SIP trunk registers but incoming call fails with error 481

Asterisk Asterisk Support
1

I am using a SIP trunk provider in the UK called Voipfone who provide extensions in the format of
accountIDextension, eg: 123456200.

You “attach” a real phone number to that extension. ie: someone dialing 0123-456 would be attached to extension 200.

The Caller ID can be either in the form of the number calling or the number called.
I’ve tried both.

I also tried changing and commenting out from_user and from_domain because at this stage it doesn’t seem to matter. I’ve only got one incoming line to play a test message.

I also tried the various NAT and port fixes currently as shown at the end of the endpoint config section.

I got in touch with the trunk provider who said everything looked good from their end, except that I appeared to have SIP ALG enabled - he said I might want to disable this.

This is running on a Ubuntu 15.10 Digitalocean Droplet with currently no firewall running AFAIK.
Nonetheless, I googled and applied modprobe -r nf_nat_sip but with no success.

pjsip config examples are rather a rare beast at the moment, so I’m going on a mix of the pjsip.sample, various wiki entries and posts in this forum. If anyone can spot anything wrong here I’d be hugely grateful!

[size=150]extensions.conf[/size]

[fromvoipfone] exten => 200,1,Answer() same => n,Wait(1) same => n,Playback(hello-world) same => n,Hangup()

[size=150]pjsip.conf[/size]

[code];===============TRANSPORT

[simpletrans]
type = transport
protocol = UDP
bind = 0.0.0.0

;===============VOIPFONE

[voipfone]
type = registration
retry_interval = 20
max_retries = 10
contact_user = voipfone
expiration = 120
transport = simpletrans
outbound_auth = voipfone
client_uri = sip:3XXXXXX*200@sip.voipfone.net
server_uri = sip:sip.voipfone.net

[voipfone]
type = aor
contact = sip:3XXXXXX*200@sip.voipfone.net

[voipfone]
type = identify
endpoint = voipfone
match = sip.voipfone.net

[voipfone]
type = auth
auth_type = userpass
username = 3XXXXXX*200
password = XXXXXX

[voipfone]
type = endpoint
context = fromvoipfone
dtmf_mode = rfc4733
disallow = all
allow = alaw,gsm
;from_user = 3XXXXXX*200
;from_domain = sip.voipfone.net
auth = voipfone
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes ; necessary if endpoint does not know/register public ip:port
ice_support=yes
aors = voipfone[/code]

[size=150]Log[/size]

<--- Received SIP request (867 bytes) from UDP:195.189.173.27:5060 --->
INVITE sip:voipfone@X.X.X.X:5060 SIP/2.0
Via: SIP/2.0/UDP 195.189.173.27:5060;branch=XXXXXXX;rport
From: "01XXXXXXXXX" <sip:01XXXXXXXXX@195.189.173.27>;tag=XXXXXXX
To: <sip:voipfone@X.X.X.X:5060>
Contact: <sip:01XXXXXXXXX@195.189.173.27>
Call-ID: VFffdd4b638936ad3eafbd811f4bb292@voipfone
CSeq: 102 INVITE
User-Agent: Voipfone Sip Network
Date: Mon, 09 Nov 2015 16:10:36 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER
Content-Type: application/sdp
Content-Length: 337

v=0
o=root 26994 26994 IN IP4 195.189.173.27
s=session
c=IN IP4 195.189.173.27
t=0 0
m=audio 13002 RTP/AVP 8 2 97 3 110 101
a=sendrecv
a=rtpmap:8 PCMA/8000
a=rtpmap:2 G726-32/8000
a=rtpmap:97 iLBC/8000
a=rtpmap:3 GSM/8000
a=rtpmap:110 speex/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=silenceSupp:off - - - -

<--- Transmitting SIP response (533 bytes) to UDP:195.189.173.27:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 195.189.173.27:5060;rport=5060;received=195.189.173.27;branch=XXXXXXX
Call-ID: VFffdd4b638936ad3eafbd811f4bb292@voipfone
From: "01XXXXXXXXX" <sip:01XXXXXXXXX@195.189.173.27>;tag=XXXXXXX
To: <sip:voipfone@X.X.X.X>;tag=XXXXXXX
CSeq: 102 INVITE
WWW-Authenticate: Digest  realm="asterisk",nonce="XXXXXXX",opaque="XXXXXXX",algorithm=md5,qop="auth"
Server: Asterisk PBX 13.6.0
Content-Length:  0


