SIP-UA Registered - Incoming Call 403 Forbidden

[Oleksii Martyshchenko]

Equipment is AS5350XM

Cisco IOS Software, 5350 Software (C5350-IS-M), Version 15.1(4)M8, RELEASE SOFTWARE (fc2)

I've got sip-ua registered.

Here is config:

sip-ua

 credentials username 0*******04 password 7 ******* realm custsip.********.com
 registrar ipv4:10.0.0.4 expires 3600
 sip-server ipv4:10.0.0.4

After configuring I can see registration process:

.Apr  2 08:04:43.088: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Sent:
REGISTER sip:custsip.********.com:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.120.204:5060;branch=z9hG4bK4DC53
From: <sip:0*******04@custsip.********.com>;tag=4A60078-2222
To: <sip:0*******04@custsip.********.com>
Date: Wed, 02 Apr 2014 08:04:43 GMT
Call-ID: 7EDA84EE-B96F11E3-80D9D56E-993FF98D
User-Agent: Cisco-SIPGateway/IOS-12.x
Max-Forwards: 70
Timestamp: 1396425883
CSeq: 4 REGISTER
Contact: <sip:0*******04@172.18.120.204:5060>
Expires:  0
Supported: path
Content-Length: 0

.Apr  2 08:04:43.092: //146/000000000000/SIP/Msg/ccsipDisplayMsg:
Received:
SIP/2.0 401 Unauthorized
Call-ID: 7EDA84EE-B96F11E3-80D9D56E-993FF98D
CSeq: 4 REGISTER
From: <sip:0*******04@custsip.********.com>;tag=4A60078-2222
Server: Cirpack/v4.56 (gw_sip)
To: <sip:0*******04@custsip.********.com>;tag=01-08164-09284568-32aebf744
Via: SIP/2.0/UDP 172.18.120.204:5060;received=172.18.120.204;branch=z9hG4bK4DC53
WWW-Authenticate: Digest realm="custsip.********.com",nonce="092844bd3ac366fe47a6ef295aadc956",opaque="09280abe35e5977",stale=false,algorithm=MD5
Content-Length: 0

.Apr  2 08:04:43.092: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Sent:
REGISTER sip:custsip.********.com:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.120.204:5060;branch=z9hG4bK4E221B
From: <sip:0*******04@custsip.********.com>;tag=4A60078-2222
To: <sip:0*******04@custsip.********.com>
Date: Wed, 02 Apr 2014 08:04:43 GMT
Call-ID: 7EDA84EE-B96F11E3-80D9D56E-993FF98D
User-Agent: Cisco-SIPGateway/IOS-12.x
Max-Forwards: 70
Timestamp: 1396425883
CSeq: 5 REGISTER
Contact: <sip:0*******04@172.18.120.204:5060>
Expires: 0
Authorization: Digest username="0*******04",realm="custsip.********.com",uri="sip:custsip.********.com:5060",response="ca34a06743949fb2f6777a2a31d760be",nonce="092844bd3ac366fe47a6ef295aadc956",opaque="09280abe35e5977",algorithm=MD5
Content-Length: 0

.Apr  2 08:04:43.096: //146/000000000000/SIP/Msg/ccsipDisplayMsg:
Received:
SIP/2.0 100 Trying

.Apr  2 08:04:53.876: //147/000000000000/SIP/Msg/ccsipDisplayMsg:
Received:

SIP/2.0 200 OK
Call-ID: 4EAC8FB8-B97411E3-80E1D56E-993FF98D
Contact: <sip:0*******04@172.18.120.204:5060>;expires=3600
CSeq: 3 REGISTER
From: <sip:0*******04@10.0.0.4>;tag=4A62A84-1355
P-Associated-URI: <sip:0*******04@custsip.********.com>
Server: Cirpack/v4.56 (gw_sip)
To: <sip:0*******04@10.0.0.4>;tag=01-08154-092847c8-16d37eca2
Via: SIP/2.0/UDP 172.18.120.204:5060;received=172.18.120.204;branch=z9hG4bK501CBF
Content-Length: 0

