[asterisk-users] Odd Issue With Polycom Phones

[Jay Vocaire]

I appears as though I was a little hasty in saying that it wasn't generating two calls.  It actually was, but I was doing a poor job of searching the logs.

I setup a new-to-me IP 6000 with older firmware on it (3.0.2.0927), and I am not getting the issue.  I am going to start upgrading the firmware on that phone to see when it breaks, then it looks like I will call Polycom to try to get them to fix the issue.

Thanks for the help from everyone on this.

-Jay

From: asterisk-users-bounces at lists.digium.com [mailto:asterisk-users-bounces at lists.digium.com] On Behalf Of Sean Brady
Sent: Wednesday, April 21, 2010 5:49 PM
To: asterisk-users at lists.digium.com
Subject: Re: [asterisk-users] Odd Issue With Polycom Phones



On 04/21/2010 03:08 PM, Warren Selby wrote:
On Wed, Apr 21, 2010 at 3:46 PM, Jay Vocaire <jvocaire at innproc.com<mailto:jvocaire at innproc.com>> wrote:
Thanks for the tip, I did just that, and now I am more confused.

It does appear as though there is just one call ID (if my assumption that the "tag=" determines the call.

The first time it sends like this:
<snip>
Asterisk responds with a SIP/2.0 401 Unauthorized, the phone then comes back with this:
<snip>
The difference is that the CSeq is now 2 and the following line is added:

Authorization: Digest username="3271", realm="asterisk", nonce="393a1b1f", uri="sip:3261 at y.y.y.y;user=phone"<sip:3261 at y.y.y.y;user=phone>, response="c8223e261c252c12172982ee661ad307", algorithm=MD5


So maybe I do have an issue in Asterisk, okay probably.  Any clues as to how to debug?  Let me know if need to post more information.

This is expected behavior for SIP communications.  I see this all the time when an end point is registering with Asterisk.  I think in those cases, however, it's a REGISTER request, not an INVITE.  How is your sip.conf configured for these end points?

Do you have any phones other than the ones experiencing this problem that you can test with?


Yes this is expected behavior on a REGISTER.  I didn't think that it was correct on an INVITE, however on reading RFC 3261, I believe that Asterisk is correctly responding to the request, needing credentials from the UA (Polycom).


My Ekiga softphone is doing the exact same thing, however it's not creating the same "2 call" issue that your Polycoms are having.  The Ekiga call setup is not including credentials on the first INVITE, receives a 401 not authorized, and sends another INVITE with credentials, and receives a "100 TRYING" from Asterisk.

This is most likely an issue with the firmware on the Polycom.  Bottom line is that another UA is doing the same thing, the call is setup properly, and it appears to work.

I respectfully request that someone smarter than me take a look at this and verify my conclusions, or correct me accordingly.

Thanks.

According to RFC 3261 (note that the RFC uses the word "request" instead of "register" or "registration request"):

"... If a 401 (Unauthorized) or 407 (Proxy Authentication Required)

response is received, the UAC SHOULD follow the authorization

procedures of Section 22.2 and Section 22.3 to retry the request with

credentials. ..."

Read more: http://www.faqs.org/rfcs/rfc3261.html#ixzz0llyASXyI

" ...

22.2 User-to-User Authentication



   When a UAS receives a request from a UAC, the UAS MAY authenticate

   the originator before the request is processed.  If no credentials

   (in the Authorization header field) are provided in the request, the

   UAS can challenge the originator to provide credentials by rejecting

   the request with a 401 (Unauthorized) status code.



   The WWW-Authenticate response-header field MUST be included in 401

   (Unauthorized) response messages.  The field value consists of at

   least one challenge that indicates the authentication scheme(s) and

   parameters applicable to the realm.



   An example of the WWW-Authenticate header field in a 401 challenge

   is:



      WWW-Authenticate: Digest

              realm="biloxi.com",

              qop="auth,auth-int",

              nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",

              opaque="5ccc069c403ebaf9f0171e9517f40e41"



   When the originating UAC receives the 401 (Unauthorized), it SHOULD,

   if it is able, re-originate the request with the proper credentials.

   The UAC may require input from the originating user before

   proceeding.  Once authentication credentials have been supplied

   (either directly by the user, or discovered in an internal keyring),

   UAs SHOULD cache the credentials for a given value of the To header

   field and "realm" and attempt to re-use these values on the next

   request for that destination.  UAs MAY cache credentials in any way

   they would like.



   If no credentials for a realm can be located, UACs MAY attempt to

   retry the request with a username of "anonymous" and no password (a

   password of "").



   Once credentials have been located, any UA that wishes to

   authenticate itself with a UAS or registrar -- usually, but not

   necessarily, after receiving a 401 (Unauthorized) response -- MAY do

   so by including an Authorization header field with the request.  The

   Authorization field value consists of credentials containing the

   authentication information of the UA for the realm of the resource

   being requested as well as parameters required in support of

   authentication and replay protection.



..."
Read more: http://www.faqs.org/rfcs/rfc3261.html#ixzz0llyY2M2W

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.digium.com/pipermail/asterisk-users/attachments/20100422/927590c8/attachment.htm