Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

CUBE not passing back SIP authentication

All,

I am attempting to setup CUBE and the piece I cannot figure out is how to get CUBE to passback the authentication from the registrar server.  The IP Phone is sending the initial register, it's received by CUBE and sent to the registrar.  The registrar responds 401 with a challenge that includes the WWW-Authenticate: Digest, but the CUBE sends the 401 to the phone without the WWW-Authenticate.  How do I get that piece working?

Register request from IP Phone:

Jun 15 14:58:06.500 EDT: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:

Received:

REGISTER sip:10.1.255.2:5070 SIP/2.0

Via: SIP/2.0/UDP 10.0.0.3;branch=z9hG4bK95b58c109A1CBBA9

From: "ACD 3" <sip:8643350812@10.1.255.2>;tag=EC921466-5483BB0F

To: <sip:8643350812@10.1.255.2>

CSeq: 2 REGISTER

Call-ID: 16211dfb-a136331c-e71d9d5@10.0.0.3

Contact: <sip:8643350812@10.0.0.3>;methods="INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER"

User-Agent: PolycomSoundPointIP-SPIP_331-UA/3.1.3.0507

Accept-Language: en

Max-Forwards: 70

Expires: 3600

Content-Length: 0

CUBE Initial response to phone:

Jun 15 14:58:06.512 EDT: //1312/E04C16F58310/SIP/Msg/ccsipDisplayMsg:

Sent:

SIP/2.0 100 Trying

Via: SIP/2.0/UDP 10.0.0.3;branch=z9hG4bK95b58c109A1CBBA9

From: "ACD 3" <sip:8643350812@10.1.255.2>;tag=EC921466-5483BB0F

To: <sip:8643350812@10.1.255.2>;tag=61DB070-1D9D

Date: Fri, 15 Jun 2012 18:58:06 GMT

Call-ID: 16211dfb-a136331c-e71d9d5@10.0.0.3

Server: Cisco-SIPGateway/IOS-12.x

CSeq: 2 REGISTER

Content-Length: 0

CUBE Register request to Registrar:

Jun 15 14:58:06.516 EDT: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:

Sent:

REGISTER sip:10.2.1.9:5070 SIP/2.0

Via: SIP/2.0/UDP 10.1.255.2:5070;branch=z9hG4bK2391BB8

From: <sip:8643350812@10.2.1.9>;tag=61DB0B0-178B

To: <sip:8643350812@10.2.1.9>

Date: Fri, 15 Jun 2012 18:58:06 GMT

Call-ID: E055DAA6-B65211E1-83129221-D5A7E229

User-Agent: Cisco-SIPGateway/IOS-12.x

Max-Forwards: 70

Timestamp: 1339786686

CSeq: 2 REGISTER

Contact: <sip:8643350812@10.1.255.2:5070>

Expires:  3600

Supported: path

Content-Length: 0

Registrar Response w/ challenge:

Jun 15 14:58:06.528 EDT: //1316/000000000000/SIP/Msg/ccsipDisplayMsg:

Received:

SIP/2.0 401 Unauthorized

Via: SIP/2.0/UDP 10.1.255.2:5070;branch=z9hG4bK2391BB8

From: <sip:8643350812@10.2.1.9>;tag=61DB0B0-178B

To: <sip:8643350812@10.2.1.9>;tag=SDr15rb99-590850185-1339786686522

Call-ID: E055DAA6-B65211E1-83129221-D5A7E229

Timestamp: 1339786686

CSeq: 2 REGISTER

WWW-Authenticate: DIGEST qop="auth",nonce="BroadWorksXh3hmefjuTemqn4BW",realm="BroadWorks",algorithm=MD5

Content-Length: 0

CUBE 401 to Phone w/o Authentication requirements:

Jun 15 14:58:06.536 EDT: //1312/E04C16F58310/SIP/Msg/ccsipDisplayMsg:

Sent:

SIP/2.0 401 Unauthorized

Via: SIP/2.0/UDP 10.0.0.3;branch=z9hG4bK95b58c109A1CBBA9

From: "ACD 3" <sip:8643350812@10.1.255.2>;tag=EC921466-5483BB0F

To: <sip:8643350812@10.1.255.2>;tag=61DB070-1D9D

Date: Fri, 15 Jun 2012 18:58:06 GMT

Call-ID: 16211dfb-a136331c-e71d9d5@10.0.0.3

Server: Cisco-SIPGateway/IOS-12.x

CSeq: 2 REGISTER

Content-Length: 0

Everyone's tags (5)
5 REPLIES

CUBE not passing back SIP authentication

Use the following command on your dial-peers:

dial-peer voice 1001 voip

voice-class sip pass-thr headers

And if you are using IOS above 15.1(3), you can use add those commands as well

Router(config)# voice service voip

Router(conf-voi-serv)# sip

Router(conf-serv-sip)# registration passthrough 

"If you this post useful, please rate it"

New Member

CUBE not passing back SIP authentication

Thanks for the reply.  I am using 15.1(4) and have those commands entered, doesn't appear to help. 

voice service voip

no ip address trusted authenticate

allow-connections sip to sip

sip

  bind control source-interface Loopback10

  bind media source-interface Loopback10

  header-passing sip-sip

  registrar server

  listen-port non-secure  5070

  registration passthrough

By default, the dial-peers should be using the global config settings so shouldn't need the 'sip pass-thru' commands, although I tried that well without success.

CUBE not passing back SIP authentication

Try to remove authentication command under sip-ua menu.

You can study the "Configuring Support for SIP Registration Proxy on Cisco UBE" at this link:

http://www.cisco.com/en/US/docs/ios/voice/cube/configuration/guide/vb-gw-sipsip.html

Regards.

New Member

CUBE not passing back SIP authentication

Did you ever get this to work? We are facing the exact same problem.

A 'debug ccsip all' shows some line regarding the SBC believing to operate in 'P2P' mode.

According to the documentation Daniele refered to this means a setup where the SBC handles the authentication by himself?

Unfortunally the examples in the same documentation is not very accurate (non-unique dial-peers, settings defined globally and on DP etc.). It also fails to explain which scenario the configuration example is ment to cover.

New Member

CUBE not passing back SIP authentication

No we did not.  The current CUBE model doesn't support Subscribe or Notify pass-through.  Cisco is implementing line side features through a product called Nano CUBE, but I've never worked on it.

5040
Views
0
Helpful
5
Replies
CreatePlease to create content