Pruebas" <sip:1001@172.28.12.58>;tag=z9hG4bK100776375
CSeq: 2 REGISTER
Date: Sun, 05 Feb 2023 11:09:32 GMT
Contact: <sip:1001@172.28.12.121:5062>;expires=3599
Expires: 3600
Server: Asterisk PBX 20.1.0
Content-Length:  0


  == Endpoint 1001 is now Reachable
<--- Received SIP request (425 bytes) from UDP:172.28.12.121:5062 --->
SUBSCRIBE sip:*88@172.28.12.58 SIP/2.0
Via: SIP/2.0/UDP 172.28.12.121:5062;branch=z9hG4bK1213557915
From: "Pruebas" <sip:1001@172.28.12.58>;tag=4173360969
To: <sip:*88@172.28.12.58>
Call-ID: 670878740@172.28.12.121
CSeq: 1 SUBSCRIBE
Contact: <sip:1001@172.28.12.121:5062>
Accept: application/dialog-info+xml
Max-Forwards: 70
User-Agent: Yealink SIP-T22P 7.73.0.50
Expires: 1800
Event: dialog
Content-Length: 0


<--- Transmitting SIP response (478 bytes) to UDP:172.28.12.121:5062 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 172.28.12.121:5062;rport=5062;received=172.28.12.121;branch=z9hG4bK1213557915
Call-ID: 670878740@172.28.12.121
From: "Pruebas" <sip:1001@172.28.12.58>;tag=4173360969
To: <sip:*88@172.28.12.58>;tag=z9hG4bK1213557915
CSeq: 1 SUBSCRIBE
WWW-Authenticate: Digest realm="asterisk",nonce="1675595372/d90f425554916379b9a857029cc85c31",opaque="06ca0cbd7ab3d5d7",algorithm=MD5,qop="auth"
Server: Asterisk PBX 20.1.0
Content-Length:  0


<--- Received SIP request (691 bytes) from UDP:172.28.12.121:5062 --->
SUBSCRIBE sip:*88@172.28.12.58 SIP/2.0
Via: SIP/2.0/UDP 172.28.12.121:5062;branch=z9hG4bK742910469
From: "Pruebas" <sip:1001@172.28.12.58>;tag=4173360969
To: <sip:*88@172.28.12.58>
Call-ID: 670878740@172.28.12.121
CSeq: 2 SUBSCRIBE
Contact: <sip:1001@172.28.12.121:5062>
Authorization: Digest username="1001", realm="asterisk", nonce="1675595372/d90f425554916379b9a857029cc85c31", uri="sip:*88@172.28.12.58", response="d96afdad5c75f7b2ff073af63d511202", algorithm=MD5, cnonce="0a4f113b", opaque="06ca0cbd7ab3d5d7", qop=auth, nc=00000001
Accept: application/dialog-info+xml
Max-Forwards: 70
User-Agent: Yealink SIP-T22P 7.73.0.50
Expires: 1800
Event: dialog
Content-Length: 0


[Feb  5 12:09:32] NOTICE[61132]: res_pjsip_exten_state.c:429 new_subscribe: Endpoint '1001' state subscription failed: Extension '*88' does not exist in context 'extensions' or has no associated hint
<--- Transmitting SIP response (327 bytes) to UDP:172.28.12.121:5062 --->
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 172.28.12.121:5062;rport=5062;received=172.28.12.121;branch=z9hG4bK742910469
Call-ID: 670878740@172.28.12.121
From: "Pruebas" <sip:1001@172.28.12.58>;tag=4173360969
To: <sip:*88@172.28.12.58>;tag=z9hG4bK742910469
CSeq: 2 SUBSCRIBE
Server: Asterisk PBX 20.1.0
Content-Length:  0


