Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

sip incoming authentication

I have been having quite a bit of trouble wrapping my head around this issue.

I register to ITSP and that is fine. Outgoing works ok. Incoming does not seem to work:

SIP/2.0 403 Incorrect Authentication

SIP/2.0 403 Forbidden

Reason: Q.850;cause=57

sip-ua authentication is configured to match and passwords double checked

problem is resolved by adding the ITSP username to the ephone-dn

I don't really understand why this makes a difference authentication-wise

ephone-dn  100

number 100 secondary 1777MYCCID no-reg primary

Everyone's tags (6)
3 ACCEPTED SOLUTIONS

Accepted Solutions

Re: sip incoming authentication

Hi Evan.
Can you please post running config?

Thanks

Regards

Carlo

Sent from Cisco Technical Support iPhone App

Please rate all helpful posts "The more you help the more you learn"

Re: sip incoming authentication

Hi Evan

On your dial-peer 6 use incoming called-number 17772760570110

Try and let me know.

HTH

Regards

Carlo

Please rate all helpful posts

"The more you help the more you learn"

Please rate all helpful posts "The more you help the more you learn"

sip incoming authentication

Hi Evan

Under sip-ua change the realm on authentication section.

remove -->> authentication username 17772760570110 password realm callcentric.com

add -->>> authentication username 17772760570110 password realm 68.112.156.253

HTH

Regards

Carlo

Please rate all helpful posts

"The more you help the more you learn"

Please rate all helpful posts "The more you help the more you learn"
18 REPLIES

Re: sip incoming authentication

Hi.
To register inbound number, use credential statement under sip-ua

eg
sip-ua
credential number 12345677 username user password password realm sipdomain.com

registrar 1 dns:sip.dipdomain.com:5060

HTH

Regards

Carlo

Sent from Cisco Technical Support iPhone App

Please rate all helpful posts "The more you help the more you learn"
New Member

sip incoming authentication

Carlo hello and thank you for the reply. Below you will find my more configuration. Incoming calls still fail without the sip ID configured on ephone-dn

sip-ua

credentials username 1777MYID password foo realm callcentric.com

authentication username 1777MYID password foo realm callcentric.com

no remote-party-id

retry invite 4

retry response 3

retry bye 2

retry cancel 2

retry register 5

timers register 250

registrar dns:callcentric.com expires 3600

sip-server dns:callcentric.com:5060

host-registrar

dial-peer voice 6 voip

description ## INBOUND DID ##

translation-profile incoming INC

destination-pattern 1777MYID

session protocol sipv2

session target dns:callcentric.com

dtmf-relay sip-notify rtp-nte

codec g711ulaw

no vad

voice translation-rule 1

rule 1 /100/ /1777MYID/

voice translation-rule 2

rule 1 /1777MYID/ /100/

voice translation-profile INC

translate called 2

voice translation-profile OUTGOING

translate calling 1

I have asked the provider but they are unsure as they do not have a Cisco IOS gateway for testing.

New Member

Hi All,I am having a similar

Hi All,

I am having a similar issue, however my IOS on the CME router is (C3845-ADVIPSERVICESK9-M), Version 12.4(22)T. Outbound calls via the sip provider is working but inbound calls are not. Below is the output of my running config and debug.

 

version 12.4

voice service voip
 callmonitor
 allow-connections h323 to h323
 allow-connections h323 to sip
 allow-connections sip to h323
 allow-connections sip to sip
 supplementary-service h450.12
 no supplementary-service sip moved-temporarily
 no supplementary-service sip refer
 redirect ip2ip
 h323
 sip
  registrar server expires max 250 min 200
  localhost dns:voip.****.com
!
!
voice class codec 100
 codec preference 1 g711ulaw
 codec preference 2 g711alaw
 codec preference 3 g723r53
 codec preference 4 g729r8
 codec preference 5 g729br8
 codec preference 6 g726r32
 codec preference 7 g728
!
!
!
!
!
!
!
!
!
!
!
!
!
!
voice translation-rule 1
 rule 1 /7120013/ /1200/

!
voice translation-rule 2
 rule 1 /^911$/ /911/
 rule 2 /^9\(.*\)/ /\1/
!
voice translation-rule 3
 rule 1 /^1200$/ /23417120013/

