SIP registration NOK on ISR4331

[JulienCAROFF87492]

Hi All,

I try to register some basic SIP phones to Cisco ISR 4331.

My SIP phone has username = 60401 password=60401

And the VoIP Router/GW sends a 401 Unauthorized... But I dont see why because REGISTER looks OK

Can someone pls help and have a look at below traces:

* REGISTER received by VoIP GW =>

Received:
REGISTER sip:10.0.0.1 SIP/2.0

Via: SIP/2.0/UDP 33.129.0.2:50687;branch=z9hG4bK-x7tlkl67jj61;rport

From: "Fixed1_0_60401" <sip:60401@10.0.0.1>;tag=ffne8scs5n

To: "Fixed1_0_60401" <sip:60401@10.0.0.1>

Call-ID: 3135373138323138383331353539-knasv82hhz8n

CSeq: 1453 REGISTER

Max-Forwards: 70

User-Agent: snomD305/10.1.39.11

Contact: <sip:60401@33.129.0.2:50687;line=2535bc1d>;reg-id=1;q=1.0;+sip.instance="<urn:uuid:b69e6b77-1c7b-460c-8be5-0004138E2210>";audio;mobility="fixed";duplex="full";description="snomD305";actor="principal";events="dialog";methods="INVITE,ACK,CANCEL,BYE,REFER,OPTIONS,NOTIFY,SUBSCRIBE,PRACK,MESSAGE,INFO"

Allow-Events: dialog, talk, hold, check-sync

X-Real-IP: 33.129.0.2

Supported: path, gruu

Authorization: Digest username="60401",realm="10.0.0.1",nonce="67F7D58004162216",uri="sip:33.159.246.25",qop=auth,nc=00000001,cnonce="1fb0eed5",response="948cb5997aaad66793ed0a798805cac9",algorithm=MD5

Expires: 3600

Content-Length: 0

* 401 Unauthorized sent by VoIP GW =>

SIP/2.0 401 Unauthorized

Via: SIP/2.0/UDP 33.129.0.2:50687;branch=z9hG4bK-x7tlkl67jj61;rport

From: "Fixed1_0_60401" <sip:60401@10.0.0.1>;tag=ffne8scs5n

To: "Fixed1_0_60401" <sip:60401@10.0.0.1>;tag=28DF9828-A5F

Date: Thu, 24 Oct 2019 10:59:46 GMT

Call-ID: 3135373138323138383331353539-knasv82hhz8n

Server: Cisco-SIPGateway/IOS-16.7.1

CSeq: 1453 REGISTER

WWW-Authenticate: Digest realm="10.0.0.1",nonce="67F7D58004162216",algorithm=MD5,qop="auth"

Content-Length: 0

Maybe Realm=10.0.0.1 is an issue?

Thx in advance

[Vaijanath Sonvane]

Can you post the configuration of your router?

[JulienCAROFF87492]

Hi Vaijanath

I think I am guessing the issue:
Let me explain: I have setup double loopback config in my VoIP GW/Rtr for redundancy purpose

* At first, the SIP phone sends correct REGISTER, everything Digest, Username ...
* Then, stack SIP of VoIP GW/Rtr receives a slightly different REGISTER, because of some IP "translation"...
* Which leads to this 401 Unauthorized !

* And I think this is because my Request URI from the REGISTER received by stack SIP is different from Digest URI, which then leads to a REJECT from VoIP GW / Rtr ISR4331

See below trace; especially BOLD + UNEDRLINED fields

Stack SIP of Rtr-VoIPGW receives =>





Received:

REGISTER sip:10.0.0.1 SIP/2.0



Via: SIP/2.0/UDP 33.129.0.2:50687;branch=z9hG4bK-uowewyhdzyah;rport

From: "Fixed1_0_60401" 60401>;tag=dsqvnchcg1

To: "Fixed1_0_60401" 60401>



Call-ID: 3135373138323138383331353539-knasv82hhz8n

CSeq: 1525 REGISTER

Max-Forwards: 70
User-Agent: snomD305/10.1.39.11



Contact: 60401>;reg-id=1;q=1.0;+sip.instance="";audio;mobility="fixed";duplex="full";description="snomD305";actor="principal";events="dialog";methods="INVITE,ACK,CANCEL,BYE,REFER,OPTIONS,NOTIFY,SUBSCRIBE,PRACK,MESSAGE,INFO"



Allow-Events: dialog, talk, hold, check-sync

X-Real-IP: 33.129.0.2

Supported: path, gruu



Authorization: Digest username="60401",realm="",nonce="3814BDF604227396",uri="sip:33.159.246.25",qop=auth,nc=00000001,cnonce="1837b797",response="0e12aa06fe1cd819358687d1979fd390",algorithm=MD5



Expires: 3600

Content-Length: 0


* What do you think Vaijanath?
Thx for reply



60401>60401>60401>

[JulienCAROFF87492]

Sorry, did you get my possible solution?

[Vaijanath Sonvane]

Hi,

I am assuming that you are using this router as CME to register your phones. Could you please post your router configuration? Which Phone models you are trying to register? Are those phones local to CME Router?

[JulienCAROFF87492]

Hi

1°) Phones to register are SIP phones, brand SNOM & Bittium(username/PW are resp. 60401 & 60402)

2°) I try to register them on ISR43XX as a backup mode to CUCM

3°) "voice" router config =>
voice register global
mode cme
max-dn 3
max-pool 2
authenticate register
voice register dn 1
number 60401
voice register dn 2
number 60402
voice register pool 1
id device-id-name SNOM
username 60401 password 60401
voice register pool 2
id device-id-name BITTIUM
username 60402 password 60402
4°) It is a double NAT translation: 33.159.246.25 I in the phones as SIP proxy.
And 10.0.0.1 is in the router as loopback as well, cf "ip NAT loopback" config in Router =>

interface Loopback10
ip address 33.159.246.25 255.255.255.255
interface Loopback99
ip address 10.0.0.1 255.255.255.0
ip nat inside

5°) what do you think about what I was suggesting, the fact that I get 401 Unauthorized bcause SIP stack from router receives Request URI= 10.0.0.1 is different from Digest URI = 33.159.246.25 => Rtr sends unauthorized

U agree or NOT?

THX for reply

[Vaijanath Sonvane]

Hi,

If you are using Cisco 43XX as a SRST backup for CUCM registered third party SIP Phones then just to be clear that the third party SIP phones are not supported in SRST mode. Please check this post:

https://community.cisco.com/t5/ip-telephony-and-phones/sip-srst-dead/m-p/3943161#M383328

[JulienCAROFF87492]

OK I know that
But I am trying to find a solution because my manager asked me to do that!
So I am trying to setup some Loopback, nat inside on my 4331, to test all that...