[Freeswitch-users] Hangup problem/SIP BYE lacking authentication

[Wellie Chao]

Hangups do not work for me under certain circumstances. Here is the 
background information:

* Our carrier uses a Metaswitch server with Acme Packet in front as a
   proxy/SBC. Only the Acme Packet machine is publicly visible
   (64.115.128.6).

* Our Freeswitch server is at 216.57.23.143.

* For calls originating from Freeswitch and terminating on Metaswitch
   (216.57.23.143 -> 64.115.128.6), Freeswitch authenticates with
   Metaswitch and everything works hunky-dorey. Either side can hang up and
   the other side will automatically hang up without requiring a manual
   hang-up.

Now the problem:

For calls originating from Metaswitch to Freeswitch (64.115.128.6 -> 
216.57.23.143), Metaswitch does not authenticate with Freeswitch. 
Metaswitch also does not use the existing authenticated registration that 
our Freeswitch server initiates with Metaswitch upon startup of 
Freeswitch. Metaswitch just begins a new (unauthenticated) session and we 
have configured Freeswitch to allow any inbound calls from 64.115.128.6 
without requiring authentication.

We receive inbound calls (Metaswitch to Freeswitch, 64.115.128.6 -> 
216.57.23.143) just fine. The phone rings and we can have a normal 
conversation. If the caller (the endpoint attached to Metaswitch) hangs 
up, both sides hang up. If I hang up (remember, I'm at the endpoint 
attached to Freeswitch), the caller's line remains attached forever.

I have recorded a packet trace. Look at freeswitch_2.cap in the ZIP file, 
and you want to graph the first call starting at 21.202 and ending 53.798. 
If you go to time 53.087, you can see that my Freeswitch server sends a 
BYE to Metaswitch. This is a result of me hanging up my phone. At time 
53.089, you see Metaswitch responding with 401 Unauthorized. Later at time 
53.777, you see a BYE from Metaswitch to Freeswitch, but you should ignore 
this because that was a result of the caller (the guy hooked up to 
Metaswitch) manually hanging up. If he had not hung up his phone, the BYE 
from Metaswitch to Freeswitch would not have been issued and his phone 
would just stay on the line forever. Also, when I hang up my phone, I see 
the following at the Freeswitch console:

2008-10-29 23:03:28 [ERR] sofia_reg.c:1089 
sofia_reg_handle_sip_r_challenge() No Matching gateway found

I presume that Freeswitch emits this error because it got the 401 
Unauthorized from Metaswitch.

I also asked our carrier for a packet trace of a successful hangup on the 
Aastra platform (the engineer at the carrier says it is an Asterisk 
derivative -- I'm not sure about that). Look at 
Aastra_authentication_test.cap in the ZIP file. Graph the first call 
starting at 43.633 and ending 93.156. If you go to 93.118, you'll see that 
the Aastra server sends a BYE. Just like our Freeswitch scenario, 
Metaswitch sends back a 401 Unauthorized, but in response to the 401 
Unauthorized, Aastra then sends back another BYE with the difference that 
the second BYE is authenticated. Metaswitch gets the second BYE and 
responds with 200 OK.

I am pretty sure that if Freeswitch were to send back a second BYE (but 
with authentication), it would work fine. Now my question is how can I do 
this? I am not sure if this divergence of behavior is caused by: (a) my 
own error in configuring Freeswitch, (b) Metaswitch lacking standard SIP 
support (maybe it's not supposed to send the 401 Unauthorized), or (c) 
Freeswitch lacking standard SIP support (maybe it's supposed to send back 
a second BYE with authentication automatically). I don't know the SIP 
standards (or Freeswitch) well enough to know whether this problem is 
caused by me or by a deficiency in one of the two products (Metaswitch or 
Freeswitch).

Can you provide some pointers?

The ZIP file with the packet traces can be downloaded here:
http://216.57.23.143/hangup_problem.zip