[asterisk-users] Asterisk refuses INVITE (401) and I don't know why

[Alex Vishnev]

Your registration should have also have the flow

PEER                 ASTERISK
REGISTER------->
<----------------------401
REGISTER(nonce) ->
<------------------------200OK

Then the server controls the life of the registration and 200 Expires Header gives you this timeout. If the invite is sent within that window, then Asterisk should not challenge anymore. If Invite is challenged and the peer responds with the correctly calculated NONCE, domain and other Auth params, then something is wrong with your Authentication. I suggest trapping the traffic with Ethereal or any other packet capture programs and examining that carefully from the start of the session (i.e. register) to the invite. I would also check where the 401 is coming from (i.e. IP address).

Hope that helps

Alex        
On Nov 22, 2011, at 11:23 AM, Jonas Kellens wrote:

> On 11/22/2011 04:37 PM, Bruce Ferrell wrote:
>> 
>> 
>> 
>> On 11/22/2011 07:29 AM, Jonas Kellens wrote:
>>> 
>>> On 11/22/2011 04:25 PM, Bruce Ferrell wrote:
>>>> 
>>>> 
>>>> Jonas,
>>>> 
>>>> May I suggest that you present us your sip.conf entry for this peer, properly redacted, of course.  That might help more.  What I do for "gateways" at known addresses is to put an entry like this into the sip.conf entry:
>>>> 
>>>> 
>>>> [peer]
>>>> type=peer
>>>> defaultip=192.168.40.123
>>>> insecure=invite,port
>>>> context=some_context
>>>> 
>>> 
>>> 
>>> This is the peer definition in sip.conf :
>>> 
>>> [SIPPEERusername]
>>> type=friend
>>> host=dynamic
>>> defaultuser=SIPPEERusername
>>> secret=guessthis
>>> context=from-PEERTRUNK
>>> nat=yes
>>> dtmfmode=rfc2833
>>> canreinvite=no
>>> disallow=all
>>> allow=alaw
>>> allow=gsm
>>> 
>>> 
>>> Hope you can help me out with this extra information.
>>> 
>>> 
>>> Kind regards,
>>> 
>>> Jonas.
>> From what I see in your entry, you are requiring registration from the peer.  The next thing i would check is to see if the registration has succeeded.  If it doesn't succeed, you will see the results you presented.  I see you have the peer set as a dynamic host, and if the IP address of the device does in fact change then registration is appropriate.
> 
> Registration of the SIP PEER is no problem. The PEER registers with a correct REGISTER statement and Asterisk sends a 200 OK.
> 
> So the PEER is registered and then wants to make a call (INVITE) but for some reason this INVITE is being refused with 401-Unauthorized.
> 
> The first 401-Unauthorized is normal, because the SIP PEER needs to send a second INVITE with a challenge (nonce). But after this INVITE with challenge, Asterisk still sends a 401 and that's strange !!
> 
> Jonas.
> 
> 
> --
> _____________________________________________________________________
> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
> New to Asterisk? Join us for a live introductory webinar every Thurs:
>               http://www.asterisk.org/hello
> 
> asterisk-users mailing list
> To UNSUBSCRIBE or update options visit:
>   http://lists.digium.com/mailman/listinfo/asterisk-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20111122/d40d5f31/attachment-0001.htm>