401 Unauthorized with Snom but not with Zoiper softphone

Home » Asterisk Users » 401 Unauthorized with Snom but not with Zoiper softphone
Asterisk Users 11 Comments

Hello,

I’m having difficulty with registering a SIP account in a Snom 320
IP-phone. This is what sip debug tells me :

[Oct 7 13:28:42] VERBOSE[20314] chan_sip.c: [Oct 7 13:28:42]
<--- SIP read from UDP:public_ip:58697 --->
REGISTER sip:sip.domain.tld SIP/2.0
Via: SIP/2.0/UDP 192.168.114.200:2048;branch=z9hG4bK-vj1xvbdnp4dw;rport
From: ;tag=sd2b3o74zc
To:
Call-ID: 3c28a76e73cf-gp9nioi8zdci
CSeq: 12 REGISTER
Max-Forwards: 70
Contact:
;reg-id=1;q=1.0;+sip.instance=”“;audio;mobility=”fix
ed”;duplex=”full”;description=”snom320″;actor=”principal”;events=”dialog”;methods=”INVITE,ACK,CANCEL,BYE,REFER,OPTIONS,NOTIFY,SUBSCRIBE,PRACK,MESSAGE,INFO”
User-Agent: snom320/8.4.18
Allow-Events: dialog
X-Real-IP: 192.168.114.200
Supported: path, gruu
Expires: 3600
Content-Length: 0

<------------->
[Oct 7 13:28:42] VERBOSE[20314] chan_sip.c: [Oct 7 13:28:42] — (14
headers 0 lines) —
[Oct 7 13:28:42] VERBOSE[20314] chan_sip.c: [Oct 7 13:28:42] Sending
to 192.168.114.200 : 2048 (no NAT)
[Oct 7 13:28:42] VERBOSE[20314] chan_sip.c: [Oct 7 13:28:42]
<--- Transmitting (NAT) to public_ip:58697 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP
192.168.114.200:2048;branch=z9hG4bK-vj1xvbdnp4dw;received=public_ip;rport=58697
From: ;tag=sd2b3o74zc
To: ;tag=as6108a7e2
Call-ID: 3c28a76e73cf-gp9nioi8zdci
CSeq: 12 REGISTER
Server: Asterisk PBX 1.6.2.10
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm=”domain.tld”, nonce=”398aee1e”
Content-Length: 0

I would expect the Snom to try a second register, this time with some
type of nonce. But there is just 1 REGISTER and 1 Unauthorized and
that’s it…

Other Snom phones with SIP-accounts go very well, but at this location
the registration fails.

Another remark : when using a Zoiper softphone, the registration goes
very well :

REGISTER sip:sip.domain.tld;transport=UDP SIP/2.0
Via: SIP/2.0/UDP
192.168.114.20:5060;branch=z9hG4bK-d8754z-fab4a5effbf90a05-1—d8754z-
Max-Forwards: 70
Contact:

To:
From: ;tag=db1a5018
Call-ID: NzBlZDMyN2U0YTEzZDk4Y2M2N2NmNzMxYTk4OWUxYTY.
CSeq: 1 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO,
SUBSCRIBE
User-Agent: Zoiper rev.7797
Allow-Events: presence, kpml
Content-Length: 0

<------------->
[Oct 7 13:46:52] VERBOSE[20314] chan_sip.c: [Oct 7 13:46:52] — (13
headers 0 lines) —
[Oct 7 13:46:52] VERBOSE[20314] chan_sip.c: [Oct 7 13:46:52] Sending
to 192.168.114.20 : 5060 (no NAT)
[Oct 7 13:46:52] VERBOSE[20314] chan_sip.c: [Oct 7 13:46:52]
<--- Transmitting (NAT) to public_ip:51363 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP
192.168.114.20:5060;branch=z9hG4bK-d8754z-fab4a5effbf90a05-1—d8754z-;received=public_ip
From: ;tag=db1a5018
To: ;tag=as2fcfde3c
Call-ID: NzBlZDMyN2U0YTEzZDk4Y2M2N2NmNzMxYTk4OWUxYTY.
CSeq: 1 REGISTER
Server: Asterisk PBX 1.6.2.10
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm=”domain.tld”, nonce=”7833b268″
Content-Length: 0

