Failed To Authenticate Device “Ext 110”

Home » Asterisk Users » Failed To Authenticate Device “Ext 110”
Asterisk Users 3 Comments

I’m having a strange problem recently with a Yealink SIP-T28P phone connected to Asterisk 11.4.0 via openvpn. It was working fine for months, and now when I dial anything from the phone, it shows “Forbidden”, and the Asterisk console shows:

[May 21 10:47:49] NOTICE[28518][C-00000004]: chan_sip.c:25189
handle_request_invite: Failed to authenticate device “Ext 110” < sip:110@192.168.6.2>;tag30259112

Asterisk 192.168.6.2
OpenVPN on router 10.8.0.1
Remote Yealink phone 10.8.0.6

The remote phone shows as being registered:
PBX*CLI> sip show peers Name/username Host Dyn Forcerport ACL Port Status Description
110/110 10.8.0.6 D A 5062 OK (111 ms) Yealink OpenVPN

Also, if there is voicemail in the mailbox for 110, the phone’s message light is lit and it beeps periodically.

toshi*CLI> sip show peer 110

* Name : 110
Description : Yealink OpenVPN
Secret :
MD5Secret :
Remote Secret:
Context : remote-phones
Record On feature : automon
Record Off feature : automon
Subscr.Cont. :
Language :
Tonezone :
AMA flags : Unknown
Transfer mode: open
CallingPres : Presentation Allowed, Not Screened
Callgroup : 1
Pickupgroup : 1
Named Callgr :
Nam. Pickupgr:
MOH Suggest :
Mailbox : 110
VM Extension : asterisk
LastMsgsSent : 1/0
Call limit : 4
Max forwards : 0
Dynamic : Yes
Callerid : “Ext 110” <110>
MaxCallBR : 384 kbps
Expire : 608
Insecure : no
Force rport : No
Symmetric RTP: No
ACL : Yes
DirectMedACL : No
T.38 support : No
T.38 EC mode : Unknown
T.38 MaxDtgrm: -1
DirectMedia : No
PromiscRedir : No
User=Phone : No
Video Support: Yes
Text Support : No
Ign SDP ver : No
Trust RPID : Yes
Send RPID : Yes
Subscriptions: Yes
Overlap dial : No
DTMFmode : rfc2833
Timer T1 : 500
Timer B : 32000
ToHost :
Addr->IP : 10.8.0.6:5062
Defaddr->IP : 10.8.0.6:5060
Prim.Transp. : UDP
Allowed.Trsp : UDP
Def. Username: 110
SIP Options : (none)
Codecs : (ulaw)
Codec Order : (ulaw:20)
Auto-Framing : No
Status : OK (237 ms)
Useragent : Yealink SIP-T28P 2.61.23.3 00:15:65:xx.xx.xx
Reg. Contact : sip:110@10.8.0.6:5062
Qualify Freq : 60000 ms
Keepalive : 0 ms
Sess-Timers : Accept
Sess-Refresh : uas
Sess-Expires : 1800 secs
Min-Sess : 90 secs
RTP Engine : asterisk
Parkinglot :
Use Reason : No
Encryption : No

sip.conf:

[110]
context=remote-phones type=peer host=dynamic qualify00
canreinvite=no dtmfmode=rfc2833
progressinband=no callgroup=1
pickupgroup=1 ; We can do call pickup for call group 1
call-limit=4
busy-level=1
qualify=yes deny=0.0.0.0/0.0.0.0
permit=0.0.0.0/0.0.0.0
nat=no qualify

3 thoughts on - Failed To Authenticate Device “Ext 110”

  • asterisk users wrote:

    That is quite strange. Please provide SIP traces of the dialogs between Asterisk and the phone in the following two scenarios:

    1) Phone registering to Asterisk (presumably successful)
    2) Phone dialing to Asterisk (presumably unsuccessful)

    Regards,

    Matthew Roth InterMedia Marketing Solutions Software Engineer and Systems Developer

  • Registration trace
    (note that extension 88 is the voicemail extension, which the phone registers to also for MWI)
    –> http://pastebin.com/c3H700wa

    Call trace:
    |Time | 10.8.0.6 |
    | | | 192.168.6.2 |
    |268.693661| INVITE SDP (g711U g729 g722
    telephone-eventRTP…e-101) |SIP From: “Ext 110” < sip:110@192.168.6.2 To: (5060) |
    |268.694449| 401 Unauthorized |SIP Status
    | |(1024) < ------------------ (5060) | |268.914195| ACK | |SIP Request | |(1024) ------------------> (5060) |
    |268.945115| INVITE SDP (g711U g729 g722
    telephone-eventRTP…e-101) |SIP From: “Ext 110” < sip:110@192.168.6.2 To: (5060) |
    |268.945717| 403 Forbidden |SIP Status
    | |(1024) < ------------------ (5060) | |269.041417| ACK | |SIP Request | |(1024) ------------------> (5060) |

    I’m also confused by the reference in “sip show peers” to port 5062, as I
    can’t see that anywhere in the configuration of either the phone or in sip.conf. All the other phones show port 5060 in the “sip show peers”
    output.

  • asterisk users wrote:

    There are no REGISTER requests in that trace. All I see are SUBSCRIBE, NOTIFY, OPTIONS, and INVITE dialogs.

    This is just a failed INVITE probably due to the username and/or password being incorrect. It’s also possible that bad ACLs (see the ‘permit/deny/acl’ settings in sip.conf) could be to blame. It’s hard to say without seeing a full SIP
    trace and Asterisk CLI output.

    Start there and work through the obvious issues one by one. First, figure out why the phone is showing up on port 5062 and correct it if necessary. Then, double-check the username and password. Keep going down that path until it leads to a resolution or report back to the list if you run into a roadblock.

    Regards,

    Matthew Roth InterMedia Marketing Solutions Software Engineer and Systems Developer