401/Unauthorized on incoming calls

Ted Fines

December 06, 2023 00:08

None

System is Yeastar S50

Setting up a new SIP trunk (Peer Trunk). Inbound calls don't work, the caller just gets disconnected. Outbound is working.

pcap shows the S50 receives the INVITE, but responds with 401/Unauthorized. See image below.

Googling, I found one suggestion that we'd set the port of the service provider's address to 0 instead of 5060, but we've confirmed it is 5060. Another suggestion said we set the 'Realm' wrong. But I can't find that setting on the PBX and think that must be obsolete information. Another suggestion said to leave the "Caller ID" empty. Tried that, no help.

There must be some check box somewhere that is requiring authentication? I've looked everywhere and can't find it. Any help? Thanks in advance!

Date Votes

5 comments

0

Ted Fines December 06, 2023 01:10

Here are the messages from the CLI log. It looks like "No matching endpoint found" could be important, but I can't find much on that error on Google for Yeastar. Any ideas? THanks!

<--- Received SIP request (1445 bytes) from UDP:10.128.45.116:5060 --->
INVITE sip:22214@192.168.2.253:5060 SIP/2.0
Via: SIP/2.0/UDP 10.128.45.116:5060;branch=z9hG4bK08Bdafeae0f87fe6cdb
From: <sip:7553332@10.128.45.116>;tag=gK083faf82
To: <tel:+67822214>
Call-ID: 21520357_99043335@10.128.45.116
CSeq: 798694 INVITE
Max-Forwards: 67
Allow: INVITE,ACK,CANCEL,BYE,REGISTER,REFER,INFO,SUBSCRIBE,NOTIFY,PRACK,UPDATE,OPTIONS,MESSAGE,PUBLISH
Contact: <sip:7553332@10.128.45.116:5060>
P-Charging-Vector: icid-value=4jYYZtZUoZ-00d41152-06-00007839-001;transit-ioi="void"
P-Early-Media: supported
Privacy: none
Accept: application/sdp, application/isup, multipart/mixed, application/dtmf, application/dtmf-relay
X-ZTE-Cookie: 7zs4rm1;id=i_eXjnuTR2BMqaZQ6YIy@mgcf72.ims.mnc001.mcc541.3gppnetwork.org
Supported: timer,100rel,precondition,replaces
Session-Expires: 1800
Min-SE: 90
Content-Length: 526
Content-Disposition: session; handling=required
Content-Type: application/sdp

v=0
o=Sonus_UAC 279162 965215 IN IP4 10.128.41.36
s=SIP Media Capabilities
c=IN IP4 10.128.41.36
t=0 0
m=audio 23476 RTP/AVP 8 97 98 99 100 3 102 18 96
a=rtpmap:8 PCMA/8000
a=rtpmap:97 AMR/8000
a=rtpmap:98 AMR/8000
a=fmtp:98 mode-set=0,2,4,7
a=rtpmap:99 GSM-EFR/8000
a=rtpmap:100 AMR/8000
a=fmtp:100 mode-set=0,2,4
a=rtpmap:3 GSM/8000
a=rtpmap:102 AMR/8000
a=fmtp:102 mode-change-neighbor=1; mode-change-period=2
a=rtpmap:18 G729/8000
a=rtpmap:96 telephone-event/8000
a=fmtp:96 0-15
a=sendrecv
a=ptime:20

[2023-12-06 11:57:47] NOTICE[29733]: res_pjsip/pjsip_distributor.c:490 log_unidentified_request: Request from '<sip:7553332@10.128.45.116>' failed for '10.128.45.116:5060' (callid: 21520357_99043335@10.128.45.116) - No matching endpoint found

<--- Transmitting SIP response (498 bytes) to UDP:10.128.45.116:5060 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 10.128.45.116:5060;rport=5060;received=10.128.45.116;branch=z9hG4bK08Bdafeae0f87fe6cdb
Call-ID: 21520357_99043335@10.128.45.116
From: <sip:7553332@10.128.45.116>;tag=gK083faf82
To: <tel:+67822214>;tag=z9hG4bK08Bdafeae0f87fe6cdb
CSeq: 798694 INVITE
WWW-Authenticate: Digest realm="asterisk",nonce="1701824267/a336761db8b1ad7bc42b33f71159c6f0",opaque="1bbb68bc777c6870",algorithm=md5,qop="auth"
Server: Yeastar S50-30.15.0.125
Content-Length: 0