<--- Received SIP request (411 bytes) from UDP:195.189.173.27:5060 --->
CANCEL sip:voipfone@X.X.X.X:5060 SIP/2.0
Via: SIP/2.0/UDP 195.189.173.27:5060;branch=z9hG4bK107fcf4f;rport
From: "01XXXXXXXXX" <sip:01XXXXXXXXX@195.189.173.27>;tag=VF7ac63d4bd8208e0621d7096b2824
To: <sip:voipfone@X.X.X.X:5060>
Contact: <sip:01XXXXXXXXX@195.189.173.27>
Call-ID: XXXXXXX@voipfone
CSeq: 102 CANCEL
User-Agent: Voipfone Sip Network
Content-Length: 0


[Nov  9 16:10:36] ERROR[811]: res_pjsip/pjsip_distributor.c:221 find_dialog: Could not find matching INVITE transaction for CANCEL request
<--- Transmitting SIP response (405 bytes) to UDP:195.189.173.27:5060 --->
SIP/2.0 481 Call/Transaction Does Not Exist
Via: SIP/2.0/UDP 195.189.173.27:5060;rport=5060;received=195.189.173.27;branch=XXXXXXX
Call-ID: VFffdd4b638936ad3eafbd811f4bb292@voipfone
From: "01XXXXXXXXX" <sip:01XXXXXXXXX@195.189.173.27>;tag=VF7ac63d4bd8208e0621d7096b2824
To: <sip:voipfone@X.X.X.X>;tag=z9hG4bK107fcf4f
CSeq: 102 CANCEL
Server: Asterisk PBX 13.6.0
Content-Length:  0

(BTW - yes, I know it’s probably a security nightmare at the moment - there’s no credit in the account so no calls can be made, it gets turned off when I’m not actively working on it, and I’ve got a console log open to watch for baddies!)

2

You are asking them to authenticate themselves. ITSP’s generally won’t do that, so they abort the call.

On chan_sip, you would use remotesecret, rather than secret, or the older hack of insecure=invite, with secret. I’m not familiar with PJSIP.

3

Thanks for your quick reply, David.

The thing is, though - registration IS successful. The two endpoints are connected together, it’s just that a fraction of a second before the call bounces back to my SIP trunk supplier’s default failover voicemail, it does actually hit my endpoint. From what Voipfone told me, there’s no authentication issue here.

Besides, pjsip appears not to offer any option of “remotesecure” or “insecure”.

I think the answer lies more in the error “SIP/2.0 481 Call/Transaction Does Not Exist” and a possible misconfig elsewhere, rather than authentication. But I could be wrong!

4

The 481 is a secondary fault. The primary problem is that the ITSP has cancelled, a transaction that was already complete. It has clearly cancelled it because it got a 401 insisting on its supplying authentication data, which it is not going to be able to do. It is not legal to cancel in response to 401, because 401 is a final response, and completes the transaction.

Also, you have either inconsistently redacted or the cancel doesn’t even include the tags and ids for a call that ever existed.

5

Thanks for your help so far, and it’s guided me to the correct bits of the wiki, but I am totally stumped. Just hitting midnight here and been at this since about 8am.

I just go round and round and round and round with google, trying to find example configs for other ITSPs that I might be able to adapt. And round and round and round and round with the wiki, going over it again and again and again with a fine tooth comb, checking the endpoints, identifiers and auth, looking at the logs, matching it to what should be happening.

wiki.asterisk.org/wiki/display/ … istrations
wiki.asterisk.org/wiki/display/ … gistration
wiki.asterisk.org/wiki/display/ … _pjsip_acl
wiki.asterisk.org/wiki/display/ … ion+Wizard
wiki.asterisk.org/wiki/display/ … +res_pjsip

Going to try and sleep on it, but if anyone can shed any light meantime I’d be massively grateful!

Thanks.

6

Thanks for the help here - finally resolved it. Will type up more detailed explanation when I’ve caught up on sleep!

Meantime, I’ve started a new clean thread with a working config viewtopic.php?f=1&t=96178