[FreePBX issue during call platform migration] 403 Forbidden

[Liptonbrisk]

Before I head off to deal with AC installation, I don't agree with the part of the A.I. assessment that appears to be ignoring that the outbound INVITE goes to voip.freephoneline.ca, while the trunk identity was referencing voip2.freephoneline.ca. "Porta [the switch/server vendor] recommended to Fibernetics [CLEC/network used by Fongo/Freephoneline] to enable Host Name Verification on Sip Registrations. This was enabled." -- Fongo admin

The trunk must present the same host name the provider expects in the SIP registration and related identity fields. That makes the voip vs. voip2 distinction matter, because a host-name mismatch might break call acceptance even when the account page shows connected (however, I haven't tested that).

Related thread: viewtopic.php?t=20920

“Temporarily clear or disable custom outbound caller ID on the trunk and test again”

That may be worth trying though since some have reported calls failing based on certain characters in outbound CID name being rejected.

[cba123]

I started having the same all circuits busy 403 Forbidden error message on my outgoing calls using FreePBX today as well.
I also tried to switch to use voip2.freephoneline.ca with the same error.
I am still using the legacy SIP channel running Freepbx 15/Asterisk 16.

As @ilneofita suggested, adding these 3 settings to the PEER Details on the Outgoing SIP setting fixed it for me.
a) authuser=1613xxxxxxx
b) fromuser=1613xxxxxxx
c) defaultuser=1613xxxxxxx

I changed all the settings back to use voip.freephoneline.ca instead of voip2.freephoneline.ca that I tested earlier today.

I am not sure if I used voip2.freephoneline.ca if it would also have caused the voip vs voip2 mismatch and continued 403 forbidden errors that mkaye experienced, but using voip.freephoneline.ca with the 3 additional PEER settings got my FPL trunks on Freepbx server working again.

[cba123]

I add the problem in my asterisk using pjsip
I solved adding in my _endpoint to force the authentication
outbound_auth=montreal_auth

Can you post your working pjsip configuration settings that you are currently using for FPL, as I haven't been able to get my FPL trunks working with pjsip on the latest Freepbx 17 / Asterisk 22, which is why I am still on the older versions using the deprecated sip channel.

Also, I don't see any field for outbound_auth under pjsip Settings Advanced, and don't know where _endpoint is located.

EDIT: I see in a separate response you indicated you don't use Freepbx and only use Asterisk, so can you post your specific Asterisk config files that were used so that I can manually try and figure out which settings are made via Freepbx GUI and if there are any additional settings not in the GUI that may need to go in a _custom configuration file.

[Liptonbrisk]

in your conf try to add
authuser=1613xxxxxxx

and if you didn't add these already, try too
fromuser=1613xxxxxxx
defaultuser=1613xxxxxxx

Sorry I don't use freepbx

Edit: you previous post too mask the number

Okay, @mkaye, maybe you can try this to see if it helps:

1) In the FreePBX GUI go to Connectivity --> Trunks --> select the chan_sip trunk for Freephoneline.

2. Under SIP Settings --> Outgoing (Peer Details), add these lines (replace with your real digits):

a) authuser=1613xxxxxxx

b) fromuser=1613xxxxxxx

c) defaultuser=1613xxxxxxx


authuser=1613xxxxxxx -- This is the username sent for authentication challenges (same as authuser in many ATA/peer examples).

fromuser=1613xxxxxxx -- This forces the SIP From: username (the identity FPL sees as the caller).

defaultuser=1613xxxxxxx -- This is used when host is not dynamic. It's often equivalent to the login name Asterisk uses when registering/outbound. Baiscally, it's the main user identity Asterisk assumes for that trunk when no specific value is being used.



2. In Registration Settings, add the register string if required:

1613xxxxxxx:[email protected]/1613xxxxxxx (only if your trunk uses registration; I think Freephoneline requires registration for outbound calls to work past 15 minutes)

3. Submit, and Apply Config.


4. Then either reload Asterisk or at the Asterisk CLI run this: sip reload


I'm guessing a bit.


