# Sip trunk over tls not authenticated by ip **URL:** \ **Category:** Asterisk SIP\ **Created:** [September 4, 2023, 10:21am UTC](https://community.asterisk.org/t/sip-trunk-over-tls-not-authenticated-by-ip/98490 "2023-09-04T10:21:02Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Drass](https://avatars.discourse-cdn.com/v4/letter/d/e495f1/32.png) [@Drass](https://community.asterisk.org/u/Drass)\ **Post date:** [September 4, 2023, 10:21am UTC](https://community.asterisk.org/t/sip-trunk-over-tls-not-authenticated-by-ip/98490/1 "2023-09-04T10:21:02Z")
Hi, I have a problem with a sip trunk or my provider configured on asterisk 13.22 over chan\_sip. I have configured sip trunk over ip with tls , the outgoing calls work fine, but asterisk refuse the call with a SIP/2.0 401 Unauthorized. The configuration of sip trunk: [SBC] disallow=all type=peer transport=tls insecure=port,invite qualify=yes host=ip\_oftrunk encryption=yes context=from-trunk allow=alaw nat=force\_rport,comedia port=5061 dtmfmode=auto here art a sip trace of invite, obiosly i changed the private data of ips domains etc: \<— SIP read from TLS:XXXXX:35780 —\> INVITE sip:91XXXXXX@pbx-corpXXX.com:5061;transport=tls SIP/2.0 Via: SIP/2.0/TLS X.X.X.X:5061;branch=z9hG4bKo6899u2068notcra7130.1 To: sip:9XXXX@pbx-corp.XXX.com From: sip:91XXXXX@smtXXXXX;user=phone;tag=lm4q4zyj-23dhxr;correlation-id=55751636 Call-ID: 192.168.126.41\_55959020\_6526775462368711112 CSeq: 1 INVITE Max-Forwards: 62 Content-Length: 382 Contact: sip:smtcXXXXs:5061;fid=fid\_1;transport=tls Content-Type: application/sdp Allow: INVITE, ACK, OPTIONS, BYE, CANCEL, PRACK Accept: application/sdp Supported: histinfo, timer P-Asserted-Identity: sip:9XXXXXX@smtcXXXX;user=phone Min-SE: 180 Session-Expires: 1800; refresher=uac P-Acme-Vsa: 200:c020.s20.icx.XXX.net P-Early-Media: supported X-CND: 5283349168674273844250 v=0 o=- 11849918 11849918 IN IP4 X.X.X.X s=- c=IN IP4 X.X.X.X t=0 0 a=sendrecv m=audio 22146 RTP/SAVP 8 18 96 c=IN IP4 X.X.X.X b=RR:3000 b=RS:1000 b=AS:128 a=rtpmap:8 PCMA/8000 a=rtpmap:18 G729/8000 a=rtpmap:96 telephone-event/8000 a=fmtp:96 0-15 a=maxptime:40 a=ptime:20 a=crypto:1 AES\_CM\_128\_HMAC\_SHA1\_80 inline:ZDQ6OYPfcARbHk8+Pv01SBlFQjSgXUeNoHcX3xxJ \<-------------\> — (19 headers 18 lines) — Sending to X.X.X.X:35780 (NAT) Sending to X.X.X.X:35780 (NAT) Using INVITE request as basis request - 192.168.126.41\_55959020\_6526775462368711112 No matching peer for ‘916XXXXXX’ from ‘X.X:X.X:35780’ I think that problem are that the calls arrive with the origing port 35780, because if i changed port=5061 by port=35780 asterisk accept the call… by the way, when I changed the sip trunk name SBC BY number that calling 91XXXXXX, asterisk accept the call. Im confused because asterisk should accept the call of any port with insecure=port,invite, and accept the call by ip defined host=X.X.X.X. Any ideas? SBC X.X.X.X Yes Yes A 5061 OK (24 ms) Thanks ---
**Author:** ![david551](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@david551](https://community.asterisk.org/u/david551)\ **Post date:** [September 4, 2023, 1:20pm UTC](https://community.asterisk.org/t/sip-trunk-over-tls-not-authenticated-by-ip/98490/2 "2023-09-04T13:20:45Z")
XXXXX should be ip\_oftrunk Asterisk 13 is end of life. chan\_sip will not be in the version released next month, and is, effectively unsupported. ---
