Unsupported Caller is forbidden on ringgroup

[NoFate]

Hey

I'm testing a 3cx on premise install, all is working, fine

extension 3000 = door intercom
extension 3001 = sip client
extension 3002 = sip client
ringgroup 3100 type ring all, containing members 3001 and 3002

from 3000 i can call to 3001 or 3002 , all working OK! But i had first always the error 603 decline, caller is forbidden (also when i did a call to 3001 or 3002)
Its all internal on local subnet, no fqdn , enabled SIP calls, and the most important feature, i had to enable this option below to make the 603 error go away ...
Under Users => options => options => SIP ID , i put there for every extension the ID again, so for 3000 i put there 3000 , then the error went away

now, i want to test ringgroups

but i then have again the 603, caller is forbidden... so how can i enable that SIP ID on a ring group? or how can i fix this issue?

thnx

below is log

INVITE sip:[email protected]:5060 SIP/2.0



Max-Forwards: 20



Via: SIP/2.0/UDP 192.168.0.70:5060;rport;branch=z9hG4bK533295590



From: "3000" <sip:[email protected]>;tag=1020907903



To: <sip:[email protected]:5060>



Call-ID: [email protected]



CSeq: 232 INVITE



User-Agent: YATE/5.5.0



Contact: <sip:[email protected]:5060>



Allow: ACK, INVITE, BYE, CANCEL, MESSAGE, OPTIONS, INFO



Content-Type: application/sdp



Content-Length: 288







v=0



o=yate 1634251910 1634251910 IN IP4 192.168.0.70



s=SIP Call



c=IN IP4 192.168.0.70



t=0 0



m=audio 9654 RTP/AVP 0 101



a=rtpmap:0 PCMU/8000



a=rtpmap:101 telephone-event/8000



m=video 9856 RTP/AVP 96



a=rtpmap:96 H264/90000



a=fmtp:96 profile-level-id=4D001F; packetization-mode=1



SIP/2.0 407 Proxy Authentication Required



Via: SIP/2.0/UDP 192.168.0.70:5060;rport=5060;branch=z9hG4bK533295590



Proxy-Authenticate: Digest nonce="414d53596168986723:708b9cdda529793c9bd6a9b01b850289",algorithm=MD5,realm="3CXPhoneSystem"



To: <sip:[email protected]:5060>;tag=6508fb11



From: "3000" <sip:[email protected]>;tag=1020907903



Call-ID: [email protected]



CSeq: 232 INVITE



Content-Length: 0







ACK sip:[email protected]:5060 SIP/2.0



Via: SIP/2.0/UDP 192.168.0.70:5060;rport;branch=z9hG4bK533295590



From: "3000" <sip:[email protected]>;tag=1020907903



To: <sip:[email protected]:5060>;tag=6508fb11



Call-ID: [email protected]



CSeq: 232 ACK



Max-Forwards: 20



Contact: <sip:[email protected]:5060>



User-Agent: YATE/5.5.0



Content-Length: 0







INVITE sip:[email protected]:5060 SIP/2.0



Max-Forwards: 20



Via: SIP/2.0/UDP 192.168.0.70:5060;rport;branch=z9hG4bK2103115691



From: "3000" <sip:[email protected]>;tag=1020907903



To: <sip:[email protected]:5060>



Call-ID: [email protected]



User-Agent: YATE/5.5.0



Contact: <sip:[email protected]:5060>



Allow: ACK, INVITE, BYE, CANCEL, MESSAGE, OPTIONS, INFO



CSeq: 233 INVITE



Proxy-Authorization: Digest username="3000", realm="3CXPhoneSystem", nonce="414d53596168986723:708b9cdda529793c9bd6a9b01b850289", uri="sip:[email protected]:5060", response="9bf230af6b4501ebacf8b7dfb10d5578", algorithm=MD5



Content-Type: application/sdp



Content-Length: 288







v=0



o=yate 1634251910 1634251910 IN IP4 192.168.0.70



s=SIP Call



c=IN IP4 192.168.0.70



t=0 0



m=audio 9654 RTP/AVP 0 101



a=rtpmap:0 PCMU/8000



a=rtpmap:101 telephone-event/8000



m=video 9856 RTP/AVP 96



a=rtpmap:96 H264/90000



a=fmtp:96 profile-level-id=4D001F; packetization-mode=1



SIP/2.0 603 Decline



Via: SIP/2.0/UDP 192.168.0.70:5060;rport=5060;branch=z9hG4bK2103115691



To: <sip:[email protected]:5060>;tag=132da303



From: "3000"<sip:[email protected]>;tag=1020907903



Call-ID: [email protected]



CSeq: 233 INVITE



Warning: 499 debian "Caller is forbidden"



Content-Length: 0







ACK sip:[email protected]:5060 SIP/2.0



Via: SIP/2.0/UDP 192.168.0.70:5060;rport;branch=z9hG4bK2103115691



From: "3000" <sip:[email protected]>;tag=1020907903



To: <sip:[email protected]:5060>;tag=132da303



Call-ID: [email protected]



CSeq: 233 ACK



Max-Forwards: 20



Contact: <sip:[email protected]:5060>



Proxy-Authorization: Digest username="3000", realm="3CXPhoneSystem", nonce="414d53596168986723:708b9cdda529793c9bd6a9b01b850289", uri="sip:[email protected]:5060", response="9bf230af6b4501ebacf8b7dfb10d5578", algorithm=MD5



User-Agent: YATE/5.5.0



Content-Length: 0

 

[YiannisH_3CX]

HI @NoFate

Add a 3CX client to all your extensions and make calls between them and see if that works so we can rule a few staff out. Try that even without the SIP IDs to see if everything works and let us know.

