[FreePBX issue during call platform migration] 403 Forbidden

[Liptonbrisk]

Before I head off to deal with AC installation, I don't agree with the part of the A.I. assessment that appears to be ignoring that the outbound INVITE goes to voip.freephoneline.ca, while the trunk identity was referencing voip2.freephoneline.ca. "Porta [the switch/server vendor] recommended to Fibernetics [CLEC/network used by Fongo/Freephoneline] to enable Host Name Verification on Sip Registrations. This was enabled." -- Fongo admin

The trunk must present the same host name the provider expects in the SIP registration and related identity fields. That makes the voip vs. voip2 distinction matter, because a host-name mismatch might break call acceptance even when the account page shows connected (however, I haven't tested that).

Related thread: viewtopic.php?t=20920

“Temporarily clear or disable custom outbound caller ID on the trunk and test again”

That may be worth trying though since some have reported calls failing based on certain characters in outbound CID name being rejected.

[cba123]

I started having the same all circuits busy 403 Forbidden error message on my outgoing calls using FreePBX today as well.
I also tried to switch to use voip2.freephoneline.ca with the same error.
I am still using the legacy SIP channel running Freepbx 15/Asterisk 16.

As @ilneofita suggested, adding these 3 settings to the PEER Details on the Outgoing SIP setting fixed it for me.
a) authuser=1613xxxxxxx
b) fromuser=1613xxxxxxx
c) defaultuser=1613xxxxxxx

I changed all the settings back to use voip.freephoneline.ca instead of voip2.freephoneline.ca that I tested earlier today.

I am not sure if I used voip2.freephoneline.ca if it would also have caused the voip vs voip2 mismatch and continued 403 forbidden errors that mkaye experienced, but using voip.freephoneline.ca with the 3 additional PEER settings got my FPL trunks on Freepbx server working again.

[cba123]

I add the problem in my asterisk using pjsip
I solved adding in my _endpoint to force the authentication
outbound_auth=montreal_auth

Can you post your working pjsip configuration settings that you are currently using for FPL, as I haven't been able to get my FPL trunks working with pjsip on the latest Freepbx 17 / Asterisk 22, which is why I am still on the older versions using the deprecated sip channel.

Also, I don't see any field for outbound_auth under pjsip Settings Advanced, and don't know where _endpoint is located.

EDIT: I see in a separate response you indicated you don't use Freepbx and only use Asterisk, so can you post your specific Asterisk config files that were used so that I can manually try and figure out which settings are made via Freepbx GUI and if there are any additional settings not in the GUI that may need to go in a _custom configuration file.

[Liptonbrisk]

in your conf try to add
authuser=1613xxxxxxx

and if you didn't add these already, try too
fromuser=1613xxxxxxx
defaultuser=1613xxxxxxx

Sorry I don't use freepbx

Edit: you previous post too mask the number

Okay, @mkaye, maybe you can try this to see if it helps:

1) In the FreePBX GUI go to Connectivity --> Trunks --> select the chan_sip trunk for Freephoneline.

2. Under SIP Settings --> Outgoing (Peer Details), add these lines (replace with your real digits):

a) authuser=1613xxxxxxx

b) fromuser=1613xxxxxxx

c) defaultuser=1613xxxxxxx


authuser=1613xxxxxxx -- This is the username sent for authentication challenges (same as authuser in many ATA/peer examples).

fromuser=1613xxxxxxx -- This forces the SIP From: username (the identity FPL sees as the caller).

defaultuser=1613xxxxxxx -- This is used when host is not dynamic. It's often equivalent to the login name Asterisk uses when registering/outbound. Baiscally, it's the main user identity Asterisk assumes for that trunk when no specific value is being used.



2. In Registration Settings, add the register string if required:

1613xxxxxxx:[email protected]/1613xxxxxxx (only if your trunk uses registration; I think Freephoneline requires registration for outbound calls to work past 15 minutes)

3. Submit, and Apply Config.


4. Then either reload Asterisk or at the Asterisk CLI run this: sip reload


I'm guessing a bit.


Test an outbound call.

As @ilneofita suggested, adding these 3 settings to the PEER Details on the Outgoing SIP setting fixed it for me.
a) authuser=1613xxxxxxx
b) fromuser=1613xxxxxxx
c) defaultuser=1613xxxxxxx

I changed all the settings back to use voip.freephoneline.ca instead of voip2.freephoneline.ca that I tested earlier today.

