SOLVED CISCO 7965 Fails to Register with PIAF-Green

[Bill Coghill]

HI,
So I had a system running at home with some Cisco 7965 units and a Raspberry Pi running IncrediblePBX 3.11.

I created the XML files and added t*f*t*p and all was good with the world.

I then decided to migrate to a 'proper' PIAF dedicated machine. I have an old PC I put PIAF-Green on and added my extensions etc as before. I copied over the XML files for the t*f*t*p stuff and the phones registered fine.

Time came to do some updates on login and it seems one of the updated has prevented the CISCOs from Registering. Debugging the SIP requests I see that the phones are getting a 401 error when attemping to register :

<--- SIP read from UDP:192.168.10.163:49155 --->
REGISTER sip:192.168.10.132 SIP/2.0
Via: SIP/2.0/UDP 192.168.10.163:5060;branch=z9hG4bKaf1789b6
From: <sip:[email protected]>;tag=ec44761eba2d0005a7e5ecaf-d7b81f9c
To: <sip:[email protected]>
Call-ID: [email protected]
Max-Forwards: 70
Date: Wed, 01 Jul 2009 03:32:55 GMT
CSeq: 104 REGISTER
User-Agent: Cisco-CP7965G/8.5.2
Contact: <sip:[email protected]:5060;transport=udp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-ec44761eba2d>";+u.sip!model.ccm.cisco.com="436"
Supported: (null),X-cisco-xsi-7.0.1
Content-Length: 0
Reason: SIP;cause=200;text="cisco-alarm:20 Name=SEPEC44761EBA2D Load=SIP45.8-5-2SR1S Last=phone-keypad"
Expires: 3600
 
<------------->
--- (14 headers 0 lines) ---
Sending to 192.168.10.163:49155 (NAT)
 
<--- Transmitting (NAT) to 192.168.10.163:49155 --->
[B]SIP/2.0 401 Unauthorized[/B]
Via: SIP/2.0/UDP 192.168.10.163:5060;branch=z9hG4bKaf1789b6;received=192.168.10.163;rport=49155
From: <sip:[email protected]>;tag=ec44761eba2d0005a7e5ecaf-d7b81f9c
To: <sip:[email protected]>;tag=as4566ef66
Call-ID: [email protected]
CSeq: 104 REGISTER
Server: FPBX-2.11.0(11.5.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="11efea99"
Content-Length: 0

I have tried making sure NAT is set to NONE which it was, but as I said it only seemed to occur when one of the following updates went in:

Retrieving... lastupdate11
Updates available as of Wed Nov 27 10:56:35 EST 2013: 10
Checking for update111. INSTALLED: Test update
Checking for update112. INSTALLED: IAXmodem CPU usage patch
Checking for update113. INSTALLED: Asterisk Security Vulnerability Resolved
Checking for update114. INSTALLED: Index apps secured in web root
Checking for update115. INSTALLED: GVoice XMPP Bug Fix Patch downloaded.
Checking for update116. INSTALLED: TravMan3 ipchecker patch
Checking for update117. INSTALLED: Weather by ZIP Code patch
Checking for update118. INSTALLED: Weather by Airport Code patch
Checking for update119. INSTALLED: PIAF access patch for FreePBX
Checking for update1110. INSTALLED: SIPgate removed from IPtables WhiteList
Updates and notifications completed.

I have disabled IP Tables in case it was causing an issue, but I cannot for the life of me workout why this is happening.

My Grandstream GXP2200 registers fine, so it is something about the way the 7965 and the PABX are talking.

Help ?

 

[rossiv]

You're not the first one to mention an issue with Cisco endpoints on PIAF Green. There's another thread that was opened a few days ago with a similar issue. It's around here somewhere.

 

[Hyksos]

It's also all over the internet when reading stuff about cisco phones too but it go way back in the past at different times and different version.

Some things catch my eye but first the 401 is normal... in the sense that it's part of the process.
Register, 401, Register with auth, then if you get another 401 after the auth, now it's not normal.

The register you're posting is the first one without auth, so the 401 is the normal answer.

