SPA112 Not Registering

[JeremyTourville71]

My ATA is not registering with the PBX system.  If I setup a softphone I can get it to register without any issues.  The issue seems to be with the ATA specifically.  I am running FreePBX ver 13.x (PBXinaFlash) for Raspberry Pi 2.  My ATA is running Firmware ver 1.4.1 and has been reset to factory defaults with the exception of the line I am trying to register.  I made sure the extension number, ports and secret matched on both the ATA and PBX settings.  My proxy is set to that of the PBX using IP address not hostname or FQDN.

I turned on logging and captured the following after power cycling the ATA and seeing the status change from "not registered" to "failed"

Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd 5, EP 2, ParameterType 22, ParameterValue 1
Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd - 5, response 8
Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd 5, EP 2, ParameterType 27, ParameterValue 60
Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd 5, EP 2, ParameterType 26, ParameterValue 70
Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd - 5, response 8
Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd - 5, response 8
Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd 5, EP 1, ParameterType 22, ParameterValue 1
Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd - 5, response 8
Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd 5, EP 1, ParameterType 27, ParameterValue 60
Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd 5, EP 1, ParameterType 26, ParameterValue 70
Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd - 5, response 8
Jun 29 20:45:56 SPA112 user.notice sprvoip: cmd - 5, response 8
Jun 29 20:46:15 SPA112 user.notice sprvoip: cmd - 18, response 23
Jun 29 20:46:16 SPA112 user.notice sprvoip: cmd - 18, response 49

Can anyone tell me what these response codes mean?  Is there something else I should check?

Thanks for your assistance.

[nipurwins]

I have this problem too.I can't manage to get the SPA112 registered with our PBX.

Permanently messages like this:

Jan 1 00:00:43 SPA112 user.notice sprvoip: cmd - 5, response 8

Our ATAs in the field (different vendor) show SIP status-codes like "SIP-401 (unauthorized)" in the log, so I am able to check the corresponding configuration parts, but the log output of SPA112 is not very helpful.

We plan to substitute nearly 2000 ATAs and are looking for an easy to manage device. I'm not shure if the SPA112 remains on the shortlist as the configuration isn't easy at all.

[JeremyTourville71]

I forgot I posted out here as nobody answered.  Anyway, I did find my answer, it was quite simple.  My PBX firewall was blocking the packet from the SPA112.  As an initial test I turned off the firewall and the SPA112 quickly registered.  I turned the firewall back on and it continued to work for a while.  When I realized the connection died again a little time later, I added the correct IP tables rules to the PBX.  This time the connection lasted until I needed to reboot the PBX.  After the reboot the connection was broken again.  The final, ultimate fix was to add the SPA112 to the whitelist.  Once I added the ATA to the whitelist a permanent entry was created in the firewall.  This completely fixed my issue.

YMMV, it all depends on the policies and firewall setup of the PBX distro you are using.

[Dan Lukes]

1. Nobody has responded because you posted your question in inappropriate community. I discovered it and moved to the proper one just few weeks ago, but I considered it so old to respond.

2. The messages like 'SPA112 user.notice sprvoip: cmd ...' are from kernel's syslog. You wish to read VoIP application syslog instead. Read Debug and syslog Messages from SPA1x2 for more. Also, packet dump (e.g. SIP registration packet sent by SPA1x2 as well as response from it's peer) are valuable source of information.

[nipurwins]

I managed to register the SPA112 after capturing SIP traffic with wireshark. There were some SIP-401 and SIP-403 stats. 

Even syslog messages weren't sufficent to figure out what goes wrong in registration.

So problem is solved but not I'm not convinced at all.

[Dan Lukes]

• 401 = 'we require authentication - add credentials to request and try again'
• 403 = 'Server is refusing to fulfill request' - for example credentials are required, but those supplied are not correct.

While 401 is not so important event for you, the 403's are sign of an issue. Unfortunately, client (e.g. SPA112) can't disclose you why received 403 response. It's server response and it's up to server to disclose reason. Most of time = server discloses no reason, especially for the failing register (because details may help rogue user to brute force access to other;s account).

It's not matter of firmware, configuration, or wishes - the reason not disclosed to client can't be logged by it.

Don't search syslog on SPA112 for the reason - check server's log instead. 

[nipurwins]

Problem is solved already. As I have no access to the Servers atm, I had to trace the SIP traffic with wireshark, only to figure out what SIP message the server sends to the Client.

Our current ATAs just show "Registration failure, SIP-403", so I can narrow to the reason.

Most of the tickets with our current ATAs are handled by our 1stL support by just look over the ATAs log. There is no option to give them access to server logs for trouble shooting. And I don't want to handly every ticket in 2ndL.

[Dan Lukes]

Well, it seems I just don't understand the issue you are facing.

Failing registration caused by 403 response is (sys-)logged by Voice Application (if the logging is enabled). So I assumed you are wishing for more details (e.g. why 403 has been responded by server) - thus my response 'only server knows'.

As mentioned already, those messages are NOT logged by kernel, but by Voice Application. Of course, reading wrong log will not disclose informations logged elsewhere.

[SteveMcPolin92686]

Is that file you linked to a map of the sprvoip syslog?   The link is dead, and the wayback machine just shows it as instructions on configuring wireshark.   If not, is there any documentation on these logs anywhere, or even a reference to what protocol they might correspond to?

[Dan Lukes]

It's just plain old syslog protocol. Thus any syslog server software daemon (not only the one behind the dead link) can process it - or - because it's almost text-only protocol, you can just capture network packets and read it's content. Wireshark or other software that can capture packets can be used for it.

[SteveMcPolin92686]

Oh, thanks. I had hoped that it had some sort of "cmd 5, (params)" -> cmd -5, response 8
could be turned into an indicator like "your cat chewed the cable"; but would have been roughly satiated with "what does 5,-5,8,20 mean in this context"?
Can you do any better than *we have no idea how the FFFF this device works"?

Ayy, aeh did. wha fancy ye

[Dan Lukes]

cmd X - like messages are from SPA112 kernel syslog - they are not useful most of time. For the purpose of SIP issues debugging you need to capture VoiceApplication syslog messages (those are NOT captured internally by SPA112, they are sent to external syslog server only). Those are less cryptic and someone familiar with SIP protocol can interpret meaning of most of them.

But short answer is "no, there's no documentation related to those messages, Cisco doesn't support self-service, buy support contract instead".