SIP URI calls between 2 Asterisk servers

I am managing 2 Asterisk servers under different domains and trying to figure out how to make SIP URI calls between these 2 servers. There is a problem I could not figure out: both servers can receive incoming SIP URI calls from other SIP devices (ATAs or softphone) and both can make outbound SIP URI calls to other destinations, but the SIP URI calls between these two servers can not work. The sip.conf and extensions.conf (all irrelevant information are removed to make it simple) are listed below, which are identical for both servers except the hostnames. The scenario is when calling from one server to the other, the receiving server gives 401 unauthenticated error, but it is ok if the SIP URI from other source. Please help to see what is wrong. Thanks in advance.

; SIP Configuration for Asterisk
;
[general]
context=incoming		       ; Default context for incoming calls.
allowguest=yes          ; Allow or reject guest calls (default is yes).
allowoverlap=no        ; Disable overlap dialing support (default is yes).
bindport=5060          ; UDP Port to bind to.
bindaddr=0.0.0.0       ; IP address to bind to (0.0.0.0 binds to all).
srvlookup=yes          ; Enable DNS SRV lookups on outbound calls.
alwaysauthreject=yes   ; Reject calls with 401 
canreinvite=no         ; Whether or not peers
nat=yes                ; Whether our devices are behind NAT or not.
externhost=host1.com
externrefresh=15
localnet=192.168.1.0/255.255.255.0
qualify=yes

;All users
[500]
type=friend
username=500
secret=pwd1
host=dynamic
context=phone
canreinvite=no
dtmfmode=rfc2833
insecure=invite
nat=yes
[general]
static=no
writeprotect=no
autofallthrough=yes
clearglobalvars=no
priorityjumping=no

[outgoing]  
exten => _500,1,Dial(SIP/500@host2.com,50,tr)
exten => _500,n,Hangup()

exten => _501,1,Dial(SIP/50001@sipsorcery.com,50,tr)
exten => _501,n,Hangup()

[incoming]
exten => _500,1,Dial(SIP/500,50,tr)
exten => _500,n,Hangup()

[phone]
include => outgoing
include => incoming 

At a guess the result of using type=friend is causing you not to use the allowguest option. Most configurations work better with type=peer.

Also, you need to know one IP address, so why not use static addresses?

Consider setting allowguest to no.

[quote=“david55”]At a guess the result of using type=friend is causing you not to use the allowguest option. Most configurations work better with type=peer.

Also, you need to know one IP address, so why not use static addresses?

Consider setting allowguest to no.[/quote]

Thanks for the reply. The static address has the same issue. Actually, the sip invite packets has reached the receiving server, but the receiving server gives 401 error. If I use allowguest=no, then, it can not receive SIP URI calls from anywhere. With this setting, incoming SIP URI calls from other sources work without problem, but does not work for those from the other asterisk server. I tried to set type=peer, not work either.

With help from dslreports, I finally found out what is wrong: the two asterisk servers can not have the same usernames for peers. After using 501 for one server and 502 for another server, the SIP URI calls between these two servers work perfect now. The problem is that the receiving server treats the caller username not as guest but as peer if it finds the same username in its own user list, then requires authentication.

You will have to send us debugs from Asterisk CLI (verbosity atleast 3) and the output of “core set debug on” command when making a call. You need to do this for both servers (for the same call).
Make an effort and copy/paste only the things that reference to the call scenario.

The setup should be working fine, so you must have a small problem in your DialPlan. We should get it sorted soon :wink:

That confusion with names is why you use peer, rather than friend. Peer names should ony be used for register requests.

On the other hand, you should not be using guessable names.

[quote=“david55”]That confusion with names is why you use peer, rather than friend. Peer names should ony be used for register requests.

On the other hand, you should not be using guessable names.[/quote]

Using type=peer is the same, so, that might not be the problem. BTW, 501 etc is just my example. My actual usernames are different.

[quote=“dejanst”]You will have to send us debugs from Asterisk CLI (verbosity atleast 3) and the output of “core set debug on” command when making a call. You need to do this for both servers (for the same call).
Make an effort and copy/paste only the things that reference to the call scenario.

The setup should be working fine, so you must have a small problem in your DialPlan. We should get it sorted soon :wink:[/quote]

Thanks a lot for your concern. I will clean up the captured sip debug information and post here for your investigation.