I am not sure if I used voip2.freephoneline.ca if it would also have caused the voip vs voip2 mismatch and continued 403 forbidden errors that mkaye experienced, but using voip.freephoneline.ca with the 3 additional PEER settings got my FPL trunks on Freepbx server working again.

Thanks for letting us know. mkaye indicated this:

added these - still fails

2. Under SIP Settings --> Outgoing (Peer Details), add these lines (replace with your real digits):

a) authuser=1613xxxxxxx

b) fromuser=1613xxxxxxx

c) defaultuser=1613xxxxxxx

Anyway, I would try making the FreePBX trunk use one Freephoneline host name consistently everywhere and set authuser, fromuser, and defaultuser to the SIP username.

[cba123]

I think the voip vs voip2 mismatch and resulting failure may have been because @mkaye may have literally copied what you indicated in the instructions that used voip2 while all the rest of their settings were voip and only edited the masked values in this setting.

2. In Registration Settings, add the register string if required:

1613xxxxxxx:[email protected]/1613xxxxxxx (only if your trunk uses registration; I think Freephoneline requires registration for outbound calls to work past 15 minutes)

Obviously, this needs to match the specific server used throughout the sip definition:
1613xxxxxxx:[email protected]/1613xxxxxxx
1613xxxxxxx:[email protected]/1613xxxxxxx

In Freepbx, the server should be defined in 5 spots using the deprecated sip channel (all under Sip Settings):
In PEER Details, under the Outgoing tab:
host=voip.freephoneline.ca
fromdomain=voip.freephoneline.ca

In User Details, under Incoming tab:
host=voip.freephoneline.ca
fromdomain=voip.freephoneline.ca

In Register String, under Incoming tab:
1613xxxxxxx:[email protected]/1613xxxxxxx

[Liptonbrisk]

I think the voip vs voip2 mismatch and resulting failure may have been because @mkaye may have literally copied what you indicated in the instructions that used voip2 while all the rest of their settings were voip

Rather, mkaye was using voip2.freephoneline.ca since the beginning of this thread (because voip.freephoneline.ca stopped working for mkaye) and before I posted config instructions.

viewtopic.php?p=83223#p83223

started today - maybe last week on sone numbers - all numbers now
tried voip2

viewtopic.php?p=83228#p83228

this what i have used for years, except voip, not voip2 - is something missing or wrong?

host=voip2.freephoneline.ca
fromdomain=voip2.freephoneline.ca

the SIP exchange shows a server/identity mismatch: the outbound INVITE goes to voip.freephoneline.ca, while the trunk identity still references voip2.freephoneline.ca.

Obviously, this needs to match the specific server used throughout the sip definition:
1613xxxxxxx:password@voip.freephoneline.ca/1613xxxxxxx

i have voip2 for host & fromname

In Registration Settings, add the register string if required:

1613xxxxxxx:password@voip2.freephoneline.ca/1613xxxxxxx

[cba123]

I think the voip vs voip2 mismatch and resulting failure may have been because @mkaye may have literally copied what you indicated in the instructions that used voip2 while all the rest of their settings were voip

viewtopic.php?p=83223#p83223

started today - maybe last week on sone numbers - all numbers now
tried voip2

viewtopic.php?p=83228#p83228

this what i have used for years, except voip, not voip2 - is something missing or wrong?

host=voip2.freephoneline.ca
fromdomain=voip2.freephoneline.ca

the SIP exchange shows a server/identity mismatch: the outbound INVITE goes to voip.freephoneline.ca, while the trunk identity still references voip2.freephoneline.ca.

Obviously, this needs to match the specific server used throughout the sip definition:
1613xxxxxxx:password@voip.freephoneline.ca/1613xxxxxxx

i have voip2 for host & fromname

In Registration Settings, add the register string if required:

1613xxxxxxx:password@voip2.freephoneline.ca/1613xxxxxxx

I may have missed it, but you only listed 3 out of the 5 spots to edit the domain name. I know you don't have Freepbx so you don't know where anything is, but I am using Freepbx.

In User Details, under the Incoming tab:
host=voip.freephoneline.ca
fromdomain=voip.freephoneline.ca

The registration field is also on the Incoming tab.
1613xxxxxxx:[email protected]/1613xxxxxxx

The PEER Data, under the Outgoing tab:
host=voip.freephoneline.ca
fromdomain=voip.freephoneline.ca

Note that host and fromdomain are defined on the incoming and outgoing tab while the register is only defined on the incoming tab.

