Subject: WebRTC (sipML5) Call Drop Issue - Endpoint answers but Asterisk fails to acknowledge (no audio/timeout) behind NAT
Description:
Hi, I am using Asterisk 18+ with PJSIP and a WebRTC client based on sipML5. My Asterisk server is operating behind a NAT environment.
The issue occurs during incoming calls:
An incoming call arrives at the browser.
The user clicks “Answer”, and the browser (sipML5) sends a 200 OK.
Asterisk logs show the client is ringing, but it seems Asterisk does not process the answer/acknowledgment correctly.
After approximately 30 seconds, Asterisk logs: – Nobody picked up in 30000 ms and terminates the call.
In the browser console, I see an error: Incoming Call UniqueID: undefined. It appears the signaling/media negotiation (ICE/DTLS) is failing due to the NAT setup.
Key Observations:
ACK Failure: Even though Asterisk receives the 200 OK from the client, it fails to send an ACK (Acknowledgment) to complete the three-way handshake and connect the call. This is typically indicative of a NAT traversal issue or an ICE negotiation failure.
Timeout Issue: The logs show that Asterisk terminates the call after 30 seconds with the error – Nobody picked up in 30000 ms, despite the browser having already sent the answer signal.
PJSIP Configuration (pjsip.conf)
Ini, TOML
[transport-wss]
type=transport
protocol=wss
bind=0.0.0.0:8089
cert_file=/etc/asterisk/certs/xxx.pem
priv_key_file=/etc/asterisk/certs/xxx.pem
external_media_address=xxx.xxx.xxx.xxx
external_signaling_address=xxx.xxx.xxx.xxx
local_net=xxx.xxx.xxx.xxx/24
webrtc-endpoint
type=endpoint
context=from-internal
disallow=all
allow=opus,ulaw,alaw
webrtc=yes
ice_support=yes
use_avpf=yes
rtcp_mux=yes
bundle=yes
dtls_fingerprint=sha-256
media_encryption=dtls
dtls_verify=fingerprint
dtls_setup=actpass
dtls_cert_file=/etc/asterisk/certs/xxx.pem
dtls_private_key=/etc/asterisk/certs/xxx.pem
force_rport=yes
rewrite_contact=yes
rtp_symmetric=yes
direct_media=no
media_use_received_transport=yes
transport=transport-wss
ad123
aors=ad123
auth=ad123-auth
ad123
type=aor
max_contacts=1
remove_existing=yes
ad123-auth
type=auth
auth_type=userpass
username=ad123
password=xxx_password_xxx
Asterisk Logs (Masked)
Plaintext
<— Received SIP request (1643 bytes) from UDP:xxx.xxx.xxx.xxx:5066 —>
INVITE sip:212@xxx.xxx.xxx.xxx;user=phone SIP/2.0
From: "22113345"sip:22113345@xxx.xxx.xxx.xxx;tag=byijimbi-CC-1006-OFC-138
To: "212"sip:212@xxx.xxx.xxx.xxx
Contact: sip:xxx.xxx.xxx.xxx:5060
– Executing [212@212test:6] Queue(“PJSIP/provider-00000006”, “Tabaarak246,twh”) in new stack
– Called PJSIP/ad123
<— Transmitting SIP request (1683 bytes) to WSS:xxx.xxx.xxx.xxx:28183 —>
INVITE sips:ad123@xxx.xxx.xxx.xxx:28183;transport=ws;rtcweb-breaker=yes SIP/2.0
From: “22113345” sip:22113345@callcenterdemo;tag=d3b8a3c8-fe1b-4a38-811e-cc929da838bd
<— Received SIP response (522 bytes) from WSS:xxx.xxx.xxx.xxx:28183 —>
SIP/2.0 180 Ringing
– PJSIP/ad123-00000007 is ringing
<— Received SIP response (2691 bytes) from WSS:xxx.xxx.xxx.xxx:28183 —>
SIP/2.0 200 OK
CSeq: 8810 INVITE
Contact: sips:ad123@df7jal23ls0d.invalid;transport=wss
– Nobody picked up in 30000 ms
<— Transmitting SIP request (477 bytes) to WSS:xxx.xxx.xxx.xxx:28183 —>
CANCEL sips:ad123@xxx.xxx.xxx.xxx:28183;transport=ws;rtcweb-breaker=yes SIP/2.0
<— Received SIP request (519 bytes) from UDP:xxx.xxx.xxx.xxx:5066 —>
CANCEL sip:212@xxx.xxx.xxx.xxx;user=phone SIP/2.0
Reason: Q.850;cause=19;text=“No answer from user (user alerted)”