Dear Community,
I’ve been struggling trying to re-connect an Asterisk Server with Microsoft Teams,
Re-connect since i already made a two-way connection with SIP OPTIONS and Calls,
Currently, i have the following settings:
Note: ${value} is not shown due privacy purposes.
Endpoint:
ParameterName : ParameterValue
===================================================================================================
100rel : yes
accept_multiple_sdp_answers : true
accountcode :
acl :
aggregate_mwi : true
allow : (g729|alaw|ulaw)
allow_overlap : true
allow_subscribe : false
allow_transfer : true
allow_unauthenticated_options : false
aors : AOR_MSTEAMS1, AOR_MSTEAMS2, AOR_MSTEAMS3
asymmetric_rtp_codec : false
auth :
bind_rtp_to_media_address : false
bundle : false
call_group :
callerid : <unknown>
callerid_privacy : allowed_passed_screen
callerid_tag :
codec_prefs_incoming_answer : prefer:pending, operation:intersect, keep:all, transcode:allow
codec_prefs_incoming_offer : prefer:pending, operation:intersect, keep:all, transcode:allow
codec_prefs_outgoing_answer : prefer:pending, operation:intersect, keep:all, transcode:allow
codec_prefs_outgoing_offer : prefer:pending, operation:union, keep:all, transcode:allow
connected_line_method : invite
contact_acl :
context : IN_MSTEAMS
cos_audio : 0
cos_video : 0
device_state_busy_at : 0
direct_media : false
direct_media_glare_mitigation : none
direct_media_method : invite
disable_direct_media_on_nat : false
dtls_auto_generate_cert : No
dtls_ca_file :
dtls_ca_path :
dtls_cert_file :
dtls_cipher :
dtls_fingerprint : SHA-256
dtls_private_key :
dtls_rekey : 0
dtls_setup : active
dtls_verify : No
dtmf_mode : rfc4733
fax_detect : true
fax_detect_timeout : 0
follow_early_media_fork : true
force_avp : false
force_rport : true
from_domain : ${domain}
from_user :
g726_non_standard : false
geoloc_incoming_call_profile :
geoloc_outgoing_call_profile :
ice_support : false
identify_by : ip,username,header,auth_username
ignore_183_without_sdp : true
inband_progress : true
incoming_call_offer_pref : local
incoming_mwi_mailbox :
language : es
mailboxes :
max_audio_streams : 1
max_video_streams : 1
media_address :
media_encryption : sdes
media_encryption_optimistic : false
media_use_received_transport : false
message_context :
moh_passthrough : true
moh_suggest : default
mwi_from_user :
mwi_subscribe_replaces_unsolicited : no
named_call_group :
named_pickup_group :
notify_early_inuse_ringing : false
one_touch_recording : false
outbound_auth :
outbound_proxy :
outgoing_call_offer_pref : remote_merge
pickup_group :
preferred_codec_only : false
record_off_feature :
record_on_feature :
refer_blind_progress : false
rewrite_contact : false
rpid_immediate : false
rtcp_mux : false
rtp_engine : asterisk
rtp_ipv6 : false
rtp_keepalive : 0
rtp_symmetric : false
rtp_timeout : 0
rtp_timeout_hold : 0
sdp_owner : ${owner}
sdp_session : ${session}
send_connected_line : yes
send_diversion : true
send_history_info : false
send_pai : false
send_rpid : false
set_var :
srtp_tag_32 : false
stir_shaken : off
stir_shaken_profile :
sub_min_expiry : 0
subscribe_context :
suppress_q850_reason_headers : false
t38_bind_udptl_to_media_address : false
t38_udptl : true
t38_udptl_ec : none
t38_udptl_ipv6 : false
t38_udptl_maxdatagram : 0
t38_udptl_nat : false
timers : yes
timers_min_se : 90
timers_sess_expires : 1800
tone_zone : cl
tos_audio : 0
tos_video : 0
transport : transport_tls
trust_connected_line : yes
trust_id_inbound : true
trust_id_outbound : true
use_avpf : false
use_ptime : false
user_eq_phone : false
voicemail_extension :
webrtc : no
Transport:
ParameterName : ParameterValue
=======================================================================================================================================
allow_reload : false
allow_wildcard_certs : Yes
async_operations : 1
bind : 0.0.0.0:5061
ca_list_file : /etc/asterisk/certs/CA.pem
ca_list_path :
cert_file : /etc/asterisk/certs/wildcard.crt
cipher : ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-SHA384, ECDHE-RSA-AES128-SHA256
cos : 0
domain :
external_media_address : ${domain}
external_signaling_address : ${domain}
external_signaling_port : 5061
local_net : net1/255.255.255.0
local_net : net2/255.255.255.0
local_net : net3/255.255.255.224
local_net : net4/255.255.255.224
method : tlsv1_2
password :
priv_key_file : /etc/asterisk/certs/private.key
protocol : tls
require_client_cert : No
symmetric_transport : false
tos : 0
verify_client : No
verify_server : No
websocket_write_timeout : 100
SIP OPTIONS:
<--- Transmitting SIP request (497 bytes) to TLS:52.114.132.46:5061 --->
OPTIONS sip:sip.pstnhub.microsoft.com SIP/2.0
Via: SIP/2.0/TLS ${domain}:5061;rport;branch=z9hG4bKPj411abb45-1454-44e2-9ee2-9e2859e43395;alias
From: <sip:MSTEAMS@${domain};tag=06872202-7eef-44d1-a40a-27e4fb428e41
To: <sip:sip.pstnhub.microsoft.com>
Contact: <sip:MSTEAMS@${domain}:5061;transport=TLS>
Call-ID: 3f1e2668-7ff1-4bd7-98f7-0f9d04a9c73f
CSeq: 38224 OPTIONS
Max-Forwards: 10
User-Agent: ${user-agent}
Content-Length: 0
Im not sure if the following notification is related to this unreachability:
NOTICE[4674]: res_pjsip/pjsip_transport_events.c:179 verify_log_result: Transport ‘transport_tls’ to remote ‘sip.pstnhub.microsoft.com’ - The certificate is untrusted
My certificate provider is LeaderSSL that works with Sectigo,
wildcard.crt file contains only the “STAR” certificate that provides LeaderSSL
CA.pem contains all intermediate CA values of the wildcard service,
AAACertificateServices.crt
SectigoRSAOrganizationValidationSecureServerCA.crt
USERTrustRSAAAACA.crt
Also,
I have downloaded the CA that MS Teams is using and added it to Centos 9: DigiCert Global Root G2
/etc/pki/ca-trust/source/anchors/${DigiCertCA.pem}
then, I applied the CA changes to the O.S. with:
update-ca-trust
I’m aware that Asterisk is not “supported” by default as a valid SBC for MS Teams, so, i followed this guide and modified what values were out of date, everything was working fine until today with no changes made whatsoever, so i believe that MS Teams is updating something or banned my server directly, my logs shows unavailability at 12:00 UTC in multiple attempts (Available - Unavailable).
Any suggestions are greatly appreciated
Warm Regards