Maybe the rest of the exchange would be that the phone.... never acknowledge the reception of the 401.
Which brings us to what is weird:
<--- SIP read from UDP:192.168.10.163:49155 --->
REGISTER sip:192.168.10.132 SIP/2.0
Via: SIP/2.0/UDP 192.168.10.163:5060;branch=z9hG4bKaf1789b6
Contact: <sip:[email protected]:5060;transport=udp>
Supported: (null),X-cisco-xsi-7.0.1

phone's source port in the packet header is 49155
The Via says 5060.
The Contact says 5060.
I remember reading hundred of posts about cisco phones and (null),X-cisco-xsi-7.0.1, the null there is often mentionned.
(Sadly I know nothing more about the null story, something about buggy cisco firmware and some problem it can cause for certain asterisk, maybe that's not the issue here.)

The phone is not listening on two ports... so something is up there too.
I think the cisco phone can send packets from a port but not actually want the answer there.
But you didn't post your phone config files so nobody can look at them.
The log is also incomplete, we can't see what happens after this.

Whatever you do, don't modify tons of stuff in an additive manner. Whatever you do, do it one thing at a time and make sure you can come back to any past state and that you can try all combinations.

I don't own cisco phones, so if I sound unhelpful it's because I am.

 

[Bill Coghill]

Just dug further into the Supported: (null),X-cisco-xsi-7.0.1 tag and it seems that this causes grief due to it being non-compliant. I wish I still had the Pi setup as I'd be interested to see if it gets the same thing but either ignores it or responds anyway.

At the moment I have been editing one thing at a time to try to get this unit back registered.

Full Registration logs from CLI.

Connected to Asterisk 11.5.0 currently running on pbx (pid = 1727)
<--- SIP read from UDP:192.168.10.163:49155 --->
REGISTER sip:192.168.10.132 SIP/2.0
Via: SIP/2.0/UDP 192.168.10.163:5060;branch=z9hG4bKce9a1b83
From: <sip:[email protected]>;tag=ec44761eba2d003498b90abb-3d75b0e3
To: <sip:[email protected]>
Call-ID: [email protected]
Max-Forwards: 70
Date: Wed, 01 Jul 2009 03:57:57 GMT
CSeq: 151 REGISTER
User-Agent: Cisco-CP7965G/8.5.2
Contact: <sip:[email protected]:5060;transport=udp>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-ec44761eba2d>";+u.sip!model.ccm.cisco.com="436"
Supported: (null),X-cisco-xsi-7.0.1
Content-Length: 0
Reason: SIP;cause=200;text="cisco-alarm:25 Name=SEPEC44761EBA2D Load=SIP45.8-5-2SR1S Last=initialized"
Expires: 180
 
<------------->
--- (14 headers 0 lines) ---
Sending to 192.168.10.163:49155 (NAT)
 
<--- Transmitting (NAT) to 192.168.10.163:49155 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.10.163:5060;branch=z9hG4bKce9a1b83;received=192.168.10.163;rport=49155
From: <sip:[email protected]>;tag=ec44761eba2d003498b90abb-3d75b0e3
To: <sip:[email protected]>;tag=as3c577acf
Call-ID: [email protected]
CSeq: 151 REGISTER
Server: FPBX-2.11.0(11.5.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="09128ae3"
Content-Length: 0
 
 
<------------>
Scheduling destruction of SIP dialog '[email protected]' in 32000 ms (Method: REGISTER)
pbx*CLI>

And now for the SEPmacaddress.cnf.xml file :

<device>
<fullConfig>true</fullConfig>
<deviceProtocol>SIP</deviceProtocol>
<sshUserId>admin</sshUserId>
<sshPassword>password</sshPassword>
<devicePool>
<name>Dallas 5.0 Beta</name>
<dateTimeSetting uuid="{9ec4850a-7748-11d3-bdf0-00108302ead1}">
<name>CMLocal</name>
<dateTemplate>D/M/Y</dateTemplate>
<timeZone>E. Australia Standard Time</timeZone>
</dateTimeSetting>
<callManagerGroup>
<name>5.0 Beta</name>
<tftpDefault>true</tftpDefault>
<members>
<member priority="0">
<callManager>
<name>192.168.10.132</name>
<description>CallManager 5.0 Beta Pub - 5.0.1.032</description>
<ports>
<ethernetPhonePort>2000</ethernetPhonePort>
<sipPort>5060</sipPort>
<securedSipPort>5061</securedSipPort>
</ports>
<processNodeName>192.168.10.132</processNodeName>
</callManager>
</member>
</members>
</callManagerGroup>
</devicePool>
 