[quote=“dejanst”]You will have to send us debugs from Asterisk CLI (verbosity atleast 3) and the output of “core set debug on” command when making a call. You need to do this for both servers (for the same call).
Make an effort and copy/paste only the things that reference to the call scenario.

The setup should be working fine, so you must have a small problem in your DialPlan. We should get it sorted soon :wink:[/quote]

Here is the sip trace from both sides. The scenario is: the peer 501 calls 500@host2.com through sip URI in the extensions.conf, while 501 also exists in the asterisk server in host2.com. This call can not go throught, but if no 501 exists in host2.com, then the call can go through. Hopefully someone can figure out why the SIP URI call can not go through if both sides have the same peer name.

Here is the sip trace from the calling side:

debian*CLI> sip set debug peer 501
SIP Debugging Enabled for IP: 218.xx.xx.xxx

<--- SIP read from UDP:218.xx.xx.xxx:49898 --->

<------------->

<--- SIP read from UDP:218.xx.xx.xxx:49898 --->
INVITE sip:500@host1.com SIP/2.0
Via: SIP/2.0/UDP 192.168.1.186:49898;rport;branch=z9hG4bKPjDDH-Y2bjaN-INqJmOcwFM7X5oJ6rgxCj
Max-Forwards: 70
From: "S. Myname" <sip:501@host1.com>;tag=yRU0cAr-4-BtQuYcX3KodZlm.ex1ya63
To: <sip:500@host1.com>
Contact: <sip:501@218.xx.xx.xxx:49898;ob>
Call-ID: zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs
CSeq: 17989 INVITE
Route: <sip:host1.com:5060;transport=udp;lr>
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: CSipSimple_hwu9508-15/r2180
Content-Type: application/sdp
Content-Length: 266

v=0
o=- 3573726236 3573726236 IN IP4 192.168.1.186
s=pjmedia
c=IN IP4 192.168.1.186
t=0 0
m=audio 4004 RTP/AVP 3 101
c=IN IP4 192.168.1.186
a=rtcp:4005 IN IP4 192.168.1.186
a=sendrecv
a=rtpmap:3 GSM/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
<------------->
--- (16 headers 12 lines) ---
Sending to 218.xx.xx.xxx:49898 (NAT)
Using INVITE request as basis request - zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs
Found peer '501' for '501' from 218.xx.xx.xxx:49898

<--- Reliably Transmitting (NAT) to 218.xx.xx.xxx:49898 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.1.186:49898;branch=z9hG4bKPjDDH-Y2bjaN-INqJmOcwFM7X5oJ6rgxCj;received=218.xx.xx.xxx;rport=49898
From: "S. Myname" <sip:501@host1.com>;tag=yRU0cAr-4-BtQuYcX3KodZlm.ex1ya63
To: <sip:500@host1.com>;tag=as400ad7a2
Call-ID: zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs
CSeq: 17989 INVITE
Server: Asterisk PBX 1.8.19.1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="6e22c5ef"
Content-Length: 0


<------------>
Scheduling destruction of SIP dialog 'zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs' in 28480 ms (Method: INVITE)

<--- SIP read from UDP:218.xx.xx.xxx:49898 --->
ACK sip:500@host1.com SIP/2.0
Via: SIP/2.0/UDP 192.168.1.186:49898;rport;branch=z9hG4bKPjDDH-Y2bjaN-INqJmOcwFM7X5oJ6rgxCj
Max-Forwards: 70
From: "S. Myname" <sip:501@host1.com>;tag=yRU0cAr-4-BtQuYcX3KodZlm.ex1ya63
To: <sip:500@host1.com>;tag=as400ad7a2
Call-ID: zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs
CSeq: 17989 ACK
Route: <sip:host1.com:5060;transport=udp;lr>
Content-Length: 0

