Solved 3CX SBC - Phones not registering (407 Proxy Authentication Required)

[chrot]

Hi Guys,

All of a sudden this friday aound 10 of our SBC-connected phones stopped working. (it seems they cannot connect) The message I see in the SBC logs is the following:

debug:3CXTunnel[22108]::2018-08-25T13:42:13.896054+00:00: TUNL | 140412460722368 | /home/repomaster/workspace/SBC/Sources/Projects/3CXSBC/Bridge.cpp:214 | Got local SIP message:#012REGISTER sip:10.0.5.218:16060 SIP/2.0#015#012Via: SIP/2.0/UDP 10.124.124.183;branch=xyz;received=ext.office.ip#015#012Max-Forwards: 70#015#012Contact: <sip:[email protected]>;methods="INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER"#015#012To: <sip:[email protected]:16060>#015#012From: "user" <sip:[email protected]:16060>;tag=60CDE53A-DD3127E7#015#012Call-ID: [email protected]#015#012CSeq: 1 REGISTER#015#012Expires: 120#015#012Accept-Language: en-us, en;q=0.9#015#012User-Agent: PolycomSoundPointIP-SPIP_321-UA/4.0.13.1445#015#012Content-Length: 0

debug:3CXTunnel[22108]::2018-08-25T13:42:13.896595+00:00: TUNL | 140412460722368 | /home/repomaster/workspace/SBC/Sources/Projects/3CXSBC/Bridge.cpp:768 | Sent to tunnel:#012REGISTER sip:10.0.5.218:16060 SIP/2.0#015#012Via: SIP/2.0/UDP 10.124.124.183;branch=xyz;received=ext.office.ip#015#012Max-Forwards: 69#015#012Record-Route: <sip:[email protected]:5060;user=proxy;tnlid=sbc.b53c7fe6>#015#012Contact: <sip:[email protected]>;methods="INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER"#015#012To: <sip:[email protected]:16060>#015#012From: "user"<sip:[email protected]:16060>;tag=60CDE53A-DD3127E7#015#012Call-ID: [email protected]#015#012CSeq: 1 REGISTER#015#012Expires: 120#015#012Accept-Language: en-us, en;q=0.9#015#012User-Agent: PolycomSoundPointIP-SPIP_321-UA/4.0.13.1445#015#012Content-Length: 0

debug:3CXTunnel[22108]::2018-08-25T13:42:13.927920+00:00: TUNL | 140412460722368 | /home/repomaster/workspace/SBC/Sources/Projects/3CXSBC/Bridge.cpp:288 | Received SIP message from tunnel:#012SIP/2.0 407 Proxy Authentication Required#015#012Via: SIP/2.0/UDP [::ffff:pbx.ip]:38381;branch=z9hG4bK-524287-1---tunneltid;rport;tnlid=sbc.b53c7fe6#015#012Via: SIP/2.0/UDP 10.124.124.183;branch=xyz;received=ext.office.ip#015#012Proxy-Authenticate: Digest nonce="414d53595b815cae74:b7b376c981bd50eae0cb238d86860c44",algorithm=MD5,realm="3CXPhoneSystem"#015#012To: <sip:[email protected]:16060>;tag=6b42f849#015#012From: "user"<sip:[email protected]:16060>;tag=60CDE53A-DD3127E7#015#012Call-ID: [email protected]#015#012CSeq: 1 REGISTER#015#012User-Agent: 3CXPhoneSystem 15.5.13103.5 (12071)#015#012Content-Length: 0

Does anyone have any idea? afaik the configuration should be correct?

Thanks!

 

[eddv123]

A 407 PROXY AUTHENTICATION REQUIRED: is normally sent back to the UAC when a proxy needs authentication from the client to allow communication.

The client should respond with digest authentication to allow it to continue - you need to check this is happening.

I would ask if you have re-generated your authentication credentials on the extensions recently but the trace states it is coming from the Tunnel.

 

[YiannisH_3CX]

Hello @chrot

Please note that from the provided logs we cannot see anything wrong as 407 proxy authentication is a normal message during the registration procedure of an extension. The device you are using however is not supported for SBC provisioning so it would have to be manually configured. With in mind i would check if a supported device can connect through the SBC so you can narrow down the cause of the issue.

 

[eddv123]

Additionally if using Polycom (despite being un-supported) I know that these models can be very sensitive to firmware version.

Where I do not think it would fix your initial issue I would always recommend having your firmware up to date when using Polycom.

 

[chrot]

Hi Guys,

Thanks a lot for your responses. After the initial "407 is considered a normal message in auth flow" I dove deeper into the network traffic, and figured out there was a firewall applicance filtering some of the SIP registration messages.

Thanks a lot!

 

[YiannisH_3CX]

Glad we could assist and to see that that issue is now resolved.