SOLVED FusionPBX - VOIP Innovation - Origination - call failed

[imcontreras]

Hi,

I'm really new, first-time fusionPBX user, I know FreePBX. Want to learn more so I set up a test environment.

My current Orig and Term provider it's VoIP Innovation.
My VPS Debian 9.4 x64
Fusion PBX v 4.4.3

Dialing from PSTN to my --> DID on voip innovation --> fusion pbx

What's working:
outgoing calls working
Ext registration successful

Problem:
No incoming calls, authentication failures on gateway

Steps were taken so far:

• No registration: VoIP Innovations, as far as I know, they only support IP authentication. This means that when setting up the gateway, it doesn't matter what username or password you put (as they are required fails). You must put the register parameter to false.
• Caller ID in the From: as a consequence of putting a random text in the authentication field. The INVITE Sip request by default will put that value in the From header. This totally breaks VoIP Innovation parameters. You just need to put the caller-id-in-from to true. This will force to put the value that comes from the effective_caller_id_number field. I will explain this below.
• Codecs: They only support PCMU, PCMA, and G729. So you should force those values before bridging. There are many ways to do this, and this depends on how are you doing your bridging statement.
• Setup Port 5080 on VoIP innovation traffic

Any ideas or help?

Really thanks in advance!

 

[Kenny Riley]

You mentioned that you are aware that FusionPBX requires a username and password for gateways even though VoIP Innovations uses IP authentication, but I don't see a username and password entered in the corresponding fields in the screenshot. Did you enter a dummy username and password?

If you are using the external profile, you should configure VoIP Innovations to send traffic on 5080 instead of 5060 as well as port forwarding 5080 on your firewall to your PBX.

If you've done these things and you still can't get incoming calls to work, you should post your logs for further examination.

 

[imcontreras]

You mentioned that you are aware that FusionPBX requires a username and password for gateways even though VoIP Innovations uses IP authentication, but I don't see a username and password entered in the corresponding fields in the screenshot. Did you enter a dummy username and password?

If you are using the external profile, you should configure VoIP Innovations to send traffic on 5080 instead of 5060 as well as port forwarding 5080 on your firewall to your PBX.

If you've done these things and you still can't get incoming calls to work, you should post your logs for further examination.

First, thanks for taking the time to help.

I contacted voip innovations regarding this issue this was their reply:

Looking into our CDRs, we are seeing a SIP Challenge Timeout occurring when inbound calls are delivered to your equipment. This error is usually a username/password being populated. Our system only requires IP based authentication so no username/password isrequired.

In your screenshot, it looks like you are populating a UN/PW and this is not needed. We only authenticate by IP and by having a SIP trunk with our SIP Signalling IP address in it, should be all you need.

Getting specific replies to your questions:

If you are using the external profile,
A: yes

you should configure VoIP Innovations to send traffic on 5080 instead of 5060
A: yes, I setup voip innovations to send traffic 5080

as well as port forwarding 5080 on your firewall to your PBX.
A: I have a droplet on digital ocean, so far no firewall enabled, maybe I need to check Debian firewall rules?

you should post your logs for further examination.
A: I'll do a research on how to gather logs.

Thanks!

 

[Kenny Riley]

No worries!

You will need a dummy username and dummy password in your Gateway settings and yes, ensure port 5080 is opened in iptables.

If you're used to FreePBX, the equivilent of of viewing the Asterisk logs by typing "asterisk -rvvvvvvv" in the command line for Freeswitch is "fs_cli".

Type fs_cli in the command line to open the logs, place a call and copy and paste your logs to something like pastebin: https://pastebin.com/ to share on the forum.

You should also look at the SIP flow by typing in "sngrep" from the command line. Sngrep is a super powerful tool for troubleshooting.

If you could include the logs of both fs_cli and a screenshot of your sngrep results, that would be super helpful.

PS - I have a working VoIP Innovations trunk on my system using the internal profile and I don't use the caller-id-from setting, so I'm not sure that is really required. Here's a screenshot of my settings of a working VI trunk. Keep in mind, I'm using the internal profile, not the external... but everything else is the same.

 

[imcontreras]

No worries!

You will need a dummy username and dummy password in your Gateway settings and yes, ensure port 5080 is opened in iptables.

If you're used to FreePBX, the equivilent of of viewing the Asterisk logs by typing "asterisk -rvvvvvvv" in the command line for Freeswitch is "fs_cli".

Type fs_cli in the command line to open the logs, place a call and copy and paste your logs to something like pastebin: https://pastebin.com/ to share on the forum.

You should also look at the SIP flow by typing in "sngrep" from the command line. Sngrep is a super powerful tool for troubleshooting.

If you could include the logs of both fs_cli and a screenshot of your sngrep results, that would be super helpful.

PS - I have a working VoIP Innovations trunk on my system using the internal profile and I don't use the caller-id-from setting, so I'm not sure that is really required. Here's a screenshot of my settings of a working VI trunk. Keep in mind, I'm using the internal profile, not the external... but everything else is the same.

I'm learning a lot today!

I saw your file and I don't see any real difference, how about the advance portion?

This is the logs from fs_cli command:
https://pastebin.com/Mvi30PaV

This is the log from sip flow:
https://pastebin.com/9XaMJ8Y6

I'm also attaching image, open ports on debian

Thanks

 

[Kenny Riley]

Hi-

I have no additional settings configured within the advanced portion of my VI gateway.