<------------->
--- (9 headers 0 lines) ---

<--- SIP read from UDP:218.xx.xx.xxx:49898 --->
INVITE sip:500@host1.com SIP/2.0
Via: SIP/2.0/UDP 192.168.1.186:49898;rport;branch=z9hG4bKPjebGwKxCwsKFBkX8XdGjy2WMFVDbvYhCZ
Max-Forwards: 70
From: "S. Myname" <sip:501@host1.com>;tag=yRU0cAr-4-BtQuYcX3KodZlm.ex1ya63
To: <sip:500@host1.com>
Contact: <sip:501@218.xx.xx.xxx:49898;ob>
Call-ID: zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs
CSeq: 17990 INVITE
Route: <sip:host1.com:5060;transport=udp;lr>
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800
Min-SE: 90
User-Agent: CSipSimple_hwu9508-15/r2180
Authorization: Digest username="501", realm="asterisk", nonce="6e22c5ef", uri="sip:500@host1.com", response="d5aabf85197360d56e2b415a4493c8a0", algorithm=MD5
Content-Type: application/sdp
Content-Length: 266

v=0
o=- 3573726236 3573726236 IN IP4 192.168.1.186
s=pjmedia
c=IN IP4 192.168.1.186
t=0 0
m=audio 4004 RTP/AVP 3 101
c=IN IP4 192.168.1.186
a=rtcp:4005 IN IP4 192.168.1.186
a=sendrecv
a=rtpmap:3 GSM/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
<------------->
--- (17 headers 12 lines) ---
Sending to 218.xx.xx.xxx:49898 (NAT)
Using INVITE request as basis request - zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs
Found peer '501' for '501' from 218.xx.xx.xxx:49898
  == Using SIP RTP CoS mark 5
Found RTP audio format 3
Found RTP audio format 101
Found audio description format GSM for ID 3
Found audio description format telephone-event for ID 101
Capabilities: us - 0x6 (gsm|ulaw), peer - audio=0x2 (gsm)/video=0x0 (nothing)/text=0x0 (nothing), combined - 0x2 (gsm)
Non-codec capabilities (dtmf): us - 0x1 (telephone-event|), peer - 0x1 (telephone-event|), combined - 0x1 (telephone-event|)
Peer audio RTP is at port 192.168.1.186:4004
Looking for 500 in phone (domain host1.com)
list_route: hop: <sip:501@218.xx.xx.xxx:49898;ob>

<--- Transmitting (NAT) to 218.xx.xx.xxx:49898 --->
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 192.168.1.186:49898;branch=z9hG4bKPjebGwKxCwsKFBkX8XdGjy2WMFVDbvYhCZ;received=218.xx.xx.xxx;rport=49898
From: "S. Myname" <sip:501@host1.com>;tag=yRU0cAr-4-BtQuYcX3KodZlm.ex1ya63
To: <sip:500@host1.com>
Call-ID: zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs
CSeq: 17990 INVITE
Server: Asterisk PBX 1.8.19.1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces
Contact: <sip:500@98.xxx.xxx.x:5060>
Content-Length: 0


<------------>
    -- Executing [500@phone:1] Dial("SIP/501-0000002e", "SIP/500@host2.com,50,tr") in new stack
  == Using SIP RTP CoS mark 5
    -- Called SIP/500@host2.com

<--- Transmitting (NAT) to 218.xx.xx.xxx:49898 --->
SIP/2.0 180 Ringing
Via: SIP/2.0/UDP 192.168.1.186:49898;branch=z9hG4bKPjebGwKxCwsKFBkX8XdGjy2WMFVDbvYhCZ;received=218.xx.xx.xxx;rport=49898
From: "S. Myname" <sip:501@host1.com>;tag=yRU0cAr-4-BtQuYcX3KodZlm.ex1ya63
To: <sip:500@host1.com>;tag=as2d0061ef
Call-ID: zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs
CSeq: 17990 INVITE
Server: Asterisk PBX 1.8.19.1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces
Contact: <sip:500@98.xxx.xxx.x:5060>
Content-Length: 0


<------------>
[Mar 31 08:43:56] NOTICE[30498]: chan_sip.c:20824 handle_response_invite: Failed to authenticate on INVITE to '"S. Myname" <sip:501@98.xxx.xxx.x>;tag=as36951692'
    -- SIP/host2.com-0000002f is circuit-busy
  == Everyone is busy/congested at this time (1:0/1/0)
    -- Executing [500@phone:2] Hangup("SIP/501-0000002e", "") in new stack
  == Spawn extension (phone, 500, 2) exited non-zero on 'SIP/501-0000002e'
Scheduling destruction of SIP dialog 'zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs' in 28480 ms (Method: INVITE)

