Cisco CallManager 8.X upper/through registration via Brekeke

thorstenpm · Post by **thorstenpm** » Tue May 27, 2014 8:31 am

1. Brekeke Product Name and Version: 3.3.4.4 advanced

2. Java version: 1.7_0.55-b14

3. OS type and the version: 2003 SP1

4. UA (phone), gateway or other hardware/software involved:
pbx: CUCM 8.6
endpoint: Media5-fone on iphone

5. Your problem:
The first iphone registers OK using upper & through with UDP as transport and digest authentication enabled all the way through.
Problem is any additional device trying to register (second iphone with the same client) will get unauthorised. Each of the endpoints can register if they are the first device to register.
Both iphone clients have different usernames/extensions (CUCM with digest authentication uses the extension as the auth username). We can see the 401 challenge from CUCM asking for web authentication digest with md5. However getting denied the registration. any thoughts/help appreciated. Not sure if this is a known limitation of CUCM 8.6?

hope · Post by **hope** » Tue May 27, 2014 8:11 pm

- Are both phones shown at Brekeke SIP Sever/Registered Clients page?
- capture packets at Brekeke server and check what error response is sent for the second phone's register request

thorstenpm · Post by **thorstenpm** » Tue May 27, 2014 8:52 pm

if Upper & Through is enabled only the first phone shows registered under "registered clients" in brekeke. It also shows registered in call manager (as expected with brekeke's IP Address).

as for the packet level for the second phone:
Endpoint = E
Callmanager = C
Brekeke = B

Sender :message: recipient

E :register: B
B :register: C
C :trying: B
C :401 unauthorised (need authentication): B
B :401 unauthorised (need authentication): E
E :register with auth: B
B :register with auth: C
C :trying: B
C :401 unauthorised: B
B :403 forbidden: E

hope above flow makes sense. Is there an easy way to provide or attach the capture to this post?

hope · Post by **hope** » Tue May 27, 2014 10:49 pm

check if the authentication password is set correct and the same on both phone and cisco side or reset it on both phone and Cisco sides.

thorstenpm · Post by **thorstenpm** » Tue May 27, 2014 10:52 pm

Both endpoints can register on their own and we can see the password being correct in the traces. I suppose proof is that they can both register on their own

thorstenpm · Post by **thorstenpm** » Wed May 28, 2014 2:58 am

update: found out that this is a call manager issue. the CUCM traces show that the same configured third party sip phone is being returned as the destination for some bizarre reason and hence the user digest authentication actually is incorrect.
In CUCM each third party sip device is associated to a user (in this case with digest auth).
Will post once we know the fix for this on CUCM side.

taitan · Post by **taitan** » Wed May 28, 2014 10:13 am

If you define the Brekeke SIP Server as a SIP trunk in CUCM, you don't have to use Upper/Thru registration.

I know some CUCM users who also use Brekeke. They use CUCM's SIP trunk function to work with Brekeke.

Add Brekeke SIP Server's IP address in CUCM's SIP trunk.