Here is a result:

hq_as5350xm_gw1# sh sip-ua register st
Line                                                                  peer               expires(sec)       registered     P-Associ-URI
================================ ========== ============ ========== ============
0*******04                                                          -1                  2206                   yes                 0*******04

I've configured dial-pear with numbers substitution:

voice service voip
 allow-connections h323 to sip
 allow-connections sip to h323
 allow-connections sip to sip
 fax protocol pass-through g711ulaw
 sip
  bind control source-interface GigabitEthernet0/1.600
  bind media source-interface GigabitEthernet0/1.600

voice translation-rule 2001
 rule 1 /.*/ /0*******04/

voice translation-rule 2002
 rule 1 /0*******04/ /3****95/

voice translation-profile DG-SIP_in
 translate called 2002

voice translation-profile DPG_DG-SIP
 translate calling 2001

interface GigabitEthernet0/1.600
 encapsulation dot1Q 600
 ip address 172.18.120.204 255.255.255.248

ip route 10.0.0.4 255.255.255.255 172.18.120.201

dial-peer voice 2001 voip

 translation-profile incoming DG-SIP_in
 translation-profile outgoing DPG_DG-SIP
 destination-pattern 050*****56
 session protocol sipv2
 session target sip-server

incoming called-number 0*******04

where 050*****56 is my mobile

and 3****95 is my local number

To reach this local number i've got 

dial-peer voice 101 voip
 description PSTN - CUCM1
 destination-pattern 3****[789].
 session target ipv4:10.20.8.5
 incoming called-number 9.T
 voice-class codec 1
 dtmf-relay h245-alphanumeric
 no vad

Outgoing calls are working great. I'm calling to my mobile and getting a call from 0*******04

But incoming calls don't work.

Here is a debug of calling back from my mobile to the number provided by ISP via SIP:

.Apr  2 08:56:05.574: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
INVITE sip:0*******04@172.18.120.204:5060;transport=udp SIP/2.0
Allow: UPDATE,REFER,INFO
Call-ID: 01201-XX-092af2ab-7921a0324@custsip.********.com
Contact: <sip:10.0.0.4:5060>
Content-Type: application/sdp
CSeq: 149931263 INVITE
From: "050*****56" <sip:050*****56@custsip.********.com;user=phone>;tag=01201-ZL-092af2ac-204a017d5
Max-Forwards: 29
To: <sip:0*******04@80.**.**.3;user=phone>
User-Agent: Cirpack/v4.56 (gw_sip)
Via: SIP/2.0/UDP 10.0.0.4:5060;branch=z9hG4bK-58FC-1A5E6A4
Content-Length: 250

v=0
o=cp10 139642899952 139642899952 IN IP4 10.0.0.3
s=SIP Call
c=IN IP4 10.0.0.3
t=0 0
m=audio 34548 RTP/AVP 8 0 18
b=AS:80
a=rtpmap:8 PCMA/8000/1
a=rtpmap:0 PCMU/8000/1
a=rtpmap:18 G729/8000/1
a=fmtp:18 annexb=no
a=ptime:20
a=sendrecv

.Apr  2 08:56:05.578: //6/75901865800A/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 10.0.0.4:5060;branch=z9hG4bK-58FC-1A5E6A4
From: "050*****56" <sip:050*****56@custsip.********.com;user=phone>;tag=01201-ZL-092af2ac-204a017d5
To: <sip:0*******04@80.**.**.3;user=phone>
Date: Wed, 02 Apr 2014 08:56:05 GMT
Call-ID: 01201-XX-092af2ab-7921a0324@custsip.********.com
CSeq: 149931263 INVITE
Allow-Events: telephone-event
Server: Cisco-SIPGateway/IOS-12.x
Content-Length: 0

