Newbie question about Cisco phones
I have FreeSwitch installed, and now I'm trying to test it. I'm attempting to use a Cisco UC phone, model CP-3805. I have it talking to the TFTP server and getting a configuration file that I got from the FreeSwitch wiki. It contains the IP address of the switch, and a couple of login/password lines: <authName>1001</authName> <authPassword>654987</authPassword> I have this same login/password in conf/directory/1001.xml: <user id="1001"> <params> <param name="password" value="654987"/> Using tcpwatch, I see the switch keeps sending "SIP/2.0 401 Unauthorized" and "SIP/2.0 403 Forbidden" messages to the phone, so I obviously have something wrong. I'm thinking I have to put something in conf/sip_profiles, but that's just a guess at this point. I'm assuming this is a FAQ, but I found very little in the wiki about configuring phones. -- Steve
Can you capture the SIP traffic between the phone and the server and drop it on pastebin.freeswitch.org? It might be good to review the SIP dialog, just in case there are some clues there. You can use the fs_cli if you wish: sofia profile internal siptrace on (if you're using the example configs that come with FreeSWITCH. Use the correct profile name if you have one other than "internal" that you're using.) On Thu, Dec 27, 2012 at 3:50 PM, Steven Schoch < schoch+freeswitch.org@xwin32.com> wrote:
I have FreeSwitch installed, and now I'm trying to test it.
I'm attempting to use a Cisco UC phone, model CP-3805. I have it talking to the TFTP server and getting a configuration file that I got from the FreeSwitch wiki. It contains the IP address of the switch, and a couple of login/password lines:
<authName>1001</authName> <authPassword>654987</authPassword>
I have this same login/password in conf/directory/1001.xml:
<user id="1001"> <params> <param name="password" value="654987"/>
Using tcpwatch, I see the switch keeps sending "SIP/2.0 401 Unauthorized" and "SIP/2.0 403 Forbidden" messages to the phone, so I obviously have something wrong.
I'm thinking I have to put something in conf/sip_profiles, but that's just a guess at this point.
I'm assuming this is a FAQ, but I found very little in the wiki about configuring phones.
-- Steve
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org
Here are the important lines from the trace: (I don't think I need to paste the whole thing.) recv 1521 bytes from tcp/[192.168.4.254]:4025 at 01:28:45.696774: ------------------------------------------------------------------------ REGISTER sip:192.168.4.1:5060;transport=tcp SIP/2.0 Via: SIP/2.0/TCP 192.168.4.254:4025 ;rport;branch=z9hG4bKPjZiQxS2mheTBbTXalnSTcX-9-vSvvYydR Max-Forwards: 70 From: "110" <sip:1001@192.168.4.1>;tag=SoDYLlxdRfdsHMTYaCd6LprFvMe6ROpl To: "110" <sip:1001@192.168.4.1> Call-ID: 6Y7zlZiZJekTAYupYa4SU.v2.8vpto97 CSeq: 4019 REGISTER User-Agent: Cisco-CP3905/9.2.1 [other stuff...] ------------------------------------------------------------------------ send 684 bytes to tcp/[192.168.4.254]:4025 at 01:28:45.856104: ------------------------------------------------------------------------ SIP/2.0 401 Unauthorized Via: SIP/2.0/TCP 192.168.4.254:4025 ;rport=4025;branch=z9hG4bKPjZiQxS2mheTBbTXalnSTcX-9-vSvvYydR From: "110" <sip:1001@192.168.4.1>;tag=SoDYLlxdRfdsHMTYaCd6LprFvMe6ROpl To: "110" <sip:1001@192.168.4.1>;tag=UrQB9NZ278Hpc Call-ID: 6Y7zlZiZJekTAYupYa4SU.v2.8vpto97 [I don't think the other stuff is pertinent.] And later: ------------------------------------------------------------------------ send 562 bytes to tcp/[192.168.4.254]:4025 at 01:28:46.032084: ------------------------------------------------------------------------ SIP/2.0 403 Forbidden Via: SIP/2.0/TCP 192.168.4.254:4025 ;rport=4025;branch=z9hG4bKPjbdyYmV-sH2X-.Cs-LZUG9P36AHF5dn4E From: "110" <sip:1001@192.168.4.1>;tag=SoDYLlxdRfdsHMTYaCd6LprFvMe6ROpl To: "110" <sip:1001@192.168.4.1>;tag=v1g4aHg64H88Q Call-ID: 6Y7zlZiZJekTAYupYa4SU.v2.8vpto97 CSeq: 4020 REGISTER I have put a name/password in the Cisco config file, and the same name/password in conf/directory/1001.xml. Should this go in the conf/sip_profiles/internal section instead? -- Steve On Thu, Dec 27, 2012 at 4:53 PM, Michael Collins <msc@freeswitch.org> wrote:
Can you capture the SIP traffic between the phone and the server and drop it on pastebin.freeswitch.org? It might be good to review the SIP dialog, just in case there are some clues there. You can use the fs_cli if you wish: sofia profile internal siptrace on (if you're using the example configs that come with FreeSWITCH. Use the correct profile name if you have one other than "internal" that you're using.)