None of the earlier responses indicated if both host and fromdomain were changed on both incoming and outgoing tabs or only changed on the outgoing tab you requested. So, did they correct 3 out of the 5 references or all 5 references?

It could also be that voip2 is not yet playing nicely (with all 5 references pointing to voip2) while voip will play nicely (with all 5 references pointing to voip) with the three additional fields added...and this may self resolve as the migration progresses for voip2.

I only tested that it now works on voip and did not also test if it will work on voip2.

[Liptonbrisk]

I know you don't have Freepbx so you don't know where anything is, but I am using Freepbx.

I have configured Freephoneline on FreePBX for someone years ago. I'm not using it currently and am certainly not familiar with the latest updates.

mkaye indicated using voip2.freephoneline.ca in the first post in this thread (and afterwards).
I am familiar enough with FreePBX and Freephoneline to know that 1613xxxxxxx:[email protected]/1613xxxxxxx is correct, given the context, and would not be the source of the problem, while 1613xxxxxxx:[email protected]/1613xxxxxxx should be avoided.

None of the earlier responses indicated if both host and fromdomain were changed on both incoming and outgoing tabs or only changed on the outgoing tab you requested. So, did they correct 3 out of the 5 references or all 5 references?

That's completely valid, and mkaye should check to ensure consistency everywhere.

It could also be that voip2 is not yet playing nicely

Without testing it's difficult to know, but that is possible.

[cba123]

I modified the pjsip in order to have it worked with FPL, the modification is on git asterisk and for sure will be included in the next release

chan_sip works fine
trying to convert to pjsip
can't seem to get the settings correct
created new pjsip trunk, incoming calls terminate after 30s
upgraded to Freepbx17/asterisk21 and let it convert all my chan_sip to pjsip - trunk won't register

Obviously, both @mkaye and I have not been able to get FPL to work properly using PJSIP and have still been using the deprecated Chan_SIP since @ilneofita made the PJSIP patch, and would love to migrate our FPL trunk over to PJSIP, and @ilneofita happen to come back today to advise of a change needed for PJSIP configuration because of today's migration, and helped us find the specific fix needed for the Chan_SIP configuration.

While Asterisk will now work with FPL using PJSIP, there must be a PJSIP setting that is needed for FPL that is not exposed and set via the Freepbx GUI, and will likely need a custom conf override.

Hopefully @ilneofita will stay online to help us figure out the PJSIP configuration under FreePBX.

But, if I do get it to work with PJSIP, I don't know if the following unresolved issue is going to impact me as I use an IVR on my inbound calls from FPL requiring an extension number to be selected via DTMF tones. FPL seems to not like to follow standards wrt PBX setups.

https://community.asterisk.org/t/freeph ... /110519/15

[mkaye]

all 5 places were changed to voip2

[cba123]

Mine stopped working again this morning.
I just received another 403 Forbidden on voip.freephoneline.ca.

I changed all 5 settings to voip2.freephoneline.ca, and it worked again.

So, not sure what is going on and how the platform migration is impacting our PBX.

[mkaye]

just flipped back to my primary freepbx server
checked everything was voip2
working at the moment!!

[Liptonbrisk]

NUC1*CLI> sip show peer freephoneline

* Name : freephoneline

ToHost : voip.freephoneline.ca
Addr->IP : 162.213.111.25:5060

Reliably Transmitting (NAT) to 162.213.111.25:5060:
OPTIONS sip:voip.freephoneline.ca SIP/2.0
***

i see voip & voip2 - not sure why??

all 5 places were changed to voip2

So that wasn't the problem. Regardless, the earlier mismatch does not appear to reflect the final, working configuration.

just flipped back to my primary freepbx server
checked everything was voip2
working at the moment!!

Good.

If this happens again (if you ever encounter the same issue where settings don't reflect what's actually happening), after you've set all relevant fields to voip2.freephoneline.ca, yet you still see something similar to

"sip show peer freephoneline
ToHost : voip.freephoneline.ca
Addr->IP : 162.213.111.25:5060

Reliably Transmitting (NAT) to 162.213.111.25:5060:
OPTIONS sip:voip.freephoneline.ca SIP/2.0"

then follow these steps:

1. Confirm the server; then capture its current state before changing anything else.

Code: Select all

bash
hostname
asterisk -rx "sip show peer freephoneline"
asterisk -rx "sip show registry"

Since there's a primary and another FreePBX server involved, hostname should be the very first thing to check and record. That also prevents a correct configuration on one server from being confused with runtime output from the other.