.Apr  2 08:56:05.578: //6/75901865800A/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP 10.0.0.4:5060;branch=z9hG4bK-58FC-1A5E6A4
From: "050*****56" <sip:050*****56@custsip.********.com;user=phone>;tag=01201-ZL-092af2ac-204a017d5
To: <sip:0*******04@80.**.**.3;user=phone>;tag=856A0-40A
Date: Wed, 02 Apr 2014 08:56:05 GMT
Call-ID: 01201-XX-092af2ab-7921a0324@custsip.********.com
CSeq: 149931263 INVITE
Allow-Events: telephone-event
Server: Cisco-SIPGateway/IOS-12.x
Reason: Q.850;cause=21
Content-Length: 0

.Apr  2 08:56:05.582: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:

ACK sip:0*******04@172.18.120.204:5060;transport=udp SIP/2.0
Call-ID: 01201-XX-092af2ab-7921a0324@custsip.********.com
Contact: <sip:10.0.0.4:5060>
CSeq: 149931263 ACK
From: "050*****56" <sip:050*****56@custsip.********.com;user=phone>;tag=01201-ZL-092af2ac-204a017d5
Max-Forwards: 29
To: <sip:0*******04@80.**.**.3;user=phone>;tag=856A0-40A
User-Agent: Cirpack/v4.56 (gw_sip)
Via: SIP/2.0/UDP 10.0.0.4:5060;branch=z9hG4bK-58FC-1A5E6A4
Content-Length: 0

.Apr  2 09:02:13.522: //-1/xxxxxxxxxxxx/DPM/dpMatchPeersCore:
   Calling Number=0*******04, Called Number=0*******04, Peer Info Type=DIALPEER_INFO_SPEECH
.Apr  2 09:02:13.522: //-1/xxxxxxxxxxxx/DPM/dpMatchPeersCore:
   Match Rule=DP_MATCH_DEST; Called Number=0*******04
.Apr  2 09:02:13.522: //-1/xxxxxxxxxxxx/DPM/dpMatchPeersCore:
   No Outgoing Dial-peer Is Matched; Result=NO_MATCH(-1)
.Apr  2 09:02:13.522: //-1/xxxxxxxxxxxx/DPM/dpMatchSafModulePlugin:
   dialstring=0*******04, saf_enabled=1, saf_dndb_lookup=1, dp_result=-1
.Apr  2 09:02:13.522: //-1/xxxxxxxxxxxx/DPM/dpMatchPeersMoreArg:
   Result=NO_MATCH(-1)
.Apr  2 09:02:13.522: //-1/xxxxxxxxxxxx/DPM/dpAssociateIncomingPeerCore:
   Calling Number=050*****56, Called Number=, Voice-Interface=0x0,
   Timeout=TRUE, Peer Encap Type=ENCAP_VOIP, Peer Search Type=PEER_TYPE_VOICE,
   Peer Info Type=DIALPEER_INFO_SPEECH
.Apr  2 09:02:13.522: //-1/xxxxxxxxxxxx/DPM/dpAssociateIncomingPeerCore:
   Result=Success(0) after DP_MATCH_ORIGINATE; Incoming Dial-peer=2001
.Apr  2 09:02:13.522: //-1/xxxxxxxxxxxx/DPM/dpMatchSafModulePlugin:
   dialstring=NULL, saf_enabled=0, saf_dndb_lookup=0, dp_result=0
.Apr  2 09:02:13.522: //-1/50E080948018/DPM/dpAssociateIncomingPeerCore:

hq_as5350xm_gw1#Calling Number=050*****5, Called Number=0*******04, Voice-Interface=0x0,
   Timeout=TRUE, Peer Encap Type=ENCAP_VOIP, Peer Search Type=PEER_TYPE_VOICE,
   Peer Info Type=DIALPEER_INFO_SPEECH
.Apr  2 09:02:13.522: //-1/50E080948018/DPM/dpAssociateIncomingPeerCore:
   Result=Success(0) after DP_MATCH_INCOMING_DNIS; Incoming Dial-peer=2001
.Apr  2 09:02:13.522: //-1/50E080948018/DPM/dpMatchSafModulePlugin:
   dialstring=NULL, saf_enabled=0, saf_dndb_lookup=0, dp_result=0

I think the problem is in To header where  sip:0*******04@80.**.**.3;user=phone  is written. Am I right? Or it can't be that way.