!
voice translation-rule 4
 rule 1 /^9(.......)$/ /01\1/
 rule 3 /^9(.*)/ /\1/
!
!
voice translation-profile Call_Inbound
 translate called 1
!
voice translation-profile PSTN_Outgoing
 translate calling 3
 translate called 2
 translate redirect-target 4
 translate redirect-called 4

!
dial-peer cor custom
 name all
 name Landline
 name Mobile
 name International
 name National
 name Internal
!
!
dial-peer cor list executive
 member all
!
dial-peer cor list all-numbers
 member all
!
dial-peer cor list Internal-Numbers
 member Internal
!
dial-peer cor list Landline-Numbers
 member Landline
!
dial-peer cor list Mobile-Numbers
 member Mobile
!
dial-peer cor list International-Calls
 member International
!
dial-peer cor list Internal
 member Internal
!
dial-peer cor list Landline
 member Landline
 member National
 member Internal
!
dial-peer cor list Mobile
 member Landline
 member Mobile
 member National
 member Internal
!
dial-peer cor list International
 member Landline
 member Mobile
 member International
 member National
 member Internal
!
dial-peer cor list National-Numbers
 member National
!

!
dial-peer voice 11 voip
 description **Incoming Call from SIP Trunk**
 translation-profile incoming Call_Inbound
 voice-class sip dtmf-relay force rtp-nte
 session protocol sipv2
 session target dns:voip.****.com
 incoming called-number .T
 dtmf-relay rtp-nte
 codec g711ulaw
 no vad
!
dial-peer voice 12 voip
 corlist outgoing International-Calls
 description **Outgoing Call to SIP Trunk**International Numbers
 translation-profile outgoing PSTN_Outgoing
 destination-pattern 9T
 voice-class sip dtmf-relay force rtp-nte
 session protocol sipv2
 session target dns:voip.****.com
 dtmf-relay rtp-nte
 codec g711ulaw
 no vad
!
dial-peer voice 13 voip
 corlist outgoing Landline-Numbers
 description **Outgoing Call to SIP Trunk**Landline Numbers**Lagos
 translation-profile outgoing PSTN_Outgoing
 destination-pattern 901.......
 voice-class sip dtmf-relay force rtp-nte
 session protocol sipv2
 session target dns:voip.****.com
 dtmf-relay rtp-nte
 codec g711ulaw
 no vad
!
dial-peer voice 14 voip
 corlist outgoing National-Numbers
 description **Outgoing Call to SIP Trunk**Landline Numbers**National2
 translation-profile outgoing PSTN_Outgoing
 destination-pattern 90[2-9][2-9].......
 voice-class sip dtmf-relay force rtp-nte
 session protocol sipv2
 session target dns:voip.****.com
 dtmf-relay rtp-nte
 codec g711ulaw
 no vad
!
dial-peer voice 15 voip
 corlist outgoing National-Numbers
 description **Outgoing Call to SIP Trunk**Landline Numbers**National
 translation-profile outgoing PSTN_Outgoing
 destination-pattern 90[2-9][2-9]......
 voice-class sip dtmf-relay force rtp-nte
 session protocol sipv2
 session target dns:voip.****.com
 dtmf-relay rtp-nte
 codec g711ulaw
 no vad
!
dial-peer voice 16 voip
 corlist outgoing Mobile-Numbers
 description **Outgoing Call to SIP Trunk**Mobile Numbers
 translation-profile outgoing PSTN_Outgoing
 destination-pattern 90[78].........
 voice-class sip dtmf-relay force rtp-nte
 session protocol sipv2
 session target dns:voip.****.com
 dtmf-relay rtp-nte
 codec g711ulaw
 no vad
!
!
sip-ua
 credentials username 23417120013 password 7 1445151E1D153F3A272D realm voip.xxxx.com
 keepalive target dns:voip.****.com
 authentication username 23417120013 password 7 124B0202031A1915292E realm voip.xxxx.com
 retry invite 2
 retry register 10
 retry options 1
 timers connect 100
 registrar dns:voip.****.com expires 3600
 sip-server dns:voip.****.com
 host-registrar
 permit hostname dns:voip.****.com
!
!
!
telephony-service
 no auto-reg-ephone
 em logout 0:0 0:0 0:0
 max-ephones 40
 max-dn 80
 ip source-address 192.168.1.82 port 2000
 timeouts interdigit 5
 timeouts busy 20
 timeouts ringing 20
 system message Chams
 url directories http://192.168.1.82/localdirectory
 load 7911 SCCP11.7-2-1-0S
 load 7960-7940 P00308000500.loads
 time-zone 23
 time-format 24
 max-conferences 8 gain -6
 web admin system name admin password chams*01
 dn-webedit
 time-webedit
 transfer-system full-consult
 secondary-dialtone 9
 create cnf-files version-stamp Jan 01 2002 00:00:00
!
!
ephone-dn  1  dual-line
 number 1200
 name ABA
 corlist incoming International
!