<sipProfile>
<sipProxies>
<backupProxy></backupProxy>
<backupProxyPort></backupProxyPort>
<emergencyProxy></emergencyProxy>
<emergencyProxyPort></emergencyProxyPort>
<outboundProxy></outboundProxy>
<outboundProxyPort></outboundProxyPort>
<registerWithProxy>true</registerWithProxy>
</sipProxies>
 
<sipCallFeatures>
    <cnfJoinEnabled>true</cnfJoinEnabled>
    <callForwardURI>x-cisco-serviceuri-cfwdall</callForwardURI>
    <callPickupURI>x-cisco-serviceuri-pickup</callPickupURI>
    <callPickupListURI>x-cisco-serviceuri-opickup</callPickupListURI>
    <callPickupGroupURI>x-cisco-serviceuri-gpickup</callPickupGroupURI>
    <meetMeServiceURI>x-cisco-serviceuri-meetme</meetMeServiceURI>
    <abbreviatedDialURI>x-cisco-serviceuri-abbrdial</abbreviatedDialURI>
    <rfc2543Hold>false</rfc2543Hold>
    <callHoldRingback>2</callHoldRingback>
    <localCfwdEnable>true</localCfwdEnable>
    <semiAttendedTransfer>true</semiAttendedTransfer>
    <anonymousCallBlock>2</anonymousCallBlock>
    <callerIdBlocking>2</callerIdBlocking>
    <dndControl>0</dndControl>
    <remoteCcEnable>true</remoteCcEnable>
</sipCallFeatures>
 
<sipStack>
    <sipInviteRetx>6</sipInviteRetx>
    <sipRetx>10</sipRetx>
    <timerInviteExpires>180</timerInviteExpires>
    <timerRegisterExpires>180</timerRegisterExpires>
    <timerRegisterDelta>5</timerRegisterDelta>
    <timerKeepAliveExpires>120</timerKeepAliveExpires>
    <timerSubscribeExpires>120</timerSubscribeExpires>
    <timerSubscribeDelta>5</timerSubscribeDelta>
    <timerT1>500</timerT1>
    <timerT2>4000</timerT2>
    <maxRedirects>70</maxRedirects>
    <remotePartyID>false</remotePartyID>
    <userInfo>None</userInfo>
</sipStack>
 
<autoAnswerTimer>1</autoAnswerTimer>
<autoAnswerAltBehavior>false</autoAnswerAltBehavior>
<autoAnswerOverride>true</autoAnswerOverride>
<transferOnhookEnabled>false</transferOnhookEnabled>
<enableVad>false</enableVad>
<preferredCodec>g711</preferredCodec>
<dtmfAvtPayload>101</dtmfAvtPayload>
<dtmfDbLevel>3</dtmfDbLevel>
<dtmfOutofBand>avt</dtmfOutofBand>
<alwaysUsePrimeLine>false</alwaysUsePrimeLine>
<alwaysUsePrimeLineVoiceMail>false</alwaysUsePrimeLineVoiceMail>
<kpml>3</kpml>
<phoneLabel>BrdRm x203</phoneLabel>
<stutterMsgWaiting>2</stutterMsgWaiting>
<callStats>false</callStats>
<offhookToFirstDigitTimer>15000</offhookToFirstDigitTimer>
<silentPeriodBetweenCallWaitingBursts>10</silentPeriodBetweenCallWaitingBursts>
<disableLocalSpeedDialConfig>true</disableLocalSpeedDialConfig>
<startMediaPort>16384</startMediaPort>
<stopMediaPort>32766</stopMediaPort>
 
<sipLines>
<line button="1">
<featureID>9</featureID>
<featureLabel>Internal </featureLabel>
<proxy>192.168.10.132</proxy>
<port>5060</port>
<name>203</name>
<displayName>BrdRm x203</displayName>
<autoAnswer>
<autoAnswerEnabled>2</autoAnswerEnabled>
</autoAnswer>
<callWaiting>3</callWaiting>
<authName>203</authName>
<authPassword>PASSWORD</authPassword>
<sharedLine>false</sharedLine>
<messageWaitingLampPolicy>3</messageWaitingLampPolicy>
<messagesNumber>*97</messagesNumber>
<ringSettingIdle>4</ringSettingIdle>
<ringSettingActive>5</ringSettingActive>
<contact>203</contact>
<forwardCallInfoDisplay>
<callerName>true</callerName>
<callerNumber>false</callerNumber>
<redirectedNumber>false</redirectedNumber>
<dialedNumber>true</dialedNumber>
</forwardCallInfoDisplay>
</line>
 
