SIP OPTIONS 404: Not found-connecting 2 asterisk servers

[dylan7]

I am trying to connect two asterisk servers on a WLAN. However, after viewing the traffic via Wireshark, I am seeming constant 404 not found requests sent between the servers. I checked the ports via nmap and see that 5060 is open and filtered. Both servers have this configuration: Everything except the ip address for host is the same on both sides.

GNU nano 2.3.1 File: /etc/asterisk/sip.conf

Code: Select all

[general]
udpbindaddr=0.0.0.0
videosupport=no
allowguest=no
dtmfmode=rfc2833
context=default
disallow=all
allow=alaw
rtcachefriends=yes
limitonpeers=yes
callcounter=yes
canreinvite=no
srtpcapable=yes
call-limit=50
t38pt_udptl=no
qualify=yes
transfer=yes
allowtransfer=yes
encryption=yes

Code: Select all

[asterisksrtp]
disallow=all
allow=alaw
host=server's ip
deny=0.0.0.0/0.0.0.0
permit=127.0.0.1/255.255.255.255
username=user
fromuser=same user as above
defaultuser=same user as above
secret=password
type=friend
context=incoming-internal
canreinvite=no
qualify=yes
nat=no
insecure=invite,port
srtpcapable=yes
encryption=yes

[david55]

Logs? In particular the one that says extension not found in context.

[dylan7]

Well, it turns out there is more of a problem. I cannot seem to generate recent log files since I cannot get the SIP phones to register with either asterisk server; I cannot attempt a call. Here is my configuration for the SIP phone on each server:

Code: Select all

[201]
disallow=all
allow=alaw
host=dynamic
deny=0.0.0.0/0.0.0.0
permit=192.168.0.0/255.255.0.0
secret=password
type=friend
context=incoming-internal
canreinvite=no
qualify=yes
nat=no
srtpcapable=no
encryption=no

when I have the host=ip and not dynamic and the softphone is running on the same machine as the asterisk server it is connecting to, I get:

Code: Select all

NOTICE[2011]: chan_sip.c:25821 handle_request_register: Registration from ip '<sip:201@192.168.1.180;transport=UDP>' failed for '192.168.1.180:40047' - Peer is not supposed to register


_____________________________________________________________________________
when I do host=dynamic and the softphone is running on the same machine as the asterisk server it is connecting to, I get:

Code: Select all

NOTICE[2011]: chan_sip.c:27107 sip_poke_noanswer: Peer '201' is now UNREACHABLE!  Last qualify: 1

and wireshark shows that the server is sending SIP OPTIONS requests to my routers public ip.
_____________________________________________________________________________
when I do host = dynamic or host=ip, setting up the softphone on a different machine than the asterisk server it is connecting to I get, from wireshark:

Code: Select all

ICMP Host administratively prohibited

.
I did

Code: Select all

sudo service iptables stop

to see if my firewall was running, but Unit iptables.service is not even loaded. In addition the servers continue to send 404 not found's back and forth.
______________________________________________________________________________
Here are the logs from the most recent attempted calls before this issue:

Code: Select all

[Jun 14 17:53:06] NOTICE[27752] cdr.c: CDR simple logging enabled.
[Jun 14 17:53:06] NOTICE[27752] loader.c: 183 modules will be loaded.
[Jun 14 17:53:06] NOTICE[27752] res_smdi.c: No SMDI interfaces are available to listen on, not starting SMDI lis$
[Jun 14 17:53:06] NOTICE[27752] chan_sip.c: The 'username' field for sip peers has been deprecated in favor of t$
[Jun 14 17:53:06] WARNING[27752] chan_sip.c: !!! PLEASE NOTE: Setting 'nat' for a peer/user that differs from th$
[Jun 14 17:53:06] WARNING[27752] chan_sip.c: !!! the name of that peer/user discoverable by an attacker. Replies$
[Jun 14 17:53:06] WARNING[27752] chan_sip.c: !!! will be sent to a different port than replies for an existing p$
[Jun 14 17:53:06] WARNING[27752] chan_sip.c: !!! use the global 'nat' setting and do not set 'nat' per peer/user.
[Jun 14 17:53:06] WARNING[27752] chan_sip.c: !!! (config category='asterisksrtp' global force_rport='Yes' peer/u$
[Jun 14 17:53:06] WARNING[27752] chan_sip.c: !!! PLEASE NOTE: Setting 'nat' for a peer/user that differs from th$
[Jun 14 17:53:06] WARNING[27752] chan_sip.c: !!! the name of that peer/user discoverable by an attacker. Replies$
[Jun 14 17:53:06] WARNING[27752] chan_sip.c: !!! will be sent to a different port than replies for an existing p$
[Jun 14 17:53:06] WARNING[27752] chan_sip.c: !!! use the global 'nat' setting and do not set 'nat' per peer/user.
[Jun 14 17:53:06] WARNING[27752] chan_sip.c: !!! (config category='201' global force_rport='Yes' peer/user force$
[Jun 14 17:53:06] NOTICE[27752] chan_skinny.c: Configuring skinny from skinny.conf
[Jun 14 17:53:06] WARNING[27752] chan_skinny.c: Failed to bind to 0.0.0.0:2000: Address already in use
[Jun 14 17:53:06] NOTICE[27752] cel_custom.c: No mappings found in cel_custom.conf. Not logging CEL to custom CS$
[Jun 14 17:53:06] NOTICE[27752] pbx_ael.c: Starting AEL load process.
[Jun 14 17:53:06] NOTICE[27752] pbx_ael.c: AEL load process: parsed config file name '/etc/asterisk/extensions.a$
[Jun 14 17:53:06] NOTICE[27752] pbx_ael.c: AEL load process: checked config file name '/etc/asterisk/extensions.$
[Jun 14 17:53:06] NOTICE[27752] pbx_ael.c: AEL load process: compiled config file name '/etc/asterisk/extensions$
[Jun 14 17:53:06] NOTICE[27752] pbx_ael.c: AEL load process: merged config file name '/etc/asterisk/extensions.a$
[Jun 14 17:53:06] NOTICE[27752] pbx_ael.c: AEL load process: verified config file name '/etc/asterisk/extensions$
[Jun 14 17:53:06] ERROR[27752] pbx_dundi.c: Unable to bind to 0.0.0.0 port 4520: Address already in use


Thank you.

[david55]

I didn't spot the "OPTIONS". Getting 404 to OPTIONS is normal and is as good a proof that the other end is still there as is getting 200 OK. If you don't want options to be sent, use qualify=no.

PS I noticed at least one deprecated option in your configuration.

[dylan7]

Thank you. In addition, how would I go about about trying to fix the SIP phone connection issues I posted above? The one that seems especially an issue is the "ICMP Host administratively prohibited" response I get when I try to connect a phone to my server from another machince, as I posted above.

[david55]

That ICMP would only come from a firewall.

[dylan7]

I believe I have fixed the firewall issue, since the servers now talk. However, another issue arose. I tried fixing it before posting here, with no luck. The phone on server 1 (asterisksrtp is called 201) it has the same configuration as the device posted in the above, except host is dynamic. The server sees the host as my router's public ip. When the soft-phone on a different machine (but linked to server 1) tries to make a call to a soft-phone (with the same config as the other phone but call 202) on a different machine but linked to server 2, the following situation happens:


so 201 on asterisk server 1 calls 202 on asterisk server 2

server 1 connected to the calling phone writes:

Code: Select all

   -- Executing [455@incoming-internal:1] NoOp("SIP/201-00000010", "Call from "" <201> to 455") in new stack
    -- Executing [455@incoming-internal:2] Dial("SIP/201-00000010", "SIP/asterisksrtp/202") in new stack
  == Using SIP RTP CoS mark 5
    -- Called SIP/asterisksrtp/202
[Jun 21 12:45:13] WARNING[2099]: chan_sip.c:21111 handle_response_invite: Received response: "Forbidden" from '"201" <sip:asterisksrtp@192.168.1.180>;tag=as2f601b30'
  == Everyone is busy/congested at this time (1:0/0/1)
    -- Executing [455@incoming-internal:3] Hangup("SIP/201-00000010", "") in new stack
  == Spawn extension (incoming-internal, 455, 3) exited non-zero on 'SIP/201-00000010'
'


Server 2 who has the phone being called writes:

Code: Select all

chan_sip.c:23540: handle request invite: Failed to authenticate device "201" <sip:server1@server1ip>tag...

Thank you again