This is incomplete. The normal flow is -> REGISTER <- 401 -> REGISTER <- 200 or 403 If you look at the CSeq in the 403 you'll see its a reply to the register after the initial REGISTER. 401 contains a challenge that's used to generate the auth data to put in the 2nd register - that allows digest authentication which avoids sending the password in plaintext and uses a nonce to prevent replay attacks (an attacker can't capture the register and resend it later to auth themselves). The digest includes the domain, if the user and password match perhaps the problem lies there... Sent from my iPad On 28 Dec 2012, at 01:38, Steven Schoch <schoch+freeswitch.org@xwin32.com> wrote:
Here are the important lines from the trace: (I don't think I need to paste the whole thing.)
recv 1521 bytes from tcp/[192.168.4.254]:4025 at 01:28:45.696774: ------------------------------------------------------------------------ REGISTER sip:192.168.4.1:5060;transport=tcp SIP/2.0 Via: SIP/2.0/TCP 192.168.4.254:4025;rport;branch=z9hG4bKPjZiQxS2mheTBbTXalnSTcX-9-vSvvYydR Max-Forwards: 70 From: "110" <sip:1001@192.168.4.1>;tag=SoDYLlxdRfdsHMTYaCd6LprFvMe6ROpl To: "110" <sip:1001@192.168.4.1> Call-ID: 6Y7zlZiZJekTAYupYa4SU.v2.8vpto97 CSeq: 4019 REGISTER User-Agent: Cisco-CP3905/9.2.1 [other stuff...]
------------------------------------------------------------------------ send 684 bytes to tcp/[192.168.4.254]:4025 at 01:28:45.856104: ------------------------------------------------------------------------ SIP/2.0 401 Unauthorized Via: SIP/2.0/TCP 192.168.4.254:4025;rport=4025;branch=z9hG4bKPjZiQxS2mheTBbTXalnSTcX-9-vSvvYydR From: "110" <sip:1001@192.168.4.1>;tag=SoDYLlxdRfdsHMTYaCd6LprFvMe6ROpl To: "110" <sip:1001@192.168.4.1>;tag=UrQB9NZ278Hpc Call-ID: 6Y7zlZiZJekTAYupYa4SU.v2.8vpto97 [I don't think the other stuff is pertinent.]
And later: ------------------------------------------------------------------------ send 562 bytes to tcp/[192.168.4.254]:4025 at 01:28:46.032084: ------------------------------------------------------------------------ SIP/2.0 403 Forbidden Via: SIP/2.0/TCP 192.168.4.254:4025;rport=4025;branch=z9hG4bKPjbdyYmV-sH2X-.Cs-LZUG9P36AHF5dn4E From: "110" <sip:1001@192.168.4.1>;tag=SoDYLlxdRfdsHMTYaCd6LprFvMe6ROpl To: "110" <sip:1001@192.168.4.1>;tag=v1g4aHg64H88Q Call-ID: 6Y7zlZiZJekTAYupYa4SU.v2.8vpto97 CSeq: 4020 REGISTER
I have put a name/password in the Cisco config file, and the same name/password in conf/directory/1001.xml. Should this go in the conf/sip_profiles/internal section instead?
-- Steve
On Thu, Dec 27, 2012 at 4:53 PM, Michael Collins <msc@freeswitch.org> wrote:
Can you capture the SIP traffic between the phone and the server and drop it on pastebin.freeswitch.org? It might be good to review the SIP dialog, just in case there are some clues there. You can use the fs_cli if you wish: sofia profile internal siptrace on (if you're using the example configs that come with FreeSWITCH. Use the correct profile name if you have one other than "internal" that you're using.)