!
ephone  1
 device-security-mode none
 mac-address 0026.0B5E.5556
 type 7940
 button  1:1 2:20
!
!+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

 

*Apr  2 13:24:58.836: //890/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
*Apr  2 13:24:58.836: //890/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
*Apr  2 13:24:58.836: //890/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x67E96228, addr=41.221.164.4, port=5060, sentBy_port=0, is_req=1, transport=1, switch=0, callBack=0x61741564
*Apr  2 13:24:58.836: //890/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
*Apr  2 13:24:58.836: //890/000000000000/SIP/Transport/sipTransportLogicSendMsg: switch transport is 0
*Apr  2 13:24:58.836: //890/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x67E96228
*Apr  2 13:24:58.836: //-1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x67E96228, addr=41.221.164.4, port=5060, connId=2 for UDP
*Apr  2 13:24:58.836: //890/000000000000/SIP/State/sipSPIChangeState: 0x70EAA778 : State change from (SIP_STATE_OUTGOING_REGISTER, SUBSTATE_NONE)  to (SIP_STATE_OUTGOING_REGISTER, SUBSTATE_NONE)
*Apr  2 13:24:58.840: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Sent:
REGISTER sip:voip.****.com:5060 SIP/2.0
Date: Wed, 02 Apr 2014 13:24:58 GMT
Authorization: Digest username="23417120013",realm="voip.****.com",uri="sip:voip.****.com:5060",response="4eb44f0f8bd51d914514c7d66f29a635",nonce="1396443258:242409a6de6a94b034fea3058e5c8614",algorithm=MD5
From: <sip:1222@voip.****.com>;tag=25522FE8-E49
Timestamp: 1396445098
Content-Length: 0
User-Agent: Cisco-SIPGateway/IOS-12.x
To: <sip:1222@voip.****.com>
Contact: <sip:1222@41.58.134.146:5060>
Expires: 3600
Call-ID: 9CDE3986-B99111E3-82E2D20E-52D92922
Via: SIP/2.0/UDP 41.58.134.146:5060;branch=z9hG4bK4DD634
CSeq: 47 REGISTER
Max-Forwards: 70


*Apr  2 13:24:58.864: //-1/xxxxxxxxxxxx/SIP/Info/HandleUdpIPv4SocketReads: Msg enqueued for SPI with IP addr: [41.221.164.4]:5060
*Apr  2 13:24:58.864: //-1/xxxxxxxxxxxx/SIP/Info/ccsip_process_sipspi_queue_event: ccsip_spi_get_msg_type returned: 2 for event 1
*Apr  2 13:24:58.864: //-1/xxxxxxxxxxxx/SIP/Transport/sipTransportProcessNWNewConnMsg: context=0x00000000
*Apr  2 13:24:58.864: //-1/xxxxxxxxxxxx/SIP/Info/ccsip_new_msg_preprocessor: Checking Invite Dialog
*Apr  2 13:24:58.864: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP 41.58.134.146:5060;branch=z9hG4bK4DD634
To: <sip:1222@voip.****.com>;tag=d672fb14
From: <sip:1222@voip.****.com>;tag=25522FE8-E49
Call-ID: 9CDE3986-B99111E3-82E2D20E-52D92922
CSeq: 47 REGISTER
Content-Length: 0