<--- Received SIP request (314 bytes) from UDP:10.128.45.116:5060 --->
ACK sip:22214@192.168.2.253:5060 SIP/2.0
Via: SIP/2.0/UDP 10.128.45.116:5060;branch=z9hG4bK08Bdafeae0f87fe6cdb
From: <sip:7553332@10.128.45.116>;tag=gK083faf82
To: <tel:+67822214>;tag=z9hG4bK08Bdafeae0f87fe6cdb
Call-ID: 21520357_99043335@10.128.45.116
CSeq: 798694 ACK
Max-Forwards: 70
Content-Length: 0

[2023-12-06 11:57:50] DEBUG[13546]: res_pjsip.c:3260 endpt_send_request: 0xdfcfac4: Wrapper created
[2023-12-06 11:57:50] DEBUG[13546]: res_pjsip.c:3281 endpt_send_request: 0xdfcfac4: Set timer to 3000 msec

<--- Transmitting SIP request (457 bytes) to UDP:10.128.45.116:5060 --->
OPTIONS sip:3480e50a@10.128.45.116:5060;transport=udp SIP/2.0
Via: SIP/2.0/UDP 192.168.2.253:5060;rport;branch=z9hG4bKPj56838244-0d3d-4d2f-a1da-3dddbee0beeb
From: <sip:unknown@192.168.2.253>;tag=f4db1dd0-8702-46ca-84ec-c30ea83696f9
To: <sip:3480e50a@10.128.45.116>
Contact: <sip:unknown@192.168.2.253:5060>
Call-ID: 927ff3b1-281c-45fa-97ab-df2b9ea90a7b
CSeq: 57318 OPTIONS
Max-Forwards: 70
User-Agent: Yeastar S50-30.15.0.125
Content-Length: 0

<--- Received SIP response (343 bytes) from UDP:10.128.45.116:5060 --->
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 192.168.2.253:5060;branch=z9hG4bKPj56838244-0d3d-4d2f-a1da-3dddbee0beeb;rport=5060
From: <sip:unknown@192.168.2.253:5060>;tag=f4db1dd0-8702-46ca-84ec-c30ea83696f9
To: <sip:3480e50a@10.128.45.116>;tag=gK00805b8c
Call-ID: 927ff3b1-281c-45fa-97ab-df2b9ea90a7b
CSeq: 57318 OPTIONS
Content-Length: 0

Comment actions Permalink
0

Ted Fines December 06, 2023 01:21

Here is the output of "pjsip show endpoint trunk-Voda-SIP-endpoint".

Thanks in advance for your assistance!

IPPBX*CLI> pjsip show endpoint trunk-Voda-SIP-endpoint

Endpoint: <Endpoint/CID.....................................> <State.....> <Channels.>
I/OAuth: <AuthId/UserName...........................................................>
Aor: <Aor............................................> <MaxContact>
Contact: <Aor/ContactUri..........................> <Hash....> <Status> <RTT(ms)..>
Transport: <TransportId........> <Type> <cos> <tos> <BindAddress..................>
Identify: <Identify/Endpoint.........................................................>
Match: <ip/cidr.........................>
Channel: <ChannelId......................................> <State.....> <Time(sec)>
Exten: <DialedExten...........> CLCID: <ConnectedLineCID.......>
Endpoint: trunk-Voda-SIP-endpoint Not in use 0 of inf
Aor: trunk-Voda-SIP-aor 1
Contact: trunk-Voda-SIP-aor/sip:3480e50a@10.128.45. c58a4ffc63 Avail 3.968

