Facing issue with authenticated STC Sip Trunk

[mohd abdul malik]

Greetings Community Members,

I am facing this strange issue where i am working for the first time on an authenticated SIP Trunk from STC.

Need your help to solve this issue as even TAC is struggling on this case since 1 week.

They have provided only with Username and password upon further inquiry they provided with the following message saying the registration message should look like this:

Sent:
REGISTER sip:fmc.stc.com.sa SIP/2.0
Via: SIP/2.0/UDP 10.228.56.90:5060;branch=z9hG4bK14AE55
From: <sip:+9661110141198@fmc.stc.com.sa >;tag=4AEC7EF-D4F
To: <sip:+9661110141198@fmc.stc.com.sa >
Date: Tue, 18 Jul 2023 08:14:22 GMT

Although i did know how to do this configuration I tried my best checking all the guides but my registration was going like below

Sent:
REGISTER sip:10.154.15.25:5060 SIP/2.0
Via: SIP/2.0/UDP 10.228.56.90:5060;branch=z9hG4bK32222DF
From: <sip:+9661110141198@10.154.15.25>;tag=A90D606-C54
To: <sip:+9661110141198@10.154.15.25>
Date: Wed, 19 Jul 2023 11:39:00 GMT
Call-ID: FFFFFFFFD862BB79-23E011EE-FFFFFFFF807DBF43-164D5B82
User-Agent: Cisco-SIPGateway/IOS-15.5.2.S3
Max-Forwards: 6
Timestamp: 1689766740
CSeq: 765 REGISTER
Contact: <sip:+9661110141198@10.228.56.90:5060>
Expires: 3600
Supported: path
Content-Length: 0

I opened a case with Cisco Tac a week back they responded it needs SIP profiles to be configured and now after 1 week we are still struggling to send the register message in the required format.

I have attached my current configuraiton.

After all Cisco TAC did we could send the register message as below and we recieved 403 Forbidden message

Jul 20 14:12:21.905: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Sent:
REGISTER sip:10.154.15.25:5060 SIP/2.0
Via: SIP/2.0/UDP 10.189.133.50:5060;branch=z9hG4bK21A24
From: <sip:+9661110141198@10.154.15.25>;tag=6E79F-392
To: <sip:+9661110141198@10.154.15.25>
Date: Thu, 20 Jul 2023 14:12:21 GMT
Call-ID: 6DFA5FA3-263D11EE-FFFFFFFF8002C517-FFFFFFFFA5150B52
User-Agent: Cisco-SIPGateway/IOS-15.5.2.S3
Max-Forwards: 70
Timestamp: 1689862341
CSeq: 4 REGISTER
Contact: <sip:+9661110141198@10.189.133.50:5060>
Expires: 3600
Supported: path
Content-Length: 0

Jul 20 14:12:22.026: //5/000000000000/SIP/Msg/ccsipDisplayMsg:
Received:
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP 10.189.133.50:5060;branch=z9hG4bK21A24
Call-ID: 6DFA5FA3-263D11EE-FFFFFFFF8002C517-FFFFFFFFA5150B52
From: <sip:+9661110141198@10.154.15.25>;tag=6E79F-392
To: <sip:+9661110141198@10.154.15.25>;tag=eed7nn3e
CSeq: 4 REGISTER
Warning: 399 5133.1261.I.260.12.165.4.7.5134.0.0.fmc.stc.com.sa "Invalid User"
Content-Length: 0

Need your support.

Thanks.

[Roger Kallberg · Accepted solution]

A few things, firstly as you use the gateway for both SRST and a SIP trunk with registration you'll need to move the ITSP registration configuration to a tenant configuration, secondly you do not have any bind statements on any of your dial-peers, that's a very bad practice. Also you SIP profile is not correctly crafted if you want the outcome that you ask about. Try something along the line with this, with a reservation that you likely need to modify it somewhat to either work fully or fit your specific needs as it's written based on the available documentation and not tested IRL.