 

[NoFate]

yeah, tried that before too, was the same message/error

 

[YiannisH_3CX]

yeah, tried that before too, was the same message/error

Did you replace everything with 3CX clients?
Can you give us some more details regarding the PBX and your network? Also does *777 work from a 3CX client?

 

[NoFate]

yeah, that was my first setup, all with 3cx clients, same issue
my setup , all is local (on premise)

pbx = ip 192.168.0.155
doorstation where i call from = ip 192.168.0.70

setup doorstatio (sip setup) is on direct IP
so i setup 192.168.0.155:5060 :> with extension username and password

there is no domain option to configure

so in network setup of 3cx , in the domain field, i have entered there the PBX ip = 192.168.0.155

so all is local setup

 

[YiannisH_3CX]

Did you replace the doorstation as well with a 3CX client for a test? Also what version PBX are you running?

From the logs you provided it looks like the authentication is failing when making a call like the PBX does not recognize the caller which should not happen if you are using 3CX clients which were auto provisioned so that is strange.
Did you try the *777 test with a 3CX client?

 

[NoFate]

i can try later to call with *777, not at home

with 3cx clients or softphone clients, i can call to ringgroup, thats no issue then
its just from this specific doorstation, thats givinc me headaches, i can call to ringgroups

btw, is also early media (video before accepting) call, supported on ring groups?
it works if i just call an extensions

thnx

 

[YiannisH_3CX]

Ok now we are getting somewhere. So if its the door phone that is giving you issues then that makes more sense because for a 3CX extension to register you need 3 things. You need the extension number the Auth ID and the password. If your door phone does not have the 3 options then you might run into issues and may need to find another solution.

btw, is also early media (video before accepting) call, supported on ring groups?

No this is not supported.

 

[JohnS_3CX]

Also discussed here: https://www.3cx.com/community/threads/early-video-preview-in-ring-group.83252/

 

[NoFate]

Ok, no ring group support , allthough I saw earlier some people mentioning it should work... Gonna test it out, if I can clear this issue

Indeed , i can only enter username and password on doorstation, but it works when I call single extensions from it, it just doesn't work when I call a ring group...

Could be the network/domain be an issue? I can try maybe the hosted 3cx , so it's all based on fqdn ?

 

[YiannisH_3CX]

ndeed , i can only enter username and password on doorstation, but it works when I call single extensions from it, it just doesn't work when I call a ring group...

You mentioned this only working if you add a SIP ID under the extensions. Is that not the case?

Could be the network/domain be an issue? I can try maybe the hosted 3cx , so it's all based on fqdn ?

I don't think this will make any difference.

 

[NoFate]

yes, calling to other sip clients, ONLY works when i add a SIP ID , indeed

why is that anyway ?

 

[YiannisH_3CX]

I suspect is because when dealing with direct SIP calls (which is what the SIP ID is meant for) there is no authentication which comes back to the calling extension not being able to authenticate properly.

 

[NoFate]

i know testing the 3cx cloud instance , to rule out network/domain
doorstation sip 3000 , sip client = 3002
unchecked the option "disallow use extension outside lan"

so 3000 and 3002 are registered fine...

but when i call from doorstation to sip, i get a 603 decline, caller is forbidden...
even if i enable the direct SIP ID

pfff, frustating

INVITE sip:[email protected]:5060 SIP/2.0

Max-Forwards: 20

Via: SIP/2.0/UDP 99.999.120.10:5060;rport;branch=z9hG4bK1164939144

From: "3000" <sip:[email protected]:5060>;tag=493874600

To: <sip:[email protected]:5060>

Call-ID: [email protected]

CSeq: 254 INVITE

User-Agent: YATE/5.5.0

Contact: <sip:[email protected]:5060>

Allow: ACK, INVITE, BYE, CANCEL, MESSAGE, OPTIONS, INFO

Content-Type: application/sdp

Content-Length: 290



v=0

o=yate 1634302555 1634302555 IN IP4 99.999.120.10

s=SIP Call

c=IN IP4 99.999.120.10

t=0 0

m=audio 9654 RTP/AVP 0 101

a=rtpmap:0 PCMU/8000

a=rtpmap:101 telephone-event/8000

m=video 9856 RTP/AVP 96

a=rtpmap:96 H264/90000

a=fmtp:96 profile-level-id=4D001F; packetization-mode=1

SIP/2.0 407 Proxy Authentication Required

Via: SIP/2.0/UDP 99.999.120.10:5060;rport=5060;branch=z9hG4bK1164939144

Proxy-Authenticate: Digest nonce="414d535961695e3b60:b1bd6b4cdbeca89d22c414769e2f6fed",algorithm=MD5,realm="3CXPhoneSystem"