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi, Seeing the firmware version in the User Agent header this phone is probably build on the same platform as the 79XX series phones and having the same sip-stack. From experience I can tell you that sip-stack is really really horrible. I don’t know if you have bought a lot of these phone or just testing one. If you’re just testing one you’re better of with the Cisco SPA500 series phones instead of these ones. Especially if you’re new to ip telephony, these phones will give you bad headaches. Erik [cid:imagedf2f15.PNG@6f1c3921.4486eef7] ABC Westland 555 Tel: +31 174 22 50 80 P.O. Box 90 Fax: +31 174 22 50 81 Mob: +31 624 423 009 2685 ZH Poeldijk erik.dekkers@certhon.com<mailto:erik.dekkers@certhon.com> The Netherlands www.certhon.com<http://www.certhon.com> DISCLAIMER All our quotations, all orders and all contracts are subject to the AVAG-CONDITIONS. Op alle offertes, opdrachten en overeenkomsten zijn de AVAG-verkoopvoorwaarden van toepassing. ISO9001 CERTIFIED Van: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] Namens Steven Ayre Verzonden: vrijdag 28 december 2012 11:14 Aan: FreeSWITCH Users Help Onderwerp: Re: [Freeswitch-users] Newbie question about Cisco phones This is incomplete. The normal flow is -> REGISTER <- 401 -> REGISTER <- 200 or 403 If you look at the CSeq in the 403 you'll see its a reply to the register after the initial REGISTER. 401 contains a challenge that's used to generate the auth data to put in the 2nd register - that allows digest authentication which avoids sending the password in plaintext and uses a nonce to prevent replay attacks (an attacker can't capture the register and resend it later to auth themselves). The digest includes the domain, if the user and password match perhaps the problem lies there... Sent from my iPad On 28 Dec 2012, at 01:38, Steven Schoch <schoch+freeswitch.org@xwin32.com<mailto:schoch+freeswitch.org@xwin32.com>> wrote: Here are the important lines from the trace: (I don't think I need to paste the whole thing.) recv 1521 bytes from tcp/[192.168.4.254]:4025 at 01:28:45.696774: ------------------------------------------------------------------------ REGISTER sip:192.168.4.1:5060;transport=tcp SIP/2.0 Via: SIP/2.0/TCP 192.168.4.254:4025;rport;branch=z9hG4bKPjZiQxS2mheTBbTXalnSTcX-9-vSvvYydR Max-Forwards: 70 From: "110" <sip:1001@192.168.4.1<mailto:sip%3A1001@192.168.4.1>>;tag=SoDYLlxdRfdsHMTYaCd6LprFvMe6ROpl To: "110" <sip:1001@192.168.4.1<mailto:sip%3A1001@192.168.4.1>> Call-ID: 6Y7zlZiZJekTAYupYa4SU.v2.8vpto97 CSeq: 4019 REGISTER User-Agent: Cisco-CP3905/9.2.1 [other stuff...] ------------------------------------------------------------------------ send 684 bytes to tcp/[192.168.4.254]:4025 at 01:28:45.856104: ------------------------------------------------------------------------ SIP/2.0 401 Unauthorized Via: SIP/2.0/TCP 192.168.4.254:4025;rport=4025;branch=z9hG4bKPjZiQxS2mheTBbTXalnSTcX-9-vSvvYydR From: "110" <sip:1001@192.168.4.1<mailto:sip%3A1001@192.168.4.1>>;tag=SoDYLlxdRfdsHMTYaCd6LprFvMe6ROpl To: "110" <sip:1001@192.168.4.1<mailto:sip%3A1001@192.168.4.1>>;tag=UrQB9NZ278Hpc Call-ID: 6Y7zlZiZJekTAYupYa4SU.v2.8vpto97 [I don't think the other stuff is pertinent.] And later: ------------------------------------------------------------------------ send 562 bytes to tcp/[192.168.4.254]:4025 at 01:28:46.032084: ------------------------------------------------------------------------ SIP/2.0 403 Forbidden Via: SIP/2.0/TCP 192.168.4.254:4025;rport=4025;branch=z9hG4bKPjbdyYmV-sH2X-.Cs-LZUG9P36AHF5dn4E From: "110" <sip:1001@192.168.4.1<mailto:sip%3A1001@192.168.4.1>>;tag=SoDYLlxdRfdsHMTYaCd6LprFvMe6ROpl To: "110" <sip:1001@192.168.4.1<mailto:sip%3A1001@192.168.4.1>>;tag=v1g4aHg64H88Q Call-ID: 6Y7zlZiZJekTAYupYa4SU.v2.8vpto97 CSeq: 4020 REGISTER I have put a name/password in the Cisco config file, and the same name/password in conf/directory/1001.xml. Should this go in the conf/sip_profiles/internal section instead? -- Steve On Thu, Dec 27, 2012 at 4:53 PM, Michael Collins <msc@freeswitch.org<mailto:msc@freeswitch.org>> wrote: Can you capture the SIP traffic between the phone and the server and drop it on pastebin.freeswitch.org<http://pastebin.freeswitch.org>? It might be good to review the SIP dialog, just in case there are some clues there. You can use the fs_cli if you wish: sofia profile internal siptrace on (if you're using the example configs that come with FreeSWITCH. Use the correct profile name if you have one other than "internal" that you're using.) _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users<http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org
On Fri, Dec 28, 2012 at 2:13 AM, Steven Ayre <steveayre@gmail.com> wrote:
This is incomplete. The normal flow is -> REGISTER <- 401 -> REGISTER <- 200 or 403
I get it! It's like an HTTP basic auth sequence. The client does a GET, the server sends a 401 Authorization Required, and then the client prompts the user for login/password. The digest includes the domain, if the user and password match perhaps the
problem lies there...