ParameterName : ParameterValue
========================================================
100rel : no
ENABLEJB : no
GROUP(trunk-Voda-SIP-endpoint) : trunk-Voda-SIP-endpoint
OBADDDIVERSION : no
OBADDPAI : no
OBADDPPI : no
OBADDRPID : no
OBDIVERSION :
OBPAI :
OBPPI :
OBRPID :
SRCTRUNKDOMAIN : 10.128.45.116
SRCTRUNKNAME : Voda-SIP
SRCTRUNKTYPE : SP
TFADDDIVERSION : yes
TFADDPAI : no
TFADDPPI : no
TFADDRPID : no
TFDIVERSION : default
TFFROM : default
TFPAI :
TFPPI :
TFRPID :
TIMEOUT(absolute) : 10800
accountcode :
aggregate_mwi : true
allow : (ulaw|alaw|g729)
allow_subscribe : true
allow_transfer : true
aors : trunk-Voda-SIP-aor
auth :
call_group :
callerid : <unknown>
callerid_privacy : allowed_not_screened
callerid_tag :
connected_line_method : invite
context : callin_trunk_Voda-SIP
cos_audio : 5
cos_video : 6
device_state_busy_at : 0
direct_media : true
direct_media_glare_mitigation : none
direct_media_method : invite
disable_direct_media_on_nat : false
dtls_ca_file :
dtls_ca_path :
dtls_cert_file :
dtls_cipher :
dtls_fingerprint : SHA-256
dtls_private_key :
dtls_rekey : 0
dtls_setup : active
dtls_verify : No
dtmf_mode : rfc4733
dtmffmtp : 0-16
emergencycid_nofromuser : no
enableiprestrict :
enableuseragent :
endpttype : trunk
fax_detect : false
force_avp : false
force_privacyid : false
force_rport : false
fqdn_user_enable : false
from_domain : 10.128.45.116
from_user :
g726_non_standard : false
get_exten_type : 0
ice_support : false
identify_by : username
ignore_183_without_sdp : false
inband_progress : false
istrunk : 0
language : en
limituseragent :
mailboxes :
media_address :
media_encryption : no
media_encryption_optimistic : true
media_use_received_transport : false
message_context : send_message
moh_suggest : default
mwi_from_user :
named_call_group :
named_pickup_group :
netmask : 255.255.255.0
netmask2 : 255.255.255.0
one_touch_recording : true
outbound_auth :
outbound_proxy :
permitip1 :
permitip2 :
permitip3 :
permitip4 :
pickup_group :
record_off_feature : automixmon
record_on_feature : automixmon
remoteregister :
rewrite_contact : false
rpid_immediate : false
rtp_engine : asterisk
rtp_ipv6 : false
rtp_keepalive : 0
rtp_symmetric : false
rtp_timeout : 0
rtp_timeout_hold : 0
sdp_owner : -
sdp_session : Asterisk
send_diversion : false
send_pai : false
send_rpid : false
srtp_tag_32 : false
sub_default_expiry : 360
sub_max_expiry : 3600
sub_min_expiry : 90
t38_noattr : false
t38_udptl : false
t38_udptl_ec : none
t38_udptl_ipv6 : false
t38_udptl_maxdatagram : 0
t38_udptl_nat : false
timers : yes
timers_min_se : 90
timers_sess_expires : 1800
tone_zone :
tos_audio : 184
tos_video : 136
transport :
transport_name :
trust_id_contact : false
trust_id_inbound : false
trust_id_outbound : false
trust_id_pai : false
trust_id_ppi : false
use_avpf : false
use_ptime : false
user_eq_phone : false

Comment actions Permalink
0

Ted Fines December 06, 2023 01:24

Results of "pjsip show aor trunk-Voda-SIP-aor"

Thanks in advance!

IPPBX*CLI> pjsip show aor trunk-Voda-SIP-aor

Aor: <Aor..............................................> <MaxContact>
Contact: <Aor/ContactUri............................> <Hash....> <Status> <RTT(ms)..>
Aor: trunk-Voda-SIP-aor 1
Contact: trunk-Voda-SIP-aor/sip:3480e50a@10.128.45.11 c58a4ffc63 Avail 3.824

ParameterName : ParameterValue
====================================================================
authenticate_qualify : false
contact : sip:3480e50a@10.128.45.116:5060;transport=udp
contactuser :
default_expiration : 3600
mailboxes :
max_contacts : 1
maximum_expiration : 7200
minimum_expiration : 60
outbound_proxy :
qualify_frequency : 60
qualify_timeout : 3.000000
remove_existing : false
support_path : false

Comment actions Permalink
0

Ted Fines December 06, 2023 01:45

I compared the output of the pjsip commands of this one where we have trouble, to another one that is configured the same way but works perfectly.

I only found one difference. The non-working unit has "direct_media" = true, while the working unit has "direct_media" set to false.

I know we've never deliberately set that parameter.

Can anyone show me where in the GUI to change that? Or can it be set from cmd line?

Comment actions Permalink
0

Ted Fines December 06, 2023 07:20

OK well here is what fixed it for us.

Tech support found a file in:

/ysdisk/ysapps/pbxcenter/usr/lib/asterisk/modules/res_pjsip_endpoint_identifier_ip

The file is named res_pjsip_endpoint_identifier_ip1.so.

Support asked us if we knew what it was and how it got there. We didn't of course because when we ssh into the unit we don't even have access to that directory.

Anyway, support told us they removed the file. Problem went away immediately. All OK now.

Comment actions Permalink

Please sign in to leave a comment.