*Apr  2 13:24:58.864: //890/000000000000/SIP/Error/ccsip_api_register_result_ind: Message Code Class 4xx Method Code 100 received for REGISTER
*Apr  2 13:24:58.864: //-1/xxxxxxxxxxxx/SIP/Info/ccsip_spi_register_free_rcb: Freeing rcb
*Apr  2 13:24:58.864: //-1/xxxxxxxxxxxx/SIP/Info/ccsip_register_reset_dns_cache: CCSIP_REGISTER:: Primary registrar DNS resolved addr reset
*Apr  2 13:24:58.864: //-1/xxxxxxxxxxxx/SIP/Info/ccsipRegisterStartExpiresTimer: Starting timer for pattern 1222 for 180 seconds
*Apr  2 13:24:58.864: //-1/xxxxxxxxxxxx/SIP/Info/sipSPIDeleteContextFromTable: Context for key=[666] removed.
*Apr  2 13:24:58.864: //890/000000000000/SIP/Info/sipSPIUdeleteCcbFromUACTable: ****Deleting from UAC table.
*Apr  2 13:24:58.864: //890/000000000000/SIP/Info/sipSPIUdeleteCcbFromTable: Deleting from table. ccb=0x70EAA778 key=9CDE3986-B99111E3-82E2D20E-52D92922
*Apr  2 13:24:58.868: //890/000000000000/SIP/Info/sipSPIFlushEventBufferQueue: There are 0 events on the internal queue that are going to be free'd
*Apr  2 13:24:58.868: //890/000000000000/SIP/Info/ccsip_qos_cleanup: Entry
*Apr  2 13:24:58.868: //890/000000000000/SIP/Info/sipSPI_ipip_free_codec_profile: Codec Profiles Freed
*Apr  2 13:24:58.868: //890/000000000000/SIP/Info/sipSPIUfreeOneCCB: Freeing ccb 70EAA778
*Apr  2 13:24:58.868: //-1/xxxxxxxxxxxx/SIP/Info/sipSPIGetContextFromTable: NO context for key[666]

 

Re: sip incoming authentication

Hi Evan.
Can you please share the output of show sip-ua register status and a debug ccsip message

Thanks

Carlo

Sent from Cisco Technical Support iPhone App

Please rate all helpful posts "The more you help the more you learn"
New Member

Re: sip incoming authentication

Carlo

I get registration 2 ways

1) Adding SIPID to the ephone-dn as a secondary number

2) Removing secondary number and "registrar dns:callcentric.com expires 3600", and replacing with "registrar 1 dns:callcentric.com:5060 expires 3600" as you indicated above. I do not get a registration without modifying the sip-ua config after removing secondary number.

Both look like this:

--------------------- Registrar-Index  1 ---------------------

Line                             peer       expires(sec) registered P-Associ-URI
================================ ========== ============ ========== ============
17772760570110                   -1         6            yes

Method 1 works for incoming calls

Method 2 fails with following messages. (I hope pastebin will be ok, sip debug is very long)

link removed

http://pastebin.com/CyXWXmN1registrar 1 dns:sip.dipdomain.com:5060--------------------- Registrar-Index  1 ---------------------

Line                             peer       expires(sec) registered P-Associ-URI
================================ ========== ============ ========== ============
17772760570110                   -1         6            yes

Re: sip incoming authentication

Hi Evan.
Can you please post running config?

Thanks

Regards

Carlo

Sent from Cisco Technical Support iPhone App

Please rate all helpful posts "The more you help the more you learn"
New Member

Re: sip incoming authentication

Sure, thank you for your continued support on this.

Do not worry about credentials. I will review them all later.

link removed      

Re: sip incoming authentication

Hi Evan

On your dial-peer 6 use incoming called-number 17772760570110

Try and let me know.

HTH

Regards

Carlo

Please rate all helpful posts

"The more you help the more you learn"

Please rate all helpful posts "The more you help the more you learn"
New Member

Re: sip incoming authentication

Carlo,

You've done it. Incoming calls are working now!

I did not read this doc well enough, it would seem:

http://www.cisco.com/en/US/tech/tk652/tk90/technologies_tech_note09186a008010fed1.shtml

Too many nights of staring a debugs!

In any case, I cannot possibly thank you enough.

Here is the full config:

voice service voip

ip address trusted list

! ADD YOUR PROVIDERS IPV4 ADDRESSES HERE

allow-connections h323 to h323

allow-connections h323 to sip

allow-connections sip to h323

allow-connections sip to sip

no supplementary-service sip moved-temporarily

no supplementary-service sip refer

redirect ip2ip

sip

! WAN INTERFACE

  bind control source-interface FastEthernet0/1

  bind media source-interface FastEthernet0/1

  e911

  registrar server expires max 36000 min 600

  localhost dns:callcentric.com

  outbound-proxy dns:callcentric.com

!

voice translation-rule 1

rule 1 /EXTENSION/ /SIPID/

! REPLACE THESE TO MATCH YOUR INFORMATION

voice translation-rule 2

rule 1 /SIPID/ /EXTENSION/

!

voice translation-profile INC

translate called 2

voice translation-profile OUT

translate calling 1

!

dial-peer voice 6 voip

description ## INBOUND DID ##

translation-profile incoming INC

session protocol sipv2

session target dns:callcentric.com

incoming called-number SIPID

dtmf-relay sip-notify rtp-nte

codec g711ulaw

no vad

!

dial-peer voice 11 voip

description ### LD USA ###

translation-profile outgoing OUT

destination-pattern 1[1-9]..[1-9]......