The important point in that old CLI output is not just that ToHost shows voip.freephoneline.ca; the OPTIONS request was also being sent to 162.213.111.25:5060 with voip.freephoneline.ca in its SIP Request-URI. At that moment, the live chan_sip peer is still presenting voip.freephoneline.ca in its active SIP target.

The IP address is useful corroboration. In that capture, Asterisk was transmitting to 162.213.111.25:5060 while using voip.freephoneline.ca (162.213.111.25:5060 is voip.freephoneline.ca:5060 at this time) in the OPTIONS Request-URI. If you want to check DNS at the time, record these current responses too:

Code: Select all

bash
dig +short voip.freephoneline.ca
dig +short voip2.freephoneline.ca

A matching IP wouldn't remove the configuration mismatch. The live peer should still use the hostname actually configured for the trunk, since voip.freephoneline.ca and voip2.freephoneline.ca are treated as distinct SIP server names and their DNS targets may change independently.

A sip show peer dump shows the active runtime peer, but it doesn't identify why that peer still has the old hostname. The most plausible explanations are

- FreePBX did not successfully generate and/or load the revised configuration after the GUI edits,
- another generated, custom, or duplicate configuration entry still defines freephoneline with voip.freephoneline.ca,
- the generated config is correct, but the active chan_sip peer wasn't refreshed cleanly after reload, or
- the changes were made on one PBX but the CLI output came from the other server (see Step 1).

2. Before any reload or restart, search the actual Asterisk configuration on that same server.

Code: Select all

bash
grep -Rni --include='*.conf' 'voip\.freephoneline\.ca' /etc/asterisk
grep -Rni --include='*.conf' 'voip2\.freephoneline\.ca' /etc/asterisk

If a definition associated with this trunk still contains voip.freephoneline.ca, investigate that first. It may show Apply Config didn't fully regenerate the relevant file or that a custom include/duplicate trunk is overriding the GUI-generated definition.


3. If the files already show voip2.freephoneline.ca but the peer still doesn't, try a SIP reload.

Code: Select all

bash
asterisk -rx "sip reload"
asterisk -rx "sip show peer freephoneline"

4. If reload doesn't fix it, restart Asterisk and recheck.

Code: Select all

bash
asterisk -rx "core restart now"
asterisk -rx "sip show peer freephoneline"

If the restart changes ToHost from voip to voip2, that strongly implies the live peer hadn't been refreshed cleanly by the prior reload. Working through those steps in order (confirm the server, check the config files, reload, and then restart) means whichever step actually changes the output tells you the real cause. And if voip2.freephoneline.ca still won't stick after all four steps, it's worth posting the fresh sip show peer output alongside the grep results, so you're not troubleshooting from a stale trace. Lastly, registration status in FPL’s online portal should not be the only registration status relied on, since portal status can lag behind the live Asterisk state.

[mkaye]

i did most of my testing on my primary freepbx server
all 5 voip2 changes were made, forbidden 403
i only changed to my backup because i had updated the system files on it and i wanted to make sure this wasn't the issue
still got 403 with all 5 voip2 changes
something changed overnight in FPL land...

[Liptonbrisk]

all 5 voip2 changes were made . . .
something changed overnight in FPL land...

Yes, for the first 403 (and I mentioned leaning towards changes involving the call platform migration as being the cause in my original response to you in this thread), but that doesn't explain this mismatch while specifying voip2.freephoneline.ca:

"ToHost : voip.freephoneline.ca
Addr->IP : 162.213.111.25:5060

Reliably Transmitting (NAT) to 162.213.111.25:5060:
OPTIONS sip:voip.freephoneline.ca SIP/2.0"

"OPTIONS sip:voip.freephoneline.ca SIP/2.0" is the keep-alive/qualify traffic for the active chan_sip peer, and "ToHost : voip.freephoneline.ca" is the current peer target. Those values come from Asterisk’s active, local, peer state. That is a separate local mismatch, not a provider-side issue.

Again, the next time that happens (or something similar where settings don't reflect what's actually happening), I would follow those steps (confirm the server, check the generated config, reload, and then restart).