80.**.**.3 is real IP of ISP SIP proxy, as I understand.

ISP says they can't change it. I only know that their equipment is Thompson.

And also what I can see is that gateway can't choose incoming dial-peer. I don't understand why if I define called number in 'incomming called number'.

[Suresh Subramanian · Accepted solution]

It seems the call is rejected by tollfraud application. Please check this URL.

http://www.cisco.com/c/en/us/support/docs/voice/call-routing-dial-plans/112083-tollfraud-ios.html#topic2

you may need to add the IP addresses under trust list.

Please collect debug voice ccapi inout and debug ccsip message for a test call.

//Suresh

Please rate all the useful posts

[Oleksii Martyshchenko]

.Apr  2 09:30:04.078: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
INVITE sip:0*******04@172.18.120.204:5060;transport=udp SIP/2.0
Allow: UPDATE,REFER,INFO
Call-ID: 14437-RV-092cb611-62a321132@custsip.********.com
Contact: <sip:10.0.0.4:5060>
Content-Type: application/sdp
CSeq: 150041301 INVITE
From: "050*****56" <sip:050*****56@custsip.********.com;user=phone>;tag=14437-NG-092cb612-2d877b981
Max-Forwards: 29
To: <sip:0*******04@80.**.**.3;user=phone>
User-Agent: Cirpack/v4.56 (gw_sip)
Via: SIP/2.0/UDP 10.0.0.4:5060;branch=z9hG4bK-4429-1A68985
Content-Length: 250

v=0
o=cp10 139643103847 139643103847 IN IP4 10.0.0.3
s=SIP Call
c=IN IP4 10.0.0.3
t=0 0
m=audio 30946 RTP/AVP 8 0 18
b=AS:80
a=rtpmap:8 PCMA/8000/1
a=rtpmap:0 PCMU/8000/1
a=rtpmap:18 G729/8000/1
a=fmtp:18 annexb=no
a=ptime:20
a=sendrecv

.Apr  2 09:30:04.082: //-1/xxxxxxxxxxxx/CCAPI/cc_set_post_tagdata:
   CALL_ERROR; Avlist Set Is Failed
.Apr  2 09:30:04.082: //-1/349BB8FC8027/CCAPI/cc_api_display_ie_subfields:
   cc_api_call_setup_ind_common:
   cisco-username=050*****56
   ----- ccCallInfo IE subfields -----
   cisco-ani=050*****56
   cisco-anitype=0
   cisco-aniplan=0
   cisco-anipi=0
   cisco-anisi=0
   dest=0*******04
   cisco-desttype=0
   cisco-destplan=0
   cisco-rdie=FFFFFFFF
   cisco-rdn=
   cisco-rdntype=0
   cisco-rdnplan=0
   cisco-rdnpi=-1
   cisco-rdnsi=-1
   cisco-redirectreason=-1   fwd_final_type =0
   final_redirectNumber =
   hunt_group_timeout =0