voice service voip
 no allow-connections h323 to h323
 no allow-connections h323 to sip
 no allow-connections sip to h323
no h323
sip
registrar server
 no outbound-proxy dns:fmc.stc.com.sa
!
no voice class sip-profiles 100
voice class sip-profiles 100
 request REGISTER sip-header SIP-Req-URI modify "(sip:)10.154.15.25:5060" "\1fmc.stc.com.sa"
 request REGISTER sip-header From modify "(<sip:)(+9661110141198)@10.154.15.25>" "\1\2@fmc.stc.com.sa>"
 request REGISTER sip-header To modify "(<sip:)(+9661110141198)@10.154.15.25>" "\1\2@fmc.stc.com.sa>"
!
sip-ua
 no credentials number +9661110141198 username +9661110141198@fmc.stc.com.sa password 7 075E781F1F5A40514438 realm fmc.stc.com.sa
 no authentication username +9661110141198@fmc.stc.com.sa password 7 1543525F557972707B19 realm fmc.stc.com.sa
 registrar ipv4:10.228.56.90 expires 3600
!
no ip route 10.228.0.0 255.255.255.0 10.228.56.254
!
voice class tenant 1
 credentials number +9661110141198 username +9661110141198@fmc.stc.com.sa password 7 075E781F1F5A40514438 realm fmc.stc.com.sa
 authentication username +9661110141198@fmc.stc.com.sa password 7 1543525F557972707B19 realm fmc.stc.com.sa
 outbound-proxy dns:fmc.stc.com.sa
 registrar ipv4:10.154.15.25 expires 3600
 sip-profiles 100
! 
dial-peer voice 2 voip
 bind control source-interface GigabitEthernet0/0/1
 bind media source-interface GigabitEthernet0/0/1
!
dial-peer voice 3 voip
 no authentication username +9661110141198@fmc.stc.com.sa password 7 0870151D584A5C434121
 bind control source-interface GigabitEthernet0/0/0
 bind media source-interface GigabitEthernet0/0/0
 voice-class sip tenant 1
!
dial-peer voice 4 voip
 bind control source-interface GigabitEthernet0/0/0
 bind media source-interface GigabitEthernet0/0/0
 voice-class sip tenant 1
!
dial-peer voice 5 voip
 bind control source-interface GigabitEthernet0/0/0
 bind media source-interface GigabitEthernet0/0/0
 voice-class sip tenant 1
!
dial-peer voice 6 voip
 bind control source-interface GigabitEthernet0/0/1
 bind media source-interface GigabitEthernet0/0/1
!
dial-peer voice 7 voip
 bind control source-interface GigabitEthernet0/0/0
 bind media source-interface GigabitEthernet0/0/0
 voice-class sip tenant 1
!
dial-peer voice 8 voip
 bind control source-interface GigabitEthernet0/0/0
 bind media source-interface GigabitEthernet0/0/0
 voice-class sip tenant 1
!
dial-peer voice 9 voip
 bind control source-interface GigabitEthernet0/0/0
 bind media source-interface GigabitEthernet0/0/0
 voice-class sip tenant 1
!
dial-peer voice 10 voip
 bind control source-interface GigabitEthernet0/0/0
 bind media source-interface GigabitEthernet0/0/0
 voice-class sip tenant 1
!
dial-peer voice 11 voip
 bind control source-interface GigabitEthernet0/0/1
 bind media source-interface GigabitEthernet0/0/1
!
dial-peer voice 12 voip
 bind control source-interface GigabitEthernet0/0/1
 bind media source-interface GigabitEthernet0/0/1
!
dial-peer voice 16 voip
 bind control source-interface GigabitEthernet0/0/1
 bind media source-interface GigabitEthernet0/0/1
!

For more information on how to configure a SBC please have a look at this document. Cisco Unified Border Element Configuration Guide Through Cisco IOS XE 17.5  

[mohd abdul malik]

Thanks Roger.

I will try with the above method and get back to you today.

[Roger Kallberg]

I would also advise you to change the bind statements in your global voice service voip section to this.

bind control source-interface GigabitEthernet0/0/1
bind media source-interface GigabitEthernet0/0/1

[mohd abdul malik]

Yes, i did remove the bind statements under voice service voip.

I also made the below changes in the SIP Profile as it was not accepting "Register" so i made it "Any."

voice class sip-profiles 100
request REGISTER sip-header SIP-Req-URI modify "(sip:)10.154.15.25:5060" "\1fmc.stc.com.sa"
request REGISTER sip-header From modify "(<sip:)(+9661110141198)@10.154.15.25>" "\1\2@fmc.stc.com.sa>"
response Any sip-header From modify "(<sip:)(+9661110141198)@10.154.15.25>" "\1\2@fmc.stc.com.sa>"
request REGISTER sip-header To modify "(<sip:)(+9661110141198)@10.154.15.25>" "\1\2@fmc.stc.com.sa>"
response ANY sip-header To modify "(<sip:)(+9661110141198)@10.154.15.25>" "\1\2@fmc.stc.com.sa>"

My current IOS version is Version 15.5(2)S3 therefore its not accepting the voice class tenant Commands.

I will first have to upgrade it to 15.6(2) atleast it seems.

I will upgrade and apply the suggested configs.

Will surely get back.

Appreciate your support.