**Author:** ![Drass](https://avatars.discourse-cdn.com/v4/letter/d/e495f1/32.png) [@Drass](https://community.asterisk.org/u/Drass)\ **Post date:** [September 4, 2023, 1:23pm UTC](https://community.asterisk.org/t/sip-trunk-over-tls-not-authenticated-by-ip/98490/3 "2023-09-04T13:23:35Z")
of coursde, XXXX is the ip, I now that asterisk 13 an chan\_sip are unsuported, but I have a client with imposibility of migrate now, and this should work on chan\_sip. Any ideas? ---
**Author:** ![david551](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@david551](https://community.asterisk.org/u/david551)\ **Post date:** [September 4, 2023, 1:25pm UTC](https://community.asterisk.org/t/sip-trunk-over-tls-not-authenticated-by-ip/98490/4 "2023-09-04T13:25:51Z")
If you obfuscate information we will assume that different obfuscated values represent different original values. ---
**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\ **Post date:** [September 4, 2023, 2:16pm UTC](https://community.asterisk.org/t/sip-trunk-over-tls-not-authenticated-by-ip/98490/5 "2023-09-04T14:16:25Z")
Entirely possible that version had a bug with TCP/TLS transports and matching. I vaguely recall such a thing. ---
**Author:** ![Drass](https://avatars.discourse-cdn.com/v4/letter/d/e495f1/32.png) [@Drass](https://community.asterisk.org/u/Drass)\ **Post date:** [September 4, 2023, 2:49pm UTC](https://community.asterisk.org/t/sip-trunk-over-tls-not-authenticated-by-ip/98490/6 "2023-09-04T14:49:56Z")
I think the same… ---
**Author:** ![Drass](https://avatars.discourse-cdn.com/v4/letter/d/e495f1/32.png) [@Drass](https://community.asterisk.org/u/Drass)\ **Post date:** [September 4, 2023, 4:45pm UTC](https://community.asterisk.org/t/sip-trunk-over-tls-not-authenticated-by-ip/98490/7 "2023-09-04T16:45:23Z")
I see this in changelog od version 13.22.0 [http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.22.0](http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.22.0) 2017-12-04 05:27 +0000 [64942276d1] Alexander Traud [pabstraud@compuserve.com](mailto:pabstraud@compuserve.com) ``` * chan_sip: Peers with distinct source ports don't match, regardless of transport. Previously, peers connected via TCP (or TLS) were matched by ignoring their source port. One cannot say anything when protocol:IP:port match, yes (see ). However, when the ports do not match, the peers do not match as well. This change allows two peers connected to an Asterisk server via TCP (or TLS) behind a NAT (= same source IP address) to be differentiated via their port as well. ASTERISK-27457 Reported by: Stephane Chazelas Change-Id: Id190428bf1d931f2dbfd4b293f53ff8f20d98efa ``` Seems to be the issue, resolved? dont work for me… ---
**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\ **Post date:** [September 4, 2023, 5:43pm UTC](https://community.asterisk.org/t/sip-trunk-over-tls-not-authenticated-by-ip/98490/8 "2023-09-04T17:43:47Z")
Don’t know then! ---
**Author:** ![system](https://global.discourse-cdn.com/asterisk/original/2X/4/475d0c889911cfb84ac4881ad6df8b523e3f9105.png) [@system](https://community.asterisk.org/u/system)\ **Post date:** [October 4, 2023, 5:44pm UTC](https://community.asterisk.org/t/sip-trunk-over-tls-not-authenticated-by-ip/98490/9 "2023-10-04T17:44:05Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.