CUBE SIP 403 Request From Unknown Source

[uastac2011]

Hi Guys,

Need some help. We are implementing SIP connection and I am new for this. I cannot make it work. I already did what the article or forums but still failed.

Here is the topology. Attached files are sip config and debug. 
I am hoping that you can help me. Thank you so much.

[TONY SMITH]

Do you see an appropriate Invite from the ITSP when you make an incoming call?

[uastac2011]

Hi Tony
I think i am not getting an invite from them.

here is the logs when i tried to call

here is the logs

Aug 16 09:39:32.793: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
OPTIONS sip:192.168.1.5:5060 SIP/2.0
Via: SIP/2.0/UDP 172.27.199.11:5060;branch=z9hG4bK3fb4703578b4
From: <sip:172.27.199.11>;tag=1473428793
To: <sip:192.168.1.5>
Date: Fri, 16 Aug 2019 09:39:32 GMT
Call-ID: bec86780-d56179d4-3eed-bc71bac@172.27.199.11
User-Agent: Cisco-CUCM10.5
CSeq: 101 OPTIONS
Contact: <sip:172.27.199.11:5060>
Max-Forwards: 0
Content-Length: 0


Aug 16 09:39:32.797: //9752/9610430CA791/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 200 OK
Via: SIP/2.0/UDP 172.27.199.11:5060;branch=z9hG4bK3fb4703578b4
From: <sip:172.27.199.11>;tag=1473428793
To: <sip:192.168.1.5>;tag=275F5B08-1B02
Date: Fri, 16 Aug 2019 09:39:32 GMT
Call-ID: bec86780-d56179d4-3eed-bc71bac@172.27.199.11
Server: Cisco-SIPGateway/IOS-15.7.3.M4b
CSeq: 101 OPTIONS
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
--More--  Allow-Events: telephone-event
Accept: application/sdp
Supported: 100rel,timer,resource-priority,replaces,sdp-anat
Content-Type: application/sdp
Content-Length: 375

v=0
o=CiscoSystemsSIP-GW-UserAgent 6061 6591 IN IP4 192.168.104.2
s=SIP Call
c=IN IP4 192.168.104.2
t=0 0
m=audio 0 RTP/AVP 18 0 8 9 4 2 15
c=IN IP4 192.168.104.2
m=image 0 udptl t38
c=IN IP4 192.168.104.2
a=T38FaxVersion:0
a=T38MaxBitRate:9600
a=T38FaxRateManagement:transferredTCF
a=T38FaxMaxBuffer:200
a=T38FaxMaxDatagram:320
a=T38FaxUdpEC:t38UDPRedundancy

[uastac2011]

Hi Guys,

The provider said we use the signaling ip of 192.168.1.202
now i can see the invite coming from ITSP but i get 404 not found. 
I have attached the debug ccsip msg. hope you can help me. Thank you so much.

[TONY SMITH]

It's not really clear what we're looking at here.  Your protocol diagram shows an incoming Invite to which your CUBE is returning 404 Not Found without talking to the CUCM.  No matching dial peer maybe?   On the other hand your PCAP shows and incoming Invite to which the CUBE replies with Trying, Ringing then finally Busy after 25 seconds.   

[uastac2011]

thank you.

question, where will i put or config the signaling ip?
the provider said that we should use the signaling ip as cucm ip address.
current ip of cucm 172.27.199.11 change to 192.168.1.202.

[TONY SMITH]

"the provider said that we should use the signaling ip as cucm ip address"

I'd be surprised if they really mean that.  My experience is that providers tend to think that a customers infrastructure consists solely of one box connected to their service.  Regardless your SIP signalling to the ITSP originates from your CUBE not from CUCM, so you can only bind to an address actually configured on one of CUBE interfaces.  Normally it would be the interface which transmits the CUBE<->ITSP traffic but in a service authenticated by IP it need to be the address the ITSP expects.

I think your configuration is changing as you progress, and maybe some of the snippets you've posted are from different versions of the config.  So for clarity could you confirm where the address 192.168.1.202 has been configured?

[uastac2011]

for now i followed what the providers said.
the ip of cucm is 192.168.1.202

where should i put the signaling ip?

[uastac2011]

The provider used X Lite to test the sip. 

Maybe we can compare that might missing in cucm config based on this.

[TONY SMITH]

Thanks for the updated diagram showing latest addressing.  Based on that it looks like you're trying to trunk directly between CUCM and the ITSP, is that correct?  Not using the CUBE function?

[uastac2011]

Here is my destination address on sip trunk.

Is this correct?

[TONY SMITH]

That looks correct if your CUCM is talking to your CUBE.   However earlier you showed signalling passing between three devices and it looked like an undefined device 192.168.1.202 was talking on one side to 172.27.199.11 (CUCM?) and also to 10.251.48.148.   I presume all these previous debugs are no longer relevant if you've checked all your addressing.

Let's see current debugs with your current configuration.  Ideally need to see SIP messages both between CUCM and CUBE, and between CUBE and ITSP.  One set for an inbound call and one for outbound.

[uastac2011]

Hi Tony 

attached files are the debug. thank you.

[TONY SMITH]

Outgoing you're back to the Error 403 from your service provider, exactly as it was a week ago except that some of your internal IP addresses have changed.

Really I think at this stage it should be back to first principles because at the moment we're going round in circles.  What specifications and requirements did you receive from the ITSP?  Did they specify the IP address you should use for your signalling to them?  I suspect that's the issue, if you're not using the correct IP then they're going to knock back your outgoing call attempt.  And you won't see any incoming call as their Invite won't be addressed to you.

Maybe post up exactly what you were given by the ITSP in terms of instructions?

[uastac2011]

Hi Tony

Here is what they gave to us.

[Vaijanath Sonvane]

Hi,

Please post your latest configuration and output of below debug commands for inbound and outbound calls separately:

debug ccsip messages

debug ccsip events

debug voip ccapi inout