To: <sip:[email protected]:5060>;tag=c37fc272

From: "3000" <sip:[email protected]:5060>;tag=493874600

Call-ID: [email protected]

CSeq: 254 INVITE

Content-Length: 0



ACK sip:[email protected]:5060 SIP/2.0

Via: SIP/2.0/UDP 99.999.120.10:5060;rport;branch=z9hG4bK1164939144

From: "3000" <sip:[email protected]:5060>;tag=493874600

To: <sip:[email protected]:5060>;tag=c37fc272

Call-ID: [email protected]

CSeq: 254 ACK

Max-Forwards: 20

Contact: <sip:[email protected]:5060>

User-Agent: YATE/5.5.0

Content-Length: 0



INVITE sip:[email protected]:5060 SIP/2.0

Max-Forwards: 20

Via: SIP/2.0/UDP 99.999.120.10:5060;rport;branch=z9hG4bK1390535221

From: "3000" <sip:[email protected]:5060>;tag=493874600

To: <sip:[email protected]:5060>

Call-ID: [email protected]

User-Agent: YATE/5.5.0

Contact: <sip:[email protected]:5060>

Allow: ACK, INVITE, BYE, CANCEL, MESSAGE, OPTIONS, INFO

CSeq: 255 INVITE

Proxy-Authorization: Digest username="3000", realm="3CXPhoneSystem", nonce="414d535961695e3b60:b1bd6b4cdbeca89d22c414769e2f6fed", uri="sip:[email protected]:5060", response="8b4a1c7ba10510eb9d0cf5dd7bba5a8d", algorithm=MD5

Content-Type: application/sdp

Content-Length: 290



v=0

o=yate 1634302555 1634302555 IN IP4 99.999.120.10

s=SIP Call

c=IN IP4 99.999.120.10

t=0 0

m=audio 9654 RTP/AVP 0 101

a=rtpmap:0 PCMU/8000

a=rtpmap:101 telephone-event/8000

m=video 9856 RTP/AVP 96

a=rtpmap:96 H264/90000

a=fmtp:96 profile-level-id=4D001F; packetization-mode=1

SIP/2.0 603 Decline

Via: SIP/2.0/UDP 99.999.120.10:5060;rport=5060;branch=z9hG4bK1390535221

To: <sip:[email protected]:5060>;tag=d5987f72

From: "3000"<sip:[email protected]:5060>;tag=493874600

Call-ID: [email protected]

CSeq: 255 INVITE

Warning: 499 xxxx "Caller is forbidden"

Content-Length: 0



ACK sip:[email protected]:5060 SIP/2.0

Via: SIP/2.0/UDP 99.999.120.10:5060;rport;branch=z9hG4bK1390535221

From: "3000" <sip:[email protected]:5060>;tag=493874600

To: <sip:[email protected]:5060>;tag=d5987f72

Call-ID: [email protected]

CSeq: 255 ACK

Max-Forwards: 20

Contact: <sip:[email protected]:5060>

Proxy-Authorization: Digest username="3000", realm="3CXPhoneSystem", nonce="414d535961695e3b60:b1bd6b4cdbeca89d22c414769e2f6fed", uri="sip:[email protected]:5060", response="8b4a1c7ba10510eb9d0cf5dd7bba5a8d", algorithm=MD5

User-Agent: YATE/5.5.0

Content-Length: 0

 

[YiannisH_3CX]

I believe its like before. Call comes in the PBX asks for authentication which the fails and you get a 603 decline. Since this is an unsupported device you will need to either use a supported device or figure out a way to have it authenticate properly. Not a lot we can do here I am afraid.

 

[NoFate]

hmm, thats not possible for me, its an hikvision door intercom, its not something i can replace

dont get it why 3cx is bugging me, it works on freepbx and also on freeswitch
why not on 3cx ?

 

[JohnS_3CX]

hmm, thats not possible for me, its an hikvision door intercom, its not something i can replace

dont get it why 3cx is bugging me, it works on freepbx and also on freeswitch
why not on 3cx ?

Since this is not a supported device, if you still wish to use it you will have to debug it yourself or get help directly from the manufacturer.

We do not provide assistance for unsupported devices as made clear here
https://www.3cx.com/community/threa...-phone-how-can-i-make-it-work-with-3cx.84739/

 

[NoFate]

i understand, but its 3cx thats rejecting the calls ?
isnt there a setting somewhere to allow the calls?

 

[NoFate]

allthough, the latest log 2 replies earlier, the error is different tough, i see now a 499 , caller is forbidden
it was before i 607 i believe...

so maybe there is a setting i'm missing in 3cx cloud to allow the caller?