! YOU MAY NEED TO CHANGE THIS DEPENDING ON YOUR LOCATION

session protocol sipv2

session target dns:callcentric.com:5060

session transport udp

dtmf-relay sip-notify rtp-nte

codec g711ulaw

!

dial-peer voice 10 voip

translation-profile outgoing OUT

destination-pattern .T

session protocol sipv2

session target dns:callcentric.com

dtmf-relay sip-notify rtp-nte

codec g711ulaw

sip-ua

credentials username password realm callcentric.com

authentication username password realm

no remote-party-id

retry invite 4

retry response 3

retry bye 2

retry cancel 2

retry register 5

timers register 250

registrar 1 dns:callcentric.com:5060 expires 3600

sip-server dns:callcentric.com:5060

host-registrar

!

!

!

telephony-service

no auto-reg-ephone

max-ephones 42

max-dn 144

ip source-address 172.16.1.1 port 2000

no caller-id name-only

calling-number initiator

time-zone 8

voicemail 202

max-conferences 4 gain -6

transfer-system full-blind

transfer-pattern .T

secondary-dialtone 9

!

!

ephone-dn  100

! MAKE SURE THIS MATCHES YOUR VOICE TRANSLATION RULES

number 100 no-reg primary

!

!

ephone  100

! MAKE SURE THIS MATCHES YOUR VOICE TRANSLATION RULES

device-security-mode none

mac-address 3191.7E4E.0082

max-calls-per-button 2

type anl

button  1:100

Re: sip incoming authentication

Hi Evan.
Thank you for nice rating and I'm glad to help.

Regards
Carlo
Carlo

Sent from Cisco Technical Support iPhone App

Please rate all helpful posts "The more you help the more you learn"
New Member

sip incoming authentication

I think I spoke too soon. For some reason now outgoing fails with the same error.

sip incoming authentication

Hi Evan.

Can  you please send the output of debug ccsip message during a failing call?

Thanks

Carlo

Please rate all helpful posts

"The more you help the more you learn"

Please rate all helpful posts "The more you help the more you learn"
New Member

Re: sip incoming authentication

Hello again Carlo

Here are the debugs

All are from calling my cell number from EXT 100

Config

link removed

CCSIP Messages

link removed

Translation

link removed

Dial-Peer

link removed

Message was edited by: Evan Roggenkamp (remove links)

Re: sip incoming authentication

Hi Evan.
Modify you dial-peer 11 as follow
session target dns:callcentric.com:5060
session transport udp
Please attach a full trace of a call using debug ccsip messages.

HTH
Regards

Carlo

Sent from Cisco Technical Support iPhone App

Please rate all helpful posts "The more you help the more you learn"
New Member

Re: sip incoming authentication

Carlo

I have made the change. Here is the debug output.

link removed

If I may note there is a significant difference between debugs on the IOS platform and on my Asterisk system (which works OK in/out with the same ITSP)

I will leave them here in the event they may help; otherwise, disregard.

link removed

All the best,

Evan

sip incoming authentication

Hi Evan

Under sip-ua change the realm on authentication section.

remove -->> authentication username 17772760570110 password realm callcentric.com

add -->>> authentication username 17772760570110 password realm 68.112.156.253

HTH

Regards

Carlo

Please rate all helpful posts

"The more you help the more you learn"

Please rate all helpful posts "The more you help the more you learn"
New Member

Re: sip incoming authentication

Carlo

You have done it again! Everything is working as expected. Tested BOTH ways this time, to be sure. Much I have to learn about the SIP protocol it would seem.

You have saved me much time and further frustration by your assistance; dinner is on me!

Thank you again, and all the best.

Re: sip incoming authentication

Thank you again for nice rating and for the dinner :)

Please keep on posting whenever you need
Best regards

Carlo
Sent from Cisco Technical Support iPhone App

Please rate all helpful posts "The more you help the more you learn"
1535
Views
5
Helpful
18
Replies