ITSP not received INVITE with Authorization

[ibasuki]

Hi,

I have setup new ITSP with this configuration : CUCM -- CUBE -- ITSP (via internet)

Credentials provided by ITSP is correct because when I tried on phonerlite, it's registered and I can make incoming and outgoing call. But when I test it on CUBE, I only able to do incoming call, when make outgoing call from ip phone, there is no ringback tone or busy tone.

From investigation, SIP traces is like this:

1. CUBE sent 101 INVITE

2. ITSP response with 401 unauthorized

3. CUBE sent 102 INVITE contains Authorization

4. CUBE sent 102 INVITE contains Authorization

5. CUBE keeps resent 102 INVITE until I put phone on-hook

ITSP said they never got 102 INVITE messages from CUBE. Have someone experiencing issue like when they connect to ITSP via internet. Is it possible that the internet provider discard the second INVITE? Since calls using phonerlite is working, I find it hard to push internet provider to check on their side.

For further information, I attach SIP traces for the call.

Thank you.

[Scott Leport]

Hi, 

Is 021xxx21 in the "From" field a number out of your DDI range? 

Are you sure that the authentication password configured on your CUBE is the same one configured on phonerlite? 

Do you have IP connectivity to your ITSP's Signalling & Media IP addresses and are you allowing outbound requests from your network on port 5070? 

[ibasuki]

Sorry for late response.

Yes, 021xx21 is number from my DDI range. ITSP only gave us 1 number.

About configuration in phonerlite, that's where I got a bit confuse. In phonerlite, I used 021xx21 as username and abcdefg as auth.name. I didn't put phone number on phonerlite, but calls are working in and out.

While this is my sip-ua configuraition on router:

credentials number 021xxx21 username abcdefgh password 7 xxx realm itsp.ip.18
authentication username abcdefgh password 7 xxx
registrar 4 ipv4:itsp.ip.18 expires 60 auth-realm itsp.ip.18

My router is Cisco 4331 running on IOS 17.3.5. I have tried to match configuration with phonerlite like this:

credentials username 021xxx21 password 7 xxx realm itsp.ip.18

But turns out, sip-ua register status become NO. I attach phonerlite config in this reply too.

For port 5070, I tried mix and match some configuration to makes outgoing calls work. I tried 5060 and 5070, since ITSP inform us to use either 5060 or 5070 should be fine, as long as it's UDP, but none are working.

[b.winter]

Taking @Scott Leport's message a bit further:
Are you sure, that you need to sent the outgoing INVITEs to the provider SIP-port 5070 (instead of the standard SIP-port 5060)?
Is there a FW between the CUBE and the Internet?

But if the initial INVITE is answered by the provider, it wouldn't make sense, that the following outgoing SIP-messages are blocked along the path.

[ibasuki]

ITSP suggested us to use either 5060 or 5070. There is no firewall between CUBE and internet, since CUBE directly connected to ONT provided by internet provider.

I agree about initial INVITE is received by the provider. So to check if there is any block from our internet provider, I tried to use other CUBE with other internet provider. But, the SIP trace shows the same thing. CUBE keeps send INVITE 102 without reply form ITSP. My conclusion is like this:
- If internet provider is misconfig, I shouldn't be able to call in/out from phonerlite when I connected directly from laptop to ONT

- If ITSP is misconfig or password provided is wrong, I shouldn't be able to register and phonerlite should not work also.

That's why I'm trying to find out the correct SIP configuration for outgoing call via our ITSP, since incoming call is working normally.

