<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">the user directory lookup for auth is not done until after we send the 407. To do this without an acl you need to not do auth on the sip profile, and handle it in dial plan instead.<div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jun 20, 2017, at 2:22 PM, Joseph Waite <<a href="mailto:joelists@tm.net.uk" class="">joelists@tm.net.uk</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">There are no users configured on FreeSwitch, all user config is done on JeraSoft VCS and FreeSwitch authenticates via radius!<div class=""><br class=""></div><div class="">FreeSwitch should allow an INVITE from any IP, not send 407, but authenticate via Radius<br class=""><div class=""><blockquote type="cite" class=""><div class="">On 20 Jun 2017, at 19:12, Sergey Safarov <<a href="mailto:s.safarov@gmail.com" class="">s.safarov@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">you can add cidr attribute for all users</div><br class=""><div class="gmail_quote"><div dir="ltr" class="">вт, 20 июн. 2017 г. в 20:25, Jospeh Waite <<a href="mailto:joelists@tm.net.uk" class="">joelists@tm.net.uk</a>>:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class="">I don’t want to allow certain users, I want all calls that come in on this Sofia profile to not send the 407 but still authenticate via Radius based on the IP.</div><div style="word-wrap:break-word" class=""><br class=""><div class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On 20 Jun 2017, at 18:15, Sergey Safarov <<a href="mailto:s.safarov@gmail.com" target="_blank" class="">s.safarov@gmail.com</a>> wrote:</div><br class="m_8968711398784479929Apple-interchange-newline"><div class=""><div dir="ltr" class="">When you generate manually ACL with trusted IP or via mod_xml_radius then you can accept call without 407 message.<br class="">Also if you add cird attribute to user directory then FreeSwitch can map call to user via cidr attribute.</div><br class=""><div class="gmail_quote"><div dir="ltr" class="">вт, 20 июн. 2017 г. в 19:43, Joseph Waite <<a href="mailto:joelists@tm.net.uk" target="_blank" class="">joelists@tm.net.uk</a>>:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class="">I am using mod_xml_radius, however my issue is that if I enable auth_calls in profile it sends a 407 Proxy Authentication Required sip message, and if I set auth_calls to false it doesn’t authenticate with Radius, it simply passes call straight into the dial plan.</div><div style="word-wrap:break-word" class=""><div class=""><br class=""></div><div class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On 20 Jun 2017, at 17:32, Sergey Safarov <<a href="mailto:s.safarov@gmail.com" target="_blank" class="">s.safarov@gmail.com</a>> wrote:</div><br class="m_8968711398784479929m_4096173545130519898Apple-interchange-newline"><div class=""><p dir="ltr" class="">You can try mod_xml_radius and generate directory record with cidr adribute.</p>
<br class=""><div class="gmail_quote"><div dir="ltr" class="">вт, 20 июня 2017 г., 19:25 Joseph Waite <<a href="mailto:joelists@tm.net.uk" target="_blank" class="">joelists@tm.net.uk</a>>:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Guys<br class="">
<br class="">
I am trying to configure a Sofia Profile that will not send a 407 Proxy Authentication Required, but will still authenticate the incoming invite via Radius based on the IP address of the INVITE.<br class="">
<br class="">
If I change the Auth_calls to false on the Sofia profile, it doesn’t send the 407, but then it doesn’t authenticate the call.<br class="">
<br class="">
Any help would be most appreciated.<br class=""></blockquote></div></div></blockquote></div></div></div></blockquote></div></div></blockquote></div></div></div></blockquote></div></div></blockquote></div></div></div></div></blockquote></div><br class=""></div></body></html>