<--- Received SIP request (426 bytes) from UDP:172.28.12.121:5062 --->
SUBSCRIBE sip:*98@172.28.12.58 SIP/2.0
Via: SIP/2.0/UDP 172.28.12.121:5062;branch=z9hG4bK3342579464
From: "Pruebas" <sip:1001@172.28.12.58>;tag=4046678955
To: <sip:*98@172.28.12.58>
Call-ID: 2421951770@172.28.12.121
CSeq: 1 SUBSCRIBE
Contact: <sip:1001@172.28.12.121:5062>
Accept: application/dialog-info+xml
Max-Forwards: 70
User-Agent: Yealink SIP-T22P 7.73.0.50
Expires: 1800
Event: dialog
Content-Length: 0


<--- Transmitting SIP response (479 bytes) to UDP:172.28.12.121:5062 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 172.28.12.121:5062;rport=5062;received=172.28.12.121;branch=z9hG4bK3342579464
Call-ID: 2421951770@172.28.12.121
From: "Pruebas" <sip:1001@172.28.12.58>;tag=4046678955
To: <sip:*98@172.28.12.58>;tag=z9hG4bK3342579464
CSeq: 1 SUBSCRIBE
WWW-Authenticate: Digest realm="asterisk",nonce="1675595373/e9a93c1210f61c200b67729514ed13e3",opaque="7e8558f116a615dd",algorithm=MD5,qop="auth"
Server: Asterisk PBX 20.1.0
Content-Length:  0


<--- Received SIP request (692 bytes) from UDP:172.28.12.121:5062 --->
SUBSCRIBE sip:*98@172.28.12.58 SIP/2.0
Via: SIP/2.0/UDP 172.28.12.121:5062;branch=z9hG4bK484043980
From: "Pruebas" <sip:1001@172.28.12.58>;tag=4046678955
To: <sip:*98@172.28.12.58>
Call-ID: 2421951770@172.28.12.121
CSeq: 2 SUBSCRIBE
Contact: <sip:1001@172.28.12.121:5062>
Authorization: Digest username="1001", realm="asterisk", nonce="1675595373/e9a93c1210f61c200b67729514ed13e3", uri="sip:*98@172.28.12.58", response="8f91263b9bd802ef9ff388cf18a83a58", algorithm=MD5, cnonce="0a4f113b", opaque="7e8558f116a615dd", qop=auth, nc=00000001
Accept: application/dialog-info+xml
Max-Forwards: 70
User-Agent: Yealink SIP-T22P 7.73.0.50
Expires: 1800
Event: dialog
Content-Length: 0


[Feb  5 12:09:33] NOTICE[61132]: res_pjsip_exten_state.c:429 new_subscribe: Endpoint '1001' state subscription failed: Extension '*98' does not exist in context 'extensions' or has no associated hint
<--- Transmitting SIP response (328 bytes) to UDP:172.28.12.121:5062 --->
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 172.28.12.121:5062;rport=5062;received=172.28.12.121;branch=z9hG4bK484043980
Call-ID: 2421951770@172.28.12.121
From: "Pruebas" <sip:1001@172.28.12.58>;tag=4046678955
To: <sip:*98@172.28.12.58>;tag=z9hG4bK484043980
CSeq: 2 SUBSCRIBE
Server: Asterisk PBX 20.1.0
Content-Length:  0

Then, the problem must be with the softphone: Jami.
As you can see, all security options are disabled (to remove complexity from connection testing).





imagen
But if I try with other softphone (as linphone or zoiper) I can’t register…
Regards

Edit:
I think I found the solution: As I run Asterisk in a virtualized system (VirtualBox), when I compile the sources, compiler optimize the binary files for the CPU, but as it’s virtualized, it fails. The solution is when I do the “make menuselect” unselect in “Compiler Flags” the option “BUILD NATIVE” (uncheck the option).
I read this solution from @jcolp in some threads as Asterisk 13.1 Startup Failed - Please Assist and PJSIP calling issues , but I tried to do this without success along some days. Now I started once again from a new fresh installation on Debian 11, and selecting this option, and it worked (at least can register the extensions). Maybe some files were not overwritten after recompile without the “BUILD NATIVE” option… Maybe developers can find some bug in the make files that prevent to overwrite some binaries.

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.