.Apr  2 09:30:04.082: //-1/349BB8FC8027/CCAPI/cc_api_call_setup_ind_common:
   Interface=0x67E2F8C0, Call Info(
   Calling Number=050*****56,(Calling Name=)(TON=Unknown, NPI=Unknown, Screening=Not Screened, Presentation=Allowed),
   Called Number=0*******04(TON=Unknown, NPI=Unknown),
   Calling Translated=FALSE, Subscriber Type Str=Unknown, FinalDestinationFlag=TRUE,
   Incoming Dial-peer=2001, Progress Indication=NULL(0), Calling IE Present=TRUE,
   Source Trkgrp Route Label=, Target Trkgrp Route Label=, CLID Transparent=FALSE), Call Id=20
.Apr  2 09:30:04.082: //-1/349BB8FC8027/CCAPI/ccCheckClipClir:
   In: Calling Number=050*****56(TON=Unknown, NPI=Unknown, Screening=Not Screened, Presentation=Allowed)
.Apr  2 09:30:04.082: //-1/349BB8FC8027/CCAPI/ccCheckClipClir:
   Out: Calling Number=050*****56(TON=Unknown, NPI=Unknown, Screening=Not Screened, Presentation=Allowed)
.Apr  2 09:30:04.082: //-1/xxxxxxxxxxxx/CCAPI/cc_get_feature_vsa:

.Apr  2 09:30:04.082: :cc_get_feature_vsa malloc success
.Apr  2 09:30:04.082: //-1/xxxxxxxxxxxx/CCAPI/cc_get_feature_vsa:

.Apr  2 09:30:04.082:  cc_get_feature_vsa count is 1
.Apr  2 09:30:04.082: //-1/xxxxxxxxxxxx/CCAPI/cc_get_feature_vsa:

.Apr  2 09:30:04.082: :FEATURE_VSA attributes are: feature_name:0,feature_time:1773941216,feature_id:10
.Apr  2 09:30:04.082: //20/349BB8FC8027/CCAPI/cc_api_call_setup_ind_common:
   Set Up Event Sent;
   Call Info(Calling Number=050*****56(TON=Unknown, NPI=Unknown, Screening=Not Screened, Presentation=Allowed),
   Called Number=0*******04(TON=Unknown, NPI=Unknown))
.Apr  2 09:30:04.082: //20/349BB8FC8027/CCAPI/cc_process_call_setup_ind:
   Event=0x68DC0DD0
.Apr  2 09:30:04.082: //-1/xxxxxxxxxxxx/CCAPI/cc_setupind_match_search:
   Try with the demoted called number 0*******04
.Apr  2 09:30:04.082: //20/349BB8FC8027/CCAPI/ccCallSetContext:
   Context=0x69BDD8C0
.Apr  2 09:30:04.086: //20/349BB8FC8027/CCAPI/cc_process_call_setup_ind:
   >>>>CCAPI handed cid 20 with tag 2001 to app "_ManagedAppProcess_TOLLFRAUD_APP"
.Apr  2 09:30:04.086: //20/349BB8FC8027/CCAPI/ccCallDisconnect:
   Cause Value=21, Tag=0x0, Call Entry(Previous Disconnect Cause=0, Disconnect Cause=0)
.Apr  2 09:30:04.086: //20/349BB8FC8027/CCAPI/ccCallDisconnect:
   Cause Value=21, Call Entry(Responsed=TRUE, Cause Value=21)
.Apr  2 09:30:04.086: //20/349BB8FC8027/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 10.0.0.4:5060;branch=z9hG4bK-4429-1A68985
From: "050*****56" <sip:050*****56@custsip.********.com;user=phone>;tag=14437-NG-092cb612-2d877b981
To: <sip:0*******04@80.**.**.3;user=phone>
Date: Wed, 02 Apr 2014 09:30:04 GMT
Call-ID: 14437-RV-092cb611-62a321132@custsip.********.com
CSeq: 150041301 INVITE
Allow-Events: telephone-event
Server: Cisco-SIPGateway/IOS-12.x
Content-Length: 0