Test an outbound call.

As @ilneofita suggested, adding these 3 settings to the PEER Details on the Outgoing SIP setting fixed it for me.
a) authuser=1613xxxxxxx
b) fromuser=1613xxxxxxx
c) defaultuser=1613xxxxxxx

I changed all the settings back to use voip.freephoneline.ca instead of voip2.freephoneline.ca that I tested earlier today.

I am not sure if I used voip2.freephoneline.ca if it would also have caused the voip vs voip2 mismatch and continued 403 forbidden errors that mkaye experienced, but using voip.freephoneline.ca with the 3 additional PEER settings got my FPL trunks on Freepbx server working again.

Thanks for letting us know. mkaye indicated this:

added these - still fails

2. Under SIP Settings --> Outgoing (Peer Details), add these lines (replace with your real digits):

a) authuser=1613xxxxxxx

b) fromuser=1613xxxxxxx

c) defaultuser=1613xxxxxxx

Anyway, I would try making the FreePBX trunk use one Freephoneline host name consistently everywhere and set authuser, fromuser, and defaultuser to the SIP username.

[cba123]

I think the voip vs voip2 mismatch and resulting failure may have been because @mkaye may have literally copied what you indicated in the instructions that used voip2 while all the rest of their settings were voip and only edited the masked values in this setting.

2. In Registration Settings, add the register string if required:

1613xxxxxxx:[email protected]/1613xxxxxxx (only if your trunk uses registration; I think Freephoneline requires registration for outbound calls to work past 15 minutes)

Obviously, this needs to match the specific server used throughout the sip definition:
1613xxxxxxx:[email protected]/1613xxxxxxx
1613xxxxxxx:[email protected]/1613xxxxxxx

In Freepbx, the server should be defined in 5 spots using the deprecated sip channel (all under Sip Settings):
In PEER Details, under the Outgoing tab:
host=voip.freephoneline.ca
fromdomain=voip.freephoneline.ca

In User Details, under Incoming tab:
host=voip.freephoneline.ca
fromdomain=voip.freephoneline.ca

In Register String, under Incoming tab:
1613xxxxxxx:[email protected]/1613xxxxxxx

[Liptonbrisk]

I think the voip vs voip2 mismatch and resulting failure may have been because @mkaye may have literally copied what you indicated in the instructions that used voip2 while all the rest of their settings were voip

viewtopic.php?p=83223#p83223

started today - maybe last week on sone numbers - all numbers now
tried voip2

viewtopic.php?p=83228#p83228

this what i have used for years, except voip, not voip2 - is something missing or wrong?

host=voip2.freephoneline.ca
fromdomain=voip2.freephoneline.ca

the SIP exchange shows a server/identity mismatch: the outbound INVITE goes to voip.freephoneline.ca, while the trunk identity still references voip2.freephoneline.ca.

Obviously, this needs to match the specific server used throughout the sip definition:
1613xxxxxxx:password@voip.freephoneline.ca/1613xxxxxxx

i have voip2 for host & fromname

In Registration Settings, add the register string if required:

1613xxxxxxx:password@voip2.freephoneline.ca/1613xxxxxxx

[cba123]

I think the voip vs voip2 mismatch and resulting failure may have been because @mkaye may have literally copied what you indicated in the instructions that used voip2 while all the rest of their settings were voip

viewtopic.php?p=83223#p83223

started today - maybe last week on sone numbers - all numbers now
tried voip2

viewtopic.php?p=83228#p83228

this what i have used for years, except voip, not voip2 - is something missing or wrong?

host=voip2.freephoneline.ca
fromdomain=voip2.freephoneline.ca

the SIP exchange shows a server/identity mismatch: the outbound INVITE goes to voip.freephoneline.ca, while the trunk identity still references voip2.freephoneline.ca.