<--- Reliably Transmitting (NAT) to 218.xx.xx.xxx:49898 --->
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP 192.168.1.186:49898;branch=z9hG4bKPjebGwKxCwsKFBkX8XdGjy2WMFVDbvYhCZ;received=218.xx.xx.xxx;rport=49898
From: "S. Myname" <sip:501@host1.com>;tag=yRU0cAr-4-BtQuYcX3KodZlm.ex1ya63
To: <sip:500@host1.com>;tag=as2d0061ef
Call-ID: zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs
CSeq: 17990 INVITE
Server: Asterisk PBX 1.8.19.1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
upported: replaces
Content-Length: 0


<------------>

<--- SIP read from UDP:218.xx.xx.xxx:49898 --->
ACK sip:500@host1.com SIP/2.0
Via: SIP/2.0/UDP 192.168.1.186:49898;rport;branch=z9hG4bKPjebGwKxCwsKFBkX8XdGjy2WMFVDbvYhCZ
Max-Forwards: 70
From: "S. Myname" <sip:501@host1.com>;tag=yRU0cAr-4-BtQuYcX3KodZlm.ex1ya63
To: <sip:500@host1.com>;tag=as2d0061ef
Call-ID: zT2ICdsrPQ0Z17R7Y8TR2xWwmNmEBQxs
CSeq: 17990 ACK
Route: <sip:host1.com:5060;transport=udp;lr>
Content-Length: 0

<------------->
--- (9 headers 0 lines) ---
Reliably Transmitting (NAT) to 218.xx.xx.xxx:49898:
OPTIONS sip:501@218.xx.xx.xxx:49898;ob SIP/2.0
Via: SIP/2.0/UDP 98.xxx.xxx.x:5060;branch=z9hG4bK197d60aa;rport
Max-Forwards: 70
From: "asterisk" <sip:asterisk@98.xxx.xxx.x>;tag=as14754a8a
To: <sip:501@218.xx.xx.xxx:49898;ob>
Contact: <sip:asterisk@98.xxx.xxx.x:5060>
Call-ID: 69c162c139806a40532e30562208914c@98.xxx.xxx.x:5060
CSeq: 102 OPTIONS
User-Agent: Asterisk PBX 1.8.19.1
Date: Sun, 31 Mar 2013 13:43:59 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces
Content-Length: 0


---

<--- SIP read from UDP:218.xx.xx.xxx:49898 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 98.xxx.xxx.x:5060;rport=5060;received=98.xxx.xxx.x;branch=z9hG4bK197d60aa
Call-ID: 69c162c139806a40532e30562208914c@98.xxx.xxx.x:5060
From: "asterisk" <sip:asterisk@98.xxx.xxx.x>;tag=as14754a8a
To: <sip:501@218.xx.xx.xxx;ob>;tag=z9hG4bK197d60aa
CSeq: 102 OPTIONS
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Accept: application/sdp, application/pidf+xml, application/xpidf+xml, application/simple-message-summary, message/sipfrag;version=2.0, application/im-iscomposing+xml, text/plain
Supported: replaces, 100rel, timer, norefersub
Allow-Events: presence, message-summary, refer
User-Agent: CSipSimple_hwu9508-15/r2180
Content-Type: application/sdp
Content-Length: 208

v=0
o=- 3573726240 3573726240 IN IP4 192.168.1.186
s=pjmedia
t=0 0
m=audio 4000 RTP/AVP 3 101
c=IN IP4 192.168.1.186
a=sendrecv
a=rtpmap:3 GSM/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
<------------->
--- (13 headers 10 lines) ---
Really destroying SIP dialog '69c162c139806a40532e30562208914c@98.xxx.xxx.x:5060' Method: OPTIONS
debian*CLI> sip set debug off

Here is the sip trace from receiving side:

debian*CLI> sip set debug on
SIP Debugging enabled
<--- SIP read from UDP:98.xxx.xxx.1:5060 --->
INVITE sip:500@host2.com SIP/2.0
Via: SIP/2.0/UDP 98.xxx.xxx.1:5060;branch=z9hG4bK57e56fc9;rport
Max-Forwards: 70
From: "Myname" <sip:501@98.xxx.xxx.1>;tag=as1e765216
To: <sip:500@host2.com>
Contact: <sip:501@98.xxx.xxx.1:5060>
Call-ID: 2e7e8b597d805cb70c78465e047e9b92@98.xxx.xxx.1:5060
CSeq: 102 INVITE
User-Agent: Asterisk PBX 1.8.19.1
Date: Sun, 24 Mar 2013 02:27:50 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces
Content-Type: application/sdp
Content-Length: 316
  
