T38 fallback to g711 is not working

Hi Guys,

my scenario is:

Linksys SPA112 (t38 enabled) <—> asterisk 13.26-cert3 <—> Linksys SPA112 (t38 disabled)

The t38 enabled linksys has directory number 6004, the other one (t38 disabled) has directory number 6005.

I am using PJSIP has SIP channel.

The call start from the t38 enabled endpoint and first part of the calls goes up with g729.
The t38enabled endpoint sends INVITE with t38 and asterisk correctly propagate the INVITE, the other linksys refuse with 488 Not Acceptable Here, the t38enabled endpoint sends a new INVITE with G711 (negotiated codec was g729) but at this point asterisk didn’t propagate the INVITE to the second linksys, so one leg (the t38enabled) switch to G711, the other side stay with G729 and the fax call fail.

I quite sure that asterisk should propagate the second REINVITE to the other endpoint but this not happen, i have also tried with chan_sip with more or less the same behaviour.

This is the endpoint template:

[default_user_endpoint](!)
type=endpoint
transport=transport-udp
subscribe_context=hints
disallow=all
allow=g729,alaw
allow=ulaw
aggregate_mwi=yes
device_state_busy_at=1
allow_subscribe=yes
sub_min_expiry=60
send_pai=yes
send_rpid=yes
connected_line_method=update
t38_udptl=yes
t38_udptl_ec=redundancy

And these are the 6004 (t38enabled) and 6005 (t38 disabled):

; UTENTE 6004 Fax 6004
[dev6004](default_user_endpoint)
callerid=Fax 6004 <6004>
context=cat-1
aors=dev6004
auth=dev6004

[dev6004](default_user_auth)
username=dev6004
password=xxxxxx

[dev6004](default_user_aor)

; UTENTE 6005 Fax 6005
[dev6005](default_user_endpoint)
callerid=Fax 6005 <6005>
context=cat-1
aors=dev6005
auth=dev6005

[dev6005](default_user_auth)
username=dev6005
password=xxxxxx

[dev6005](default_user_aor)

Just for info, with t38 disabled endpoint, i mean that i have disabled t38 from configuration page of the linksys 6005.

This is the wireshark call flow:

I have added FAXOPT(gateway)=yes but now i have no audio after t38 negotiation; in debug log i found:

[Jun 10 12:38:09] DEBUG[5086][C-00000004] res_fax.c: PJSIP/dev6004-00000007 attempted to negotiate T.38 but PJSIP/dev6005-00000008 refused the request
[Jun 10 12:38:09] DEBUG[5086][C-00000004] res_fax.c: starting T.38 gateway for T.38 channel PJSIP/dev6004-00000007 and G.711 channel PJSIP/dev6005-00000008
[Jun 10 12:38:09] DEBUG[5086][C-00000004] res_fax.c: Requesting a new FAX session from 'Spandsp FAX Driver'.
[Jun 10 12:38:09] DEBUG[5086][C-00000004] res_fax.c: channel 'PJSIP/dev6004-00000007' using FAX session '11'

The strange thing is that 6005 is still using g729 and after this i have no audio at all.