[b.winter]

Can you share your complete config? Something is wrong with your sip-ua config, you are sending the string "username" as username in the Re-Invite:

Aug 13 12:21:50.777: //283638/1B4217800000/SIP/Msg/ccsipDisplayMsg:
Sent: 
INVITE sip:08xxxx09@itsp.ip.18:5070 SIP/2.0
Via: SIP/2.0/UDP 10.17.14.6:5060;branch=z9hG4bK5C534A26
Remote-Party-ID: "R.Meeting Galunggung" <sip:021xxx21@10.17.14.6>;party=calling;screen=yes;privacy=off
From: "R.Meeting Galunggung" <sip:021xxx21@itsp.ip.18>;tag=4BC32FD-26D9
To: <sip:08xxxx09@itsp.ip.18>
Date: Sat, 13 Aug 2022 12:21:50 GMT
Call-ID: 57D6B25C-1A3911ED-8BE4F197-D86D2370@10.17.14.6
Supported: 100rel,timer,resource-priority,replaces,sdp-anat
Min-SE:  1800
Cisco-Guid: 0457316224-0000065536-0000000006-3359931914
User-Agent: Cisco-SIPGateway/IOS-17.3.5
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
CSeq: 102 INVITE
Timestamp: 1660393310
Contact: <sip:021xxx21@10.17.14.6:5060>
Expires: 180
Allow-Events: telephone-event
Authorization: Digest username="username",realm="itsp.ip.18",uri="sip:08xxxx09@itsp.ip.18:5070",response="03ec4a6626a2e3ba030b00326bb5aa09",nonce="62f796b48a482df8022ecc25794a00b79f51673c",algorithm=md5
Max-Forwards: 69
Session-ID: d2d058482f8eb35cba382c46b9925ba0;remote=00000000000000000000000000000000
Content-Type: application/sdp
Content-Disposition: session;handling=required
Content-Length: 240

Authorization: Digest username="username",realm="itsp.ip.18",uri="sip:08xxxx09@itsp.ip.18:5070",response="03ec4a6626a2e3ba030b00326bb5aa09",nonce="62f796b48a482df8022ecc25794a00b79f51673c",algorithm=md5

This is probably the problem for outgoing calls

[ibasuki]

I attach my configuration. Just for your information, about username on authorization digest, I checked wireshark of phonerlite from my laptop, username is a username provided by ITSP (not phone number). I've tried to change credential configuration to these:

- credentials number 021xxx21 username 021xxx21 password 7 xxx realm itsp.ip.18

or

- credentials username 021xxx21 password 7 xxx realm itsp.ip.18

Both resulting sip-ua register status became "No".

[b.winter]

Then maybe you have already a problem registering the SIP trunk "correctly". I know, it's strange because it is still registered.
But could you use the following lines and provide the output of the registration process:
debug ccsip messages
debug ccsip non-call

credentials number 021xxx21 username 021xxx21 password 7 xxxx realm 103.x.x.18
authentication username abcdefgh password 7 xxxx realm 103.x.x.18

In your "credential" line, a username is missing.
And where did you get the username "abcdefgh" in the "authentication" line? Or did you just pick anything?

[ibasuki]

No username in credential line is actually my bad, I forgot to paste edited username which is abcdefgh. This username "abcdefgh" is what I got from ITSP. They provide us: number, auth.name, password, and public ip address as realm.

I will try you suggestion with my customer and update you later.

Thank you for such a fast response. Really appreciate it.

[b.winter]

With the info from the ITSP you just provided, then probably the config should look this:

credentials number 021xxx21 username abcdefgh password 7 xxxx realm 103.x.x.18
authentication username abcdefgh password 7 xxxx realm 103.x.x.18

But depending, how the ITSP wants to have the REGISTER message, you maybe need to get rid of the parameter "number 021xxx21" in the credentials command (credentials username abcdefgh password 7 xxxx realm 103.x.x.18)
But such info needs to come from the ITSP. They also need to give you the info, how the INVITE has to look like. Otherwise, it's just reading a glassball, only try and error.

[Scott Leport]

Suggest you speak to the ITSP to get all this ironed out. Otherwise it's all just guesswork. 

However, one thing that might pay dividends is to take a packet capture of your registration via phonerlite and registration via the CUBE then compare the two together. 

[ibasuki · Accepted solution]

Hi,

Sorry to keep this thread hanging. So what I have done to solve this is issue is to do a workaround. ITSP installed a SIP Gateway device on my customer's site, so Cisco VG only configured with dial-peer to this new SIP Gateway. For SIP registration etc, it is handled by SIP Gateway.