SRTP issue on some hardware phones

Hello,
I have issue with SRTP. When using softphone connected to my asterisk server, SRTP works ok.
If i try calling from a Grandstream GXP2130 phone with enabled SRTP my server shows 488 Not Acceptable Here.
On my GXP2130 if i disable SRTP it works fine.

Below are sample sip messages

  1. GXP2130, SRTP enabled, 100 Trying and then failing with 488 Not acceptable here:

INVITE sip:066*******@voip*****:5061 SIP/2.0
Via: SIP/2.0/TLS 192.168.100.103:52665;branch=z9hG4bK1718427006;rport;alias
From: sip:103@voip:5061******;tag=1483956476
To: sip:066*******@voip:5061*****
Call-ID: 502091212-5063-4@BJC.BGI.BAA.BAD
CSeq: 21 INVITE
Contact: sips:103@192.168.100.103:52665;transport=tls
Authorization: Digest username=“103”, realm=“asterisk”, nonce=“1573049009/ead44f581fdcfa1ba3d82502a06da4be”, uri="sip:066******$…
Max-Forwards: 70
User-Agent: Grandstream GXP2130 1.0.9.26
Privacy: none
P-Preferred-Identity: sip:103@voip:5061*******
Supported: replaces, path, timer
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, UPDATE, MESSAGE
Content-Type: application/sdp
Accept: application/sdp, application/dtmf-relay
Content-Length: 601

v=0
o=103 8000 8000 IN IP4 192.168.100.103
s=SIP Call
c=IN IP4 192.168.100.103
t=0 0
m=audio 5204 RTP/SAVP 8 101
a=sendrecv
a=rtpmap:8 PCMA/8000
a=ptime:20
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=crypto:1 AES_CM_256_HMAC_SHA1_80 inline:F/0scmDP6keRNoDEMPMLwWOoYPztu/S+wfWZOcsPsOIM3VRsrD+0PnU0AqYnDWeL
a=crypto:2 AES_CM_256_HMAC_SHA1_32 inline:tciHooN7YERx+n48CS4fFQtzgbiyNfYoavjOkQU1HLr9pFyAH73FkLdDzcBx7NV9
a=crypto:3 AES_CM_128_HMAC_SHA1_80 inline:thrc7R2DH9NScK45FJf+Vg4oqLtei6wKC3HUmv9B
a=crypto:4 AES_CM_128_HMAC_SHA1_32 inline:h7VbY6N458JMOTL6ckeRcJ2fmUVa99AGAdt41nV3

  1. Same GXP2130, SRTP disabled, works OK:

INVITE sip:066***********@voip*****:5061 SIP/2.0
Via: SIP/2.0/TLS 192.168.100.103:42812;branch=z9hG4bK1533293156;rport;alias
From: sip:103@voip:5061*****;tag=1693902311
To: sip:066******@voip:5061*****
Call-ID: 2016177651-5063-4@BJC.BGI.BAA.BAD
CSeq: 21 INVITE
Contact: sips:103@192.168.100.103:42812;transport=tls
Authorization: Digest username=“103”, realm=“asterisk”, nonce=“1573047675/54e46990918ec4164665e46c128bf107”, uri="sip:066*****$…
Max-Forwards: 70
User-Agent: Grandstream GXP2130 1.0.9.26
Privacy: none
P-Preferred-Identity: sip:103@voip:5061******
Supported: replaces, path, timer
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, UPDATE, MESSAGE
Content-Type: application/sdp
Accept: application/sdp, application/dtmf-relay
Content-Length: 216

v=0
o=103 8000 8000 IN IP4 192.168.100.103
s=SIP Call
c=IN IP4 192.168.100.103
t=0 0
m=audio 5204 RTP/AVP 8 101
a=sendrecv
a=rtpmap:8 PCMA/8000
a=ptime:20
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15

  1. Dial from softphone, SRTP enabled, works OK:

INVITE sip:098********@voip*****;transport=TLS SIP/2.0
Via: SIP/2.0/TLS 192.168.0.39:51240;branch=z9hG4bK-524287-1—34c6db2bf82045ca;rport
Max-Forwards: 70
Contact: sip:105@77:46919******;transport=TLS
To: sip:098*******@voip*****
From: sip:105@voip*****;transport=TLS;tag=06732823
Call-ID: IIWglrKr4bqFwDsZao8Iew…
CSeq: 2 INVITE
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
Content-Type: application/sdp
User-Agent: Zoiper rv2.10.3.0
Authorization: Digest username=“105”,realm=“asterisk”,nonce=“1573052113/773eab29d5c2a7f0defb5b317ec7085b”,uri="sip:098*****$
Allow-Events: presence, kpml, talk
Content-Length: 1243

v=0
o=Zoiper 1573052112839 1 IN IP4 192.168.0.39
s=Z
c=IN IP4 192.168.0.39
t=0 0
m=audio 36212 RTP/SAVP 8 101 0 3 97 110
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=rtpmap:97 iLBC/8000
a=fmtp:97 mode=30
a=rtpmap:110 speex/8000
a=sendrecv
a=crypto:5 AES_256_CM_HMAC_SHA1_80 inline:Vmb208g9gmTVMI+VMDTqVgDCvOKPhkzGQBVwWas41UCEu9H0NHRC+uZnNIAR6g==
a=crypto:6 AES_256_CM_HMAC_SHA1_32 inline:Vmb208g9gmTVMI+VMDTqVgDCvOKPhkzGQBVwWas41UCEu9H0NHRC+uZnNIAR6g==
a=crypto:9 AES_CM_256_HMAC_SHA1_80 inline:Vmb208g9gmTVMI+VMDTqVgDCvOKPhkzGQBVwWas41UCEu9H0NHRC+uZnNIAR6g==
a=crypto:10 AES_CM_256_HMAC_SHA1_32 inline:Vmb208g9gmTVMI+VMDTqVgDCvOKPhkzGQBVwWas41UCEu9H0NHRC+uZnNIAR6g==
a=crypto:3 AES_192_CM_HMAC_SHA1_80 inline:Vmb208g9gmTVMI+VMDTqVgDCvOKPhkzGQBVwWas41UCEu9H0NHQ=
a=crypto:4 AES_192_CM_HMAC_SHA1_32 inline:Vmb208g9gmTVMI+VMDTqVgDCvOKPhkzGQBVwWas41UCEu9H0NHQ=
a=crypto:7 AES_CM_192_HMAC_SHA1_80 inline:Vmb208g9gmTVMI+VMDTqVgDCvOKPhkzGQBVwWas41UCEu9H0NHQ=
a=crypto:8 AES_CM_192_HMAC_SHA1_32 inline:Vmb208g9gmTVMI+VMDTqVgDCvOKPhkzGQBVwWas41UCEu9H0NHQ=
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:Vmb208g9gmTVMI+VMDTqVgDCvOKPhkzGQBVwWas4
a=crypto:2 AES_CM_128_HMAC_SHA1_32 inline:Vmb208g9gmTVMI+VMDTqVgDCvOKPhkzGQBVwWas4

Any suggestions why my asterisk server is not working with GXP2130 SRTP enabled?
How can i debug “488 Not acceptable here” message to see what exactly is not acceptable?

SRTP has to be explicitly enabled in Asterisk. What channel driver are you using? What is the configuration for the SIP user/peer or endpoint? Is SRTP enabled for it?

jcolp, i was about to post the config for the [103] user and seen it has media_encryption=no
Thank you very much.