asterisk users - Apr 2016 - Incoming calls from Andrews & Arnold failing to authenticate

I have service with both VoIPtalk.org and Andrews & Arnold (aa.net.uk).
VoIPtalk calls are unauthenticated and reach me fine, but Andrews &
Arnold calls are authenticated. The last call I successfully received
was on Tuesday afternoon. Initially, A&A were for some odd reason not
sending calls to my server, but that has been resolved. The problem now
is that the calls fail to authenticate, and are therefore rejected -
error 403 is presented to them, and I see this in Asterisk's console: 

[Apr 23 11:53:19] NOTICE[27398][C-00000004]: chan_sip.c:25535
handle_request_invite: Failed to authenticate device "XXXXX XXXXXX"
<sip:XXXXXXXXXXX at voiceless.aa.net.uk>;tag=2016042311531900001

I have checked that the username and password in my config agree both
ends, and have even tried changing them.

The bulk of my calls come in on A&A, so I am obviously trying to find
out what has gone wrong. No-one else is seeing any problem. What do I
need to do to track this down?

-- 
Phil Reynolds
mail: phil-asterisk at tinsleyviaduct.com
Web: http://phil.tinsleyviaduct.com/

Hello Phil,

On Saturday, April 23, 2016, 12:19:15 PM, you wrote:
> I have checked that the username and password in my config agree both
> ends, and have even tried changing them.
> The bulk of my calls come in on A&A, so I am obviously trying to find
> out what has gone wrong. No-one else is seeing any problem. What do I
> need to do to track this down?
I have a couple of lines with A&A, and I have not been having any
problems recently. When I have had similar problems in the past, it
has been an issue with the SIP config. I originally had a number of
contexts set up in sip.conf to handle the lines coming in (such as
[aa-line1], [aa-line2]) each with their own username and password
settings. The type=user setting was critical, because all the calls
came from the same IP address, and using type=peer caused matching
problems which resulted in authentication failures. This got too
complex to manage once I added in all the IP addresses A&A calls might
come in from. so I simplified the setup.

I now have just one context in sip.conf to handle incoming A&A calls,
with the same username for all lines, and type=peer. Calls are then
sent to extensions.conf, where the calls are directed to the correct
call-handler for the line based on the CID. Here is the setup in
sip.conf for A&A calls:

-------------------------------------------
sip.conf
=======[aa-incoming](!)
type=peer
context=aa-incoming
insecure=invite
transport=udp
disallow=all
allow=alaw
trustrpid=yes
sendrpid=yes

; IPv4 hostnames
[voiceless-1](aa-incoming)
host=a4.voiceless.aa.net.uk
[voiceless-2](aa-incoming)
host=b4.voiceless.aa.net.uk
[voiceless-3](aa-incoming)
host=c4.voiceless.aa.net.uk
[voiceless-4](aa-incoming)
host=d4.voiceless.aa.net.uk
[voiceless-5](aa-incoming)
host=e4.voiceless.aa.net.uk
[voiceless-6](aa-incoming)
host=f4.voiceless.aa.net.uk
[voiceless-7](aa-incoming)
host=g4.voiceless.aa.net.uk
[voiceless-8](aa-incoming)
host=h4.voiceless.aa.net.uk
[voiceless-9](aa-incoming)
host=i4.voiceless.aa.net.uk
[voiceless-10](aa-incoming)
host=j4.voiceless.aa.net.uk
-------------------------------------------

The trustrpid and sendrpid settings were important.

-------------------------------------------
extensions.conf  (DNIDs changed)
==============[aa-incoming]
exten => 440000000001,1,Goto(from-aa-line1,s,1)
exten => 440000000002,1,Goto(from-aa-line2,s,1)
exten => 440000000003,1,Goto(from-aa-line3,s,1)
-------------------------------------------

Hope this helps.

Julian





-- 
Best regards,
 Julian                            mailto:jb_soft at trink.co.uk

On Sat, 23 Apr 2016 22:45:32 +0100
Julian Beach <jb_soft at trink.co.uk> wrote:
> Hello Phil,
> 
> I have a couple of lines with A&A, and I have not been having any
> problems recently. When I have had similar problems in the past, it
> has been an issue with the SIP config. I originally had a number of
> contexts set up in sip.conf to handle the lines coming in (such as
> [aa-line1], [aa-line2]) each with their own username and password
> settings. The type=user setting was critical, because all the calls
> came from the same IP address, and using type=peer caused matching
> problems which resulted in authentication failures. This got too
> complex to manage once I added in all the IP addresses A&A calls might
> come in from. so I simplified the setup.
> 
> I now have just one context in sip.conf to handle incoming A&A calls,
> with the same username for all lines, and type=peer. Calls are then
> sent to extensions.conf, where the calls are directed to the correct
> call-handler for the line based on the CID. Here is the setup in
> sip.conf for A&A calls:
Actually, this is now sorted. It turns out the latest recommended
configs on the A&A wiki had peer vs. user confusion. On correcting
this, all was well.

-- 
Phil Reynolds
mail: phil-asterisk at tinsleyviaduct.com
Web: http://phil.tinsleyviaduct.com/