v=0
o=root 894359558 894359558 IN IP4 98.xxx.xxx.1
s=Asterisk PBX 1.8.19.1
c=IN IP4 98.xxx.xxx.1
t=0 0
m=audio 16802 RTP/AVP 3 0 111 101
a=rtpmap:3 GSM/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:111 G726-32/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=silenceSupp:off - - - -
a=ptime:20
a=sendrecv
<------------->
--- (14 headers 14 lines) ---
Sending to 98.xxx.xxx.1:5060 (NAT)
Using INVITE request as basis request - 2e7e8b597d805cb70c78465e047e9b92@98.xxx.xxx.1:5060
Found peer '501' for '501' from 98.xxx.xxx.1:5060
  
<--- Reliably Transmitting (NAT) to 98.xxx.xxx.1:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 98.xxx.xxx.1:5060;branch=z9hG4bK57e56fc9;received=98.xxx.xxx.1;rport=5060
From: "Myname" <sip:501@98.xxx.xxx.1>;tag=as1e765216
To: <sip:500@host2.com>;tag=as45b8c1d8
Call-ID: 2e7e8b597d805cb70c78465e047e9b92@98.xxx.xxx.1:5060
CSeq: 102 INVITE
Server: Asterisk PBX 1.8.19.1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="43a60df0"
Content-Length: 0
  
<------------>
Scheduling destruction of SIP dialog '2e7e8b597d805cb70c78465e047e9b92@98.xxx.xxx.1:5060' in 7296 ms (Method: INVITE)
Retransmitting #1 (NAT) to 98.xxx.xxx.1:5060:
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 98.xxx.xxx.1:5060;branch=z9hG4bK57e56fc9;received=98.xxx.xxx.1;rport=5060
From: "Myname" <sip:501@98.xxx.xxx.1>;tag=as1e765216
To: <sip:500@host2.com>;tag=as45b8c1d8
Call-ID: 2e7e8b597d805cb70c78465e047e9b92@98.xxx.xxx.1:5060
CSeq: 102 INVITE
Server: Asterisk PBX 1.8.19.1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="43a60df0"
Content-Length: 0
  
---
  
<--- SIP read from UDP:98.xxx.xxx.1:5060 --->
ACK sip:500@host2.com SIP/2.0
Via: SIP/2.0/UDP 98.xxx.xxx.1:5060;branch=z9hG4bK57e56fc9;rport
Max-Forwards: 70
From: "Myname" <sip:501@98.xxx.xxx.1>;tag=as1e765216
To: <sip:500@host2.com>;tag=as45b8c1d8
Contact: <sip:501@98.xxx.xxx.1:5060>
Call-ID: 2e7e8b597d805cb70c78465e047e9b92@98.xxx.xxx.1:5060
CSeq: 102 ACK
User-Agent: Asterisk PBX 1.8.19.1
Content-Length: 0
  
<------------->
--- (10 headers 0 lines) ---
debian*CLI> sip set debug off

Why in the heck you want to use the same extension numbers on both servers? Separate them!

Well, I don’t need to use the same extensions on both sides. For my settting, using different names are fine to me. Just curious why it does not work with the same extensions on both servers, what is the logic for not allowing the same names. If nobody knows the answer, I can move on since my problem has bee solved with different extensions.

If the local phone are friends, they will match the From header in the call from the other side.

This only happens if you ignore the security advice, repeated in an emailing from Digium in the last couple of weeks, and use one of the extension numbers for the device as the device name. A suggested safe name for the device is the MAC address. This does mean you have to a have a Dial line for each device, or do a database lookup.

However, in almost all cases, local phones should actually be peers, not friends. I probably didn’t make it clear that all your friends should be peers.

[quote=“david55”]
However, in almost all cases, local phones should actually be peers, not friends. I probably didn’t make it clear that all your friends should be peers.[/quote]

David: Thanks a lot for your instruction. You are right, after I change all users to peer from friend, the SIP URI calls work perfect even with same usernames in different server. Before, I only tried to change some some of those users to peers, which made the calls fail when having same usernames. So now, my case is completely closed.