SIP/2.0 407 Proxy Authentication Required -- when trying to register SPA-3000 as a client

[GordonShumway]

The most frustrating part is that it's been working for months, and now suddenly SPA-3000 can no longer register. I'm using SPA-3000 to forward calls from the buzzer to extensions.

This is part of the capture from the 3cx server:

REGISTER sip:CUSTOM_FQDN SIP/2.0
Via: SIP/2.0/UDP INTERNET_IP:5061;branch=z9hG4bK-8cb1ad7a
From: Buzzer <sip:1111@CUSTOM_FQDN>;tag=c2f60da1c2a91a9co1
To: Buzzer <sip:1111@CUSTOM_FQDN>
Call-ID: 7f459e-f8ee79aa@LAN_IP
CSeq: 71295 REGISTER
Max-Forwards: 70
Contact: Buzzer <sip:1111@INTERNET_IP:5061>;expires=360
User-Agent: Linksys/SPA3000-3.1.10(GWd)
GUID: a1ea57dc78d2f0fd92aac5af88a2b44d
Content-Length: 0
Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER
Supported: x-sipura

SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP INTERNET_IP:5061;branch=z9hG4bK-8cb1ad7a
Proxy-Authenticate: Digest nonce="414d53595e99df2197:c2f6c927e3bd780bd038795783211ac3",algorithm=MD5,realm="3CXPhoneSystem"
To: "Buzzer"<sip:1111@CUSTOM_FQDN>;tag=e984c674
From: Buzzer <sip:1111@CUSTOM_FQDN>;tag=c2f60da1c2a91a9co1
Call-ID: 7f459e-f8ee79aa@LAN_IP
CSeq: 71295 REGISTER
Content-Length: 0

The SPA-3000 is behind NAT and the 3cx is in the cloud. I've tried switching from CUSTOM_FQDN to a 3cx-provided domain name, switching port to 5060 and then I finally regenerated username/passwords for the extension in 3cx and pasted the new ones into the SPA-3000 settings.

I'm still getting 407 and I don't know why and can't even figure out when did it start happening.

I have a Pixel phone in the same network as SPA-3000 which connects to 3cx using Android native SIP client (not 3cx client) just fine.

Any ideas what can I do to fix the problem? I found a similar post from the past where things just mysteriously started working somehow all of sudden, I wish it was my experience.

PS. I did change the LAN_IP for SPA-3000 a while back, also upgraded to the 16.0.5.610 just now and was on a previous BETA build before that. Could that be a factor?

 

[GordonShumway]

Also tried changing Auth ID in 3cx and on the client to an extension -- same problem.

 

[leejor]

To be clear, you are using the PSTN (portion) of the 3000 to send incoming (remote) PSTN calls to 3CX (as a trunk), and not vice-versa?

I did change the LAN_IP for SPA-3000 a while back, also upgraded to the 16.0.5.610 just now and was on a previous BETA build before that. Could that be a factor?

Probably. After which change, did it stop working?

 

[GordonShumway]

To be clear, you are using the PSTN (portion) of the 3000 to send incoming (remote) PSTN calls to 3CX (as a trunk), and not vice-versa?

Correct, FXO to ATA to VoIP.

Probably. After which change, did it stop working?

Probably? Is 3cx known to be sensitive to LAN IPs of the devices behind NAT?

I get buzzed in once or twice a month, there's no way to find out how long ago it stopped working. I have found other posts with people claiming occasionally their devices stop registering/sending calls to 3cx with similar symptoms, maybe 3cx engineers can chime in on that?

SPA-3000 is definitely trying to register and 3cx replies with 407 -- why?

 

[leejor]

<sip:1111@CUSTOM_FQDN>

Is the 1111, the actual trunk number (they are usually 5 digits), or just something you put in to mask the real number (not that it is a secret that someone could exploit).