Obviously, this needs to match the specific server used throughout the sip definition:
1613xxxxxxx:password@voip.freephoneline.ca/1613xxxxxxx

i have voip2 for host & fromname

In Registration Settings, add the register string if required:

1613xxxxxxx:password@voip2.freephoneline.ca/1613xxxxxxx

I may have missed it, but you only listed 3 out of the 5 spots to edit the domain name. I know you don't have Freepbx so you don't know where anything is, but I am using Freepbx.

In User Details, under the Incoming tab:
host=voip.freephoneline.ca
fromdomain=voip.freephoneline.ca

The registration field is also on the Incoming tab.
1613xxxxxxx:[email protected]/1613xxxxxxx

The PEER Data, under the Outgoing tab:
host=voip.freephoneline.ca
fromdomain=voip.freephoneline.ca

Note that host and fromdomain are defined on the incoming and outgoing tab while the register is only defined on the incoming tab.

None of the earlier responses indicated if both host and fromdomain were changed on both incoming and outgoing tabs or only changed on the outgoing tab you requested. So, did they correct 3 out of the 5 references or all 5 references?

It could also be that voip2 is not yet playing nicely (with all 5 references pointing to voip2) while voip will play nicely (with all 5 references pointing to voip) with the three additional fields added...and this may self resolve as the migration progresses for voip2.

I only tested that it now works on voip and did not also test if it will work on voip2.

[Liptonbrisk]

I know you don't have Freepbx so you don't know where anything is, but I am using Freepbx.

I have configured Freephoneline on FreePBX for someone years ago. I'm not using it currently and am certainly not familiar with the latest updates.

mkaye indicated using voip2.freephoneline.ca.
So, 1613xxxxxxx:[email protected]/1613xxxxxxx is correct, given the context, and would not be the source of the problem.

None of the earlier responses indicated if both host and fromdomain were changed on both incoming and outgoing tabs or only changed on the outgoing tab you requested. So, did they correct 3 out of the 5 references or all 5 references?

That's completely valid, and mkaye should check to ensure consistency everywhere.

It could also be that voip2 is not yet playing nicely

Without testing it's difficult to know, but that is possible.

[cba123]

I modified the pjsip in order to have it worked with FPL, the modification is on git asterisk and for sure will be included in the next release

chan_sip works fine
trying to convert to pjsip
can't seem to get the settings correct
created new pjsip trunk, incoming calls terminate after 30s
upgraded to Freepbx17/asterisk21 and let it convert all my chan_sip to pjsip - trunk won't register

Obviously, both @mkaye and I have not been able to get FPL to work properly using PJSIP and have still been using the deprecated Chan_SIP since @ilneofita made the PJSIP patch, and would love to migrate our FPL trunk over to PJSIP, and @ilneofita happen to come back today to advise of a change needed for PJSIP configuration because of today's migration, and helped us find the specific fix needed for the Chan_SIP configuration.

While Asterisk will now work with FPL using PJSIP, there must be a PJSIP setting that is needed for FPL that is not exposed and set via the Freepbx GUI, and will likely need a custom conf override.

Hopefully @ilneofita will stay online to help us figure out the PJSIP configuration under FreePBX.

But, if I do get it to work with PJSIP, I don't know if the following unresolved issue is going to impact me as I use an IVR on my inbound calls from FPL requiring an extension number to be selected via DTMF tones. FPL seems to not like to follow standards wrt PBX setups.

https://community.asterisk.org/t/freeph ... /110519/15

[mkaye]

all 5 places were changed to voip2

[cba123]

Mine stopped working again this morning.
I just received another 403 Forbidden on voip.freephoneline.ca.

I changed all 5 settings to voip2.freephoneline.ca, and it worked again.

So, not sure what is going on and how the platform migration is impacting our PBX.

[mkaye]

just flipped back to my primary freepbx server
checked everything was voip2
working at the moment!!