[Roger Kallberg]

Why are you using so old version of IOS? I would recommend using version 17.6.4 as that’s a reliable and proven release. Also I did not write that you should remove the bind statements from your global configuration. You need to have them there for your SRST configuration to work, so you should have your internal interface set there.

Any is likely a bad idea to use as it would affect other things than just the registration header.

[b.winter]

There is no REGISTER method on the response^^ That's why you cannot enter it.
SIP REGISTER is a request method.

[mohd abdul malik]

Hey Roger,

Unfortunately it is not accepting the Register command under sip profile as can be seen in the snapshot therefore i applied it with Any.

After applying all the suggested configs We are still not able to send the Register message along with the domain name as can be seen below:

Please advise.

REGISTER sip:10.154.15.25:5060 SIP/2.0
Via: SIP/2.0/UDP 10.228.56.90:5060;branch=z9hG4bK1715AA
From: <sip:+9661110141198@10.154.15.25>;tag=528516-15AC
To: <sip:+9661110141198@10.154.15.25>
Date: Sun, 23 Jul 2023 13:32:38 GMT
Call-ID: 657D413E-288A11EE-FFFFFFFF8002C113-5B17C5FD
User-Agent: Cisco-SIPGateway/IOS-16.3.9
Max-Forwards: 70
Timestamp: 1690119158
CSeq: 25 REGISTER
Contact: <sip:+9661110141198@10.228.56.90:5060>
Expires: 3600
Supported: path
Content-Length: 0

Jul 23 13:32:39.766: //25/000000000000/SIP/Msg/ccsipDisplayMsg:
Sent:
REGISTER sip:10.154.15.25:5060 SIP/2.0
Via: SIP/2.0/UDP 10.228.56.90:5060;branch=z9hG4bK1715AA
From: <sip:+9661110141198@10.154.15.25>;tag=528516-15AC
To: <sip:+9661110141198@10.154.15.25>
Date: Sun, 23 Jul 2023 13:32:39 GMT
Call-ID: 657D413E-288A11EE-FFFFFFFF8002C113-5B17C5FD
User-Agent: Cisco-SIPGateway/IOS-16.3.9
Max-Forwards: 70
Timestamp: 1690119159
CSeq: 25 REGISTER
Contact: <sip:+9661110141198@10.228.56.90:5060>
Expires: 3600
Supported: path
Content-Length: 0

[Roger Kallberg]

Please post your configuration after you have put in the suggested changes and also the output from debug ccsip message, debug voip ccapi inout and debug voip translation running simultaneously.

[Nithin Eluvathingal]

Make sure your Cube router has required route to the ISP SIP server IP. verify the network connectivity between your CUBE and ISP SIP server. With the Voice class tenant conf shared by @Roger Kallberg it should register if there is a connectivity.

[Roger Kallberg]

Any update on this? Would you be able to provide the asked for information?

[Ibrahim AlQumairi]

FYI 

For CUBE registration configuration, Check the below link which contains more details about the registration process:

https://community.cisco.com/t5/collaboration-blogs/handle-cube-registration-authentication-like-a-boss/ba-p/3660492

[mohd abdul malik]

Hello Roger,

Now after making some changes the Gateway got registered(I have attached the current config). Now the Calls are not working, we have opened another case with the service provider and waiting for their update.

Thanks for your and everybody else's support.

[Roger Kallberg]

With the configuration you shared now you will not have a working SRST setup. For this you’ll need to add the global bind statements and you need to correct your SIP-UA configuration. Also what I noticed that you have statically configured name resolution. This is a quick way to get into a lot of trouble. I would recommend you to configure use of DNS for name resolution. One last thing, it’s recommended to use information in the VIA header to match the inbound dial peers, not inbound calling or caller number, which you btw is currently missing one dial peer, namely for the direction from CM to the gateway. It’s highly advisable to add that as otherwise you’ll end up with issues for what interface to use for that traffic. This could end up in issues with one way audio. What you want is at a minimum two pairs of dial peers, one inbound and one outbound for CM and the same for the ITSP, so total four dial peers. To have one outbound dial peer towards CM you’d need to user a server group as you’d likely have more than one CM. Have a look at this document for about all the information you’ll ever need and/or wanted to know about call routing in IOS. Explain Cisco IOS and IOS XE Call Routing 

[mohd abdul malik]

Thanks Roger for going through my config.

I will definitely go through your recommendations and try to include as much as possible.

Looking at the guidance and explanations I am wondering why i didnt post here earlier most of my doubts and things would have been cleared long back.

Anyways I will try asking more questions and go through things deeply.

Thanks for being inspiration to me.

AbdulMalik.