.Apr  2 09:30:04.086: //20/349BB8FC8027/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP 10.0.0.4:5060;branch=z9hG4bK-4429-1A68985
From: "050*****56" <sip:050*****56@custsip.********.com;user=phone>;tag=14437-NG-092cb612-2d877b981
To: <sip:0*******04@80.**.**.3;user=phone>;tag=27718C-3BE
Date: Wed, 02 Apr 2014 09:30:04 GMT
Call-ID: 14437-RV-092cb611-62a321132@custsip.********.com
CSeq: 150041301 INVITE
Allow-Events: telephone-event
Server: Cisco-SIPGateway/IOS-12.x
Reason: Q.850;cause=21
Content-Length: 0

.Apr  2 09:30:04.086: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
ACK sip:0*******04@172.18.120.204:5060;transport=udp SIP/2.0
Call-ID: 14437-RV-092cb611-62a321132@custsip.********.com
Contact: <sip:10.0.0.4:5060>
CSeq: 150041301 ACK
From: "050*****56" <sip:050*****56@custsip.********.com;user=phone>;tag=14437-NG-092cb612-2d877b981
Max-Forwards: 29
To: <sip:0*******04@80.**.**.3;user=phone>;tag=27718C-3BE
User-Agent: Cirpack/v4.56 (gw_sip)
Via: SIP/2.0/UDP 10.0.0.4:5060;branch=z9hG4bK-4429-1A68985
Content-Length: 0

.Apr  2 09:30:04.090: //20/349BB8FC8027/CCAPI/cc_api_call_disconnect_done:

hq_as5350xm_gw1#Disposition=0, Interface=0x67E2F8C0, Tag=0x0, Call Id=20,
   Call Entry(Disconnect Cause=21, Voice Class Cause Code=0, Retry Count=0)
.Apr  2 09:30:04.090: //20/349BB8FC8027/CCAPI/cc_api_call_disconnect_done:
   Call Disconnect Event Sent
.Apr  2 09:30:04.090: //-1/xxxxxxxxxxxx/CCAPI/cc_free_feature_vsa:

.Apr  2 09:30:04.090: :cc_free_feature_vsa freeing 69BC31D8
.Apr  2 09:30:04.090: //-1/xxxxxxxxxxxx/CCAPI/cc_free_feature_vsa:

.Apr  2 09:30:04.090:  vsacount in free is 0

[Suresh Subramanian · Accepted solution]

OK, it is confirmed.

.Apr  2 09:30:04.086: //20/349BB8FC8027/CCAPI/cc_process_call_setup_ind:
   >>>>CCAPI handed cid 20 with tag 2001 to app "_ManagedAppProcess_TOLLFRAUD_APP"
.Apr  2 09:30:04.086: //20/349BB8FC8027/CCAPI/ccCallDisconnect:
   Cause Value=21, Tag=0x0, Call Entry(Previous Disconnect Cause=0, Disconnect Cause=0)

http://www.cisco.com/c/en/us/support/docs/voice/call-routing-dial-plans/112083-tollfraud-ios.html#t3

Please add the IP address 10.0.0.3 & 10.0.0.4 also service provider IP addresses under ip address trust list.

//Suresh

Please rate all the helpful posts.

[Oleksii Martyshchenko]

thank you, THANK YOU, THAAAANK YOUUUUU!!!!!

It works!

I've added to trust list and Bingo!! My local phone rang!

Thanks a lot!

[Suresh Subramanian]

Great to know it works now.

//Suresh

Please rate all the useful posts.

[Oleksii Martyshchenko]

For me how Great it is! 

[Oleksii Martyshchenko]

What I've also tried is:

voice class uri dg sip
 pattern 0********4

dial-peer voice 2001 voip

incoming uri from dg

[Dragan Ilic]

Just to add to Suresh comment - maybe you would need some SIP normalization script for inbound calls...check on cisco.com about that feature on CUBE.

BR,

Dragan

[Jean-Pierre Twagilimana]

I tried that too (http://www.cisco.com/c/en/us/support/docs/voice/call-routing-dial-plans/112083-tollfraud-ios.html#t3 ) and it worked, thanks.