Here is the entire header from the 2nd request: REGISTER sip:192.168.4.1:5060;transport=tcp SIP/2.0 Via: SIP/2.0/TCP 192.168.4.254:4025 ;rport;branch=z9hG4bKPj3ewRQ6PZNlIanuwbxr2CmdFx1fK2BF0A Max-Forwards: 70 From: "110" <sip:1001@192.168.4.1>;tag=fP-z0E14AtiuJz99qM1-4639EYKwlVjD To: "110" <sip:1001@192.168.4.1> Call-ID: TJDE1DQJNq40N64qIBpmll0KBNhezSyR CSeq: 22408 REGISTER User-Agent: Cisco-CP3905/9.2.1 Contact: <sip:110@192.168.4.254:4025 ;transport=TCP>;+sip.instance="<urn:uuid:00000000-0000-0000-0000-f47f353ce879>";+u.sip! devicename.ccm.cisco.com="SEPF47F353CE879";+u.sip!model.ccm.cisco.com="592" Expires: 3600 Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS Content-Disposition: session;handling=optional Content-Type: application/x-cisco-remotecc-request+xml Content-Length: 413 Reason: SIP;cause=200;text="cisco-alarm:25 Name=SEPF47F353CE879 Load=3905.9-2-1-0 Last=initialized" Supported: replaces,join,sdp-anat,norefersub,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-control,X-cisco-monrec,X-cisco-config,X-cisco-sis-4.0.0,X-cisco-xsi-7.0.1 Authorization: Digest username="1001", realm="192.168.4.1", nonce="ba548054-7dac-4cae-8939-076a2b438ee6", uri="sip:192.168.4.1:5060;transport=tcp", response="d9057b4ea439ce750e6b4e751cfc5e69", algorithm=MD5, cnonce="G4bay98LUnpnFmf.907akOTr60NEaeup", qop=auth, nc=00000001 The configuration file from /tftpboot includes: <name>1001</name> ... <authName>1001</authName> <authPassword>654987</authPassword> ...so I assume it's sending that password in the digest. I think my problem is that I don't yet fully understand the FreeSwitch configuration. The only place that password occurs is in conf/directory/1001.xml. It it supposed to go somewhere else? On Fri, Dec 28, 2012 at 2:52 AM, Erik Dekkers <erik.dekkers@certhon.com> wrote:
Seeing the firmware version in the User Agent header this phone is probably build on the same platform as the 79XX series phones and having the same sip-stack.
From experience I can tell you that sip-stack is really really horrible. I don’t know if you have bought a lot of these phone or just testing one.
Fortunately, I only purchased 2 for testing. I also purchased 3 Polycom SoundPoint IP 320 SIP phones, also for testing. I haven't gotten to them yet, because they need to boot with FTP instead of TFTP, and I need to figure out how to get vsftpd to work. I also bought an ultra-cheap Zultys (their headquarters is 1 mile from my house) phone, but I haven't even powered it up yet, and I probably won't use many of them because it doesn't have PoE. I'll try your suggestion on the SPA500 series. -- Steve
participants (4)
-
Erik Dekkers
-
Michael Collins
-
Steven Ayre
-
Steven Schoch