<line button="2">
<featureID></featureID>
<featureLabel></featureLabel>
<speedDialNumber></speedDialNumber>
</line>
</sipLines>
 
<voipControlPort>5060</voipControlPort>
<dscpForAudio>184</dscpForAudio>
<ringSettingBusyStationPolicy>0</ringSettingBusyStationPolicy>
<dialTemplate>dialplan.xml</dialTemplate>
</sipProfile>
 
<commonProfile>
<phonePassword></phonePassword>
<backgroundImageAccess>true</backgroundImageAccess>
<callLogBlfEnabled>2</callLogBlfEnabled>
</commonProfile>
 
<loadInformation>SIP45.8-5-2SR1S</loadInformation>
 
<vendorConfig>
<disableSpeaker>false</disableSpeaker>
<disableSpeakerAndHeadset>false</disableSpeakerAndHeadset>
<pcPort>1</pcPort>
<settingsAccess>1</settingsAccess>
<garp>0</garp>
<voiceVlanAccess>0</voiceVlanAccess>
<videoCapability>0</videoCapability>
<autoSelectLineEnable>0</autoSelectLineEnable>
<webAccess>1</webAccess>
<daysDisplayNotActive>1,7</daysDisplayNotActive>
<displayOnTime>08:00</displayOnTime>
<displayOnDuration>10:30</displayOnDuration>
<displayIdleTimeout>00:30</displayIdleTimeout>
<spanToPCPort>1</spanToPCPort>
</vendorConfig>
 
<versionStamp>1136931633-57191cee-5ffc-4342-b286-4246b4991890</versionStamp>
 
<userLocale>
<name>Australia</name>
<uid>1</uid>
<langCode>en_AU</langCode>
<version>1.0.0.0-1</version>
<winCharSet>iso-8859-1</winCharSet>
</userLocale>
 
<networkLocale>Australia</networkLocale>
<networkLocaleInfo>
<name>Australia</name>
<uid>64</uid>
<version>1.0.0.0-1</version>
</networkLocaleInfo>
 
<deviceSecurityMode>1</deviceSecurityMode>
<idleTimeout>0</idleTimeout>
<authenticationURL></authenticationURL>
<directoryURL></directoryURL>
<idleURL></idleURL>
<informationURL></informationURL>
<messagesURL></messagesURL>
<proxyServerURL></proxyServerURL>
<servicesURL></servicesURL>
<dscpForSCCPPhoneConfig>96</dscpForSCCPPhoneConfig>
<dscpForSCCPPhoneServices>0</dscpForSCCPPhoneServices>
<dscpForCm2Dvce>96</dscpForCm2Dvce>
<transportLayerProtocol>4</transportLayerProtocol>
<capfAuthMode>0</capfAuthMode>
 
<capfList>
<capf>
<phonePort>3804</phonePort>
</capf>
</capfList>
 
<certHash></certHash>
<encrConfig>false</encrConfig>
</device>

This is the same file I was using on the Pi so I am assuming it is valid.

Thanks for taking to time to look over this stuff.

Bill.

 

[TwigsUSAN]

Just making sure that .132 is the last octet of your PIAF server.

 

[Bill Coghill]

That's correct - 192.168.10.132.

 

[Bill Coghill]

So I noticed this in the log :
<--- Transmitting (NAT) to 192.168.10.163:49155 --->
SIP/2.0 401 Unauthorized

NAT is set to off for this extension, but it seems to still be active for this extension. I had a look in the Asterisk Config and it seems NAT is turned on there. I set it to NO then rebooted the phone and it registered.
Unfortunately as I had to run off to a meeting so have not had a chance to try setting it to on again to see if it breaks it again. Also I haven't tried dialling out to make sure NAT off hasn't broken my links to my sip provider.

For now it seems to have done the trick though.

Bill