Home / server / Questions / 387852
Accepted
brownian
Asked: 2012-05-11 02:04:01 +0800 CST

Asterisk: Authenticated SIP trunk

  • 772

Let's say I have an Asterisk system with a bunch of connections: there are phones (who register itself with *) and providers (who wish to establish SIP trunks to put a lot of calls over, with different Caller IDs).

Here is my vision about how calls should be placed over an authenticated SIP trunk: remote end of SIP trunk should send INVITE's with From field set to it's identity (username for authentication) and Contact field set to what should be Caller ID for this call.

Is that true?

Why I believe this should be true: now, I can not specify username/secret and host=<IP> -- for remote end to register I need to say host=dynamic. So, I can setup "pseudo-trunk" as a bunch of extensions, or I need to setup trunk with host and no authentication. No authentication is bad.

So, is the above true? And will asterisk match peers by looking at From field and use Caller ID from Contact field?

If that is not true --- how an authenticated SIP trunk should work?

Thanks!

authentication asterisk sip

2 Answers

  1. Read "asterisk the future of telephony" o'rellys book

    it have all sip protocol nice described.

    your qestion can be solved as

    host=dynamic
defaultip=ip_of_other_side
deny=0.0.0.0/0.0.0.0
permit=ip_of_other_side/255.255.255.255

    or

    host=

    on both side and no register string

    http://www.voip-info.org/wiki/view/Asterisk+config+sip.conf

    • 0
  2. Best Answer

    So, the above (about From and Contact) may be true, but not required to be true. Will it work or not may depend on actual peers sonfigurations.

    When * receives INVITE request with "wild" From (a number that is "not assigned" to any peer), it responses with Unauthorized, adding authentication header with no any username field (in contrast: when * receives INVITE with a "valid" peer name in From, so it can match peer for incoming call, it includes username in authentication header).

    This response should be enough to authenticate: the client sends "the same" INVITE with the same From and Contact, and with Authorization header with a valid username field. Asterisk then matches incoming peer on given username value.

    Actually, any phone can behave like this; so there is no distinct difference between "SIP phone" and "SIP peer" in SIP. RFC 3261 does not contain a single "trunk" word.

    ps. Please, if someone will explain things better, I will be glad (and, for sure, accept better answer).

    • 0