REGISTER sip:sip.domain.tld;transport=UDP SIP/2.0
Via: SIP/2.0/UDP
192.168.114.20:5060;branch=z9hG4bK-d8754z-fdd59e394f9c23b9-1—d8754z-
Max-Forwards: 70
Contact:

To:
From: ;tag=db1a5018
Call-ID: NzBlZDMyN2U0YTEzZDk4Y2M2N2NmNzMxYTk4OWUxYTY.
CSeq: 2 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO,
SUBSCRIBE
User-Agent: Zoiper rev.7797
Authorization: Digest
username=”test3″,realm=”domain.tld”,nonce=”7833b268″,uri=”sip:sip.domain.tld;transport=UDP”,response=”198f6262248fb11fe6cb55408a1cb8ce”,algorithm=MD5
Allow-Events: presence, kpml
Content-Length: 0

SIP/2.0 200 OK
Via: SIP/2.0/UDP
192.168.114.20:5060;branch=z9hG4bK-d8754z-fdd59e394f9c23b9-1—d8754z-;received=public_ip
From: ;tag=db1a5018
To: ;tag=as2fcfde3c
Call-ID: NzBlZDMyN2U0YTEzZDk4Y2M2N2NmNzMxYTk4OWUxYTY.
CSeq: 2 REGISTER
Server: Asterisk PBX 1.6.2.10
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
Expires: 60
Contact:
;expires=60
Date: Thu, 07 Oct 2010 11:46:52 GMT
Content-Length: 0

It’s the same account, the same password, but other agent.

Can anyone help me with this please ?! I see no difference but there
must be !!

Kind regards,
Jonas.

11 thoughts on - 401 Unauthorized with Snom but not with Zoiper softphone

  • The difference is the SNOM is using rport and Zoiper isn’t. Is nat for
    this client set to ‘yes’ or something else?

  • Wanted to say more before sending:
    this might indicate a broken nat sip helper so the responses never get
    to the snom. You should check the inside traffic to the snom.

  • Hello !

    Thank you very much for your quick answer !!

    nat=yes is set as a global parameter and also in the realtime MySQL
    sip_buddies database I have for every peer nat=yes.

    I then find it very strange that when placing these Snom phones in my
    environment (for configuration) work very well, and then when I hook
    them up at the site there is trouble with nat. I’m also behind nat here…

    I do not find an rport-parameter in the snom’s webinterface…

    Jonas.

  • And I wanted to add that it is possible to make outbound calls, but
    because the phone is not registered receiving calls is not possible…

    Jonas.

  • This is a REGISTER from the sip trace of the Snom 320 IP-phone :

    REGISTER sip:sip.domain.tld SIP/2.0
    Via: SIP/2.0/UDP 192.168.114.200:2049;branch=z9hG4bK-od9b7c0ekamp;rport
    Call-ID: 3c26701f88d8-6i37fwkca22u
    CSeq: 46 REGISTER
    Max-Forwards: 70
    Contact:
    ;reg-id=1;q=1.0;+sip.instance=”“;audio;mobility=”fixed”;duplex=”full”;description=”snom320″;actor=”principal”;events=”dialog”;methods=”INVITE,ACK,CANCEL,BYE,REFER,OPTIONS,NOTIFY,SUBSCRIBE,PRACK,MESSAGE,INFO”

    User-Agent: snom320/8.4.18
    Allow-Events: dialog
    X-Real-IP: 192.168.114.200
    Supported: path, gruu
    Expires: 3600
    Content-Length: 0

    and indeed there is no ACK or 200 OK to this REGISTER…

    Kind regards,

    Jonas.

  • Even when I mark the option in the Zoiper softphone to use rport, the
    registration still goes fine… With or without rport… Registration
    succeeds. But meanwhile, the Snom is still not registering…

    Jonas.

  • Hi!

    Do a SIP trace on your SNOM phone, and you will most probably see that
    the 401 reply of Asterisk does not arrive on the phone. Then check your
    STUN/ICE settings on the phone in combination with the nat= settings in
    sip.conf on Asterisk.

    BTW: Are you happy with firmware 8.4.18? I still stick to 7.3.30 for the
    3xx models.

    Philipp

  • Hello,

    I don’t really need the version 8 firmware, but I install it because it
    is the most recent…

    The SIP trace of the SNOM indeed does not show any answer to the
    REGISTER being sent (the SIP trace consists of only REGISTER-statements…)

    I have no STUN/ICE settings filled in.