Can you provide the sip flow on the actual invite of the call? I have attached an example..

Your other screenshot looks like a netstat output of listening ports, not iptables.. do an iptables --list-rules to show all active rules. You will want to ensure port 5080 is opened.

Also, I noticed this line in your log output:
2018-12-26 23:21:56.686170 [DEBUG] sofia.c:10092 sofia/external/16305603232@64.136.174.30 receiving invite from 64.136.174.30:5060 version: 1.8.3 -4-4d4c454d3e 64bit

This looks like VI is sending you traffic on port 5060.. You may want to confirm VI is configured to send you traffic on 5080 if you want to use the external profile, as you have your gateway setup.

From the VI back office navigate to Endpoints > Endpoint Groups > Select your endpoint group in question and ensure the port is set to 5080.

 

[imcontreras]

Hi-

I have no additional settings configured within the advanced portion of my VI gateway.

Can you provide the sip flow on the actual invite of the call? I have attached an example..

Your other screenshot looks like a netstat output of listening ports, not iptables.. do an iptables --list-rules to show all active rules. You will want to ensure port 5080 is opened.

Also, I noticed this line in your log output:
2018-12-26 23:21:56.686170 [DEBUG] sofia.c:10092 sofia/external/16305603232@64.136.174.30 receiving invite from 64.136.174.30:5060 version: 1.8.3 -4-4d4c454d3e 64bit

This looks like VI is sending you traffic on port 5060.. You may want to confirm VI is configured to send you traffic on 5080 if you want to use the external profile, as you have your gateway setup.

From the VI back office navigate to Endpoints > Endpoint Groups > Select your endpoint group in question and ensure the port is set to 5080.

Kenny,

I was afraid of making to many changes and got lost so I rebuild everything from scratch, start over
My VPS Debian 8.4 x64
Fusion PBX v 4.4.3

getting the same error, so I think I have something wrong on the config but I don't know what, I'm sending fresh logs

this is the result for the IPTABLES
https://pastebin.com/gsrXrZr6

and also the latest logs from fs_cli command:
https://pastebin.com/MD16sYGU

I'm also attaching a new image for the sip flow

also image from my port setup on voip innovations (5080)

and image from my gateway setup

Thanks for your time!

 

[Kenny Riley]

Press Enter on one of the INVITE's in sngrep to get more information about why it's being rejected and include that screenshot.

 

[imcontreras]

Press Enter on one of the INVITE's in sngrep to get more information about why it's being rejected and include that screenshot.

Good morning, this is the image. Thanks!

 

[Kenny Riley]

Well that's weird.. your system is requesting authentication on the external profile -- but the whole point of the the external profile is for anonymous traffic.

I would restart the external profile and ensure it's running, just for added measure. Maybe flush the cache as well: Status > SIP Status

I'm afraid that's about as far as I can go as I don't really use the external profile on my system. I've been using FusionPBX for about a year and came from FreePBX as well -- where I used port 5060 for everything so I avoided using the external profile as it just added a layer of confusion for me as a new user.

Perhaps @DigitalDaz can chime in?

 

[imcontreras]

Well that's weird.. your system is requesting authentication on the external profile -- but the whole point of the the external profile is for anonymous traffic.

I would restart the external profile and ensure it's running, just for added measure. Maybe flush the cache as well: Status > SIP Status

I'm afraid that's about as far as I can go as I don't really use the external profile on my system. I've been using FusionPBX for about a year and came from FreePBX as well -- where I used port 5060 for everything so I avoided using the external profile as it just added a layer of confusion for me as a new user.

Perhaps @DigitalDaz can chime in?

So if I select the internal profile do I need to do anything else other than select 5060 on voip inovation?

will give I try

Thanks

 

[Kenny Riley]

So if I select the internal profile do I need to do anything else other than select 5060 on voip inovation?

will give I try

Thanks

You will need to set your Gateway to the internal profile, set your traffic for 5060 at Voip Innovations, ensure 5060 is opened on your firewall/ip tables, and add the Voip Innovations IP Addresses to the access control list:
Advanced > Access Controls > Domains

I don't use Voip Innovations as my primary carrier so I'm not sure if these are the correct IP's used these days, but here are my ACL rules for them:

allow 64.136.173.31/32 VI_1
allow 64.136.174.30/32 VI_2
allow 64.136.174.20/32 VI_3
allow 209.166.154.70/32 VI_4
allow 192.240.151.100/32 VI_5

 

[imcontreras]

You will need to set your Gateway to the internal profile, set your traffic for 5060 at Voip Innovations, ensure 5060 is opened on your firewall/ip tables, and add the Voip Innovations IP Addresses to the access control list:
Advanced > Access Controls > Domains

I don't use Voip Innovations as my primary carrier so I'm not sure if these are the correct IP's used these days, but here are my ACL rules for them:

allow 64.136.173.31/32 VI_1
allow 64.136.174.30/32 VI_2
allow 64.136.174.20/32 VI_3
allow 209.166.154.70/32 VI_4
allow 192.240.151.100/32 VI_5

Kenny,
finally, I got it working

You were right on all your tips and pointers. I'll buy you a beer or a cup of coffee any day any time.
Thanks for all your help!

 

[Kenny Riley]

Awesome! Glad I could help!