    Is it possible I need STUN/ICE for the Snom 320 but not for the Zoiper
    softphone ???

    The strange thing in this story is : Snom 320 receives no 200OK, but
    registration with the Zoiper softphone on a computer on the same LAN
    (connected to the PC port of the SNOM) works fine !!

    Jonas.

  • I have never seen this problem before with Snom M3 and different routers
    (Linux/Cisco or stupid SpeedTouches) without any
    connection NAT helpers for SIP enabled. I’d say you should try the
    difference values for nat to see if one works with the NAT gateway or
    use STUN like suggested elsewhere.

  • What STUN-server can I use then ?! Asterisk is no STUN-server I guess
    and is there then something like a public STUN-server ?!

    I have never experienced problems with NAT…

    The different options for nat are :
    nat=yes|no|never|route
    Correct ?!

    Some extra information : when using TELNET to my public Asterisk server
    on port 5060, then there is no response. This means that the answer is
    blocked somewhere, right ?! Maybe on ISP-level ?! Is that plausible ?!

    Jonas.

  • Hello,

    there is a really great difference in the Via-header of the
    REGISTER-message between the Zoiper and the Snom.
    Also the Zoiper has a Contact-header, and the Snom REGISTER has not…

    Snom :

    REGISTER sip:sip.domain.tld SIP/2.0
    _*Via: SIP/2.0/UDP 192.168.114.200:2049;branch=z9hG4bK-p4ayhthezdr6;rport*_
    Call-ID: 3c26701f88d8-6i37fwkca22u
    CSeq: 9 REGISTER
    Max-Forwards: 70
    Contact:
    ;reg-id=1;q=1.0;+sip.instance=”“;audio;mobility=”fixed”;duplex=”full”;description=”snom320″;actor=”principal”;events=”dialog”;methods=”INVITE,ACK,CANCEL,BYE,REFER,OPTIONS,NOTIFY,SUBSCRIBE,PRACK,MESSAGE,INFO”
    User-Agent: snom320/8.4.18
    Allow-Events: dialog
    X-Real-IP: 192.168.114.200
    Supported: path, gruu
    Expires: 3600
    Content-Length: 0

    SIP/2.0 401 Unauthorized
    _*Via: SIP/2.0/UDP
    192.168.114.200:2049;branch=z9hG4bK-p4ayhthezdr6;received=public_ip;rport=64646*_
    Call-ID: 3c26701f88d8-6i37fwkca22u
    CSeq: 9 REGISTER
    Server: Asterisk PBX 1.6.2.10
    Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
    Supported: replaces, timer
    WWW-Authenticate: Digest algorithm=MD5, realm=”domain.tld”, nonce=”120e4f10″
    Content-Length: 0

    Zoiper :

    REGISTER sip:sip.domain.tld;transport=UDP SIP/2.0
    _*Via: SIP/2.0/UDP
    public_ip:59096;branch=z9hG4bK-d8754z-83ebdbc32d0fb2e0-1—d8754z-;rport*_
    Max-Forwards: 70
    _*Contact:
    *_
    Call-ID: NjY2MmY3NjRkNDRlOWJhOGQ2NzgyNzg4Y2M5ZGFlZjE.
    CSeq: 1 REGISTER
    Expires: 3600
    Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO,
    SUBSCRIBE
    User-Agent: Zoiper rev.7797
    Allow-Events: presence, kpml
    Content-Length: 0

    SIP/2.0 401 Unauthorized
    _*Via: SIP/2.0/UDP
    public_ip:59096;branch=z9hG4bK-d8754z-83ebdbc32d0fb2e0-1—d8754z-;received=public_ip;rport=59095*_
    Call-ID: NjY2MmY3NjRkNDRlOWJhOGQ2NzgyNzg4Y2M5ZGFlZjE.
    CSeq: 1 REGISTER
    Server: Asterisk PBX 1.6.2.10
    Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
    Supported: replaces, timer
    WWW-Authenticate: Digest algorithm=MD5, realm=”domain.tld”, nonce=”08277195″
    Content-Length: 0

    Is that why Asterisk is not able to send the 401 or the 200 ??

    Anyone knows if there is a special setting in the Snom 320 or Asterisk
    itself to overcome this issue ?!

    Jonas.