Hello,
I'm a new starter of Kamailio (SER). I am using the version 4.4.0-dev6 in a Debian machine. I've configured all the IMS network elements, the FHoSS and also Boghe IMS/RCS client in a Windows machine.
When an IMS user belonging to my network tries to register and IP SEC mechanism is enabled, the registration flow stops at 401 Unauthorized from S-CSCF -> I-CSCF -> P-CSCF -> client. The problem is that the HSS in MAA message does not send the SIP-Auth-Data-item that should be cointain the Confidentiality Key and the Integrity Key; so the client is not able to challenge the S-CSCF sending another REGISTER message.
Do you have any suggestions about this? When IP SEC is disabled (by managing client options), the registration works well. Maybe is there any configuration at HSS level that i'm not considering?
Thank you in advance for your help, Cristina
Hello,
maybe some other IMS guys are able to help more, but in general the authentication in handled in the configuration file of Kamailio by calling various auth functions. You have to spot where those are used and why is responding with 401. Eventually run it with debug=3 in kamailio.cfg to get more verbosity of what it is done in the code.
Also, it may help to check the emails from Franz Edler during January and February on this list, he provided configs and many details about building a prototype IMS platform. See next link and follow up discussion:
- http://lists.sip-router.org/pipermail/sr-users/2016-January/091204.html
Cheers, Daniel
On 03/02/16 11:58, Cristina Caridi wrote:
Hello,
I'm a new starter of Kamailio (SER). I am using the version 4.4.0-dev6 in a Debian machine. I've configured all the IMS network elements, the FHoSS and also Boghe IMS/RCS client in a Windows machine.
When an IMS user belonging to my network tries to register and IP SEC mechanism is enabled, the registration flow stops at 401 Unauthorized from S-CSCF -> I-CSCF -> P-CSCF -> client. The problem is that the HSS in MAA message does not send the SIP-Auth-Data-item that should be cointain the Confidentiality Key and the Integrity Key; so the client is not able to challenge the S-CSCF sending another REGISTER message.
Do you have any suggestions about this? When IP SEC is disabled (by managing client options), the registration works well. Maybe is there any configuration at HSS level that i'm not considering?
Thank you in advance for your help, Cristina
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
Hi Cristina,
Unfortunately IPSEC is not supported 100% on the P-CSCF at this time. There are pieces of code that exist for it but it is not something we focused on yet. Perhaps some of the other devs will get to it when they get the need or some spare time
Cheers Jason
On Thu, Feb 4, 2016 at 7:42 PM, Daniel-Constantin Mierla miconda@gmail.com wrote:
Hello,
maybe some other IMS guys are able to help more, but in general the authentication in handled in the configuration file of Kamailio by calling various auth functions. You have to spot where those are used and why is responding with 401. Eventually run it with debug=3 in kamailio.cfg to get more verbosity of what it is done in the code.
Also, it may help to check the emails from Franz Edler during January and February on this list, he provided configs and many details about building a prototype IMS platform. See next link and follow up discussion:
http://lists.sip-router.org/pipermail/sr-users/2016-January/091204.html
Cheers, Daniel
On 03/02/16 11:58, Cristina Caridi wrote:
Hello,
I'm a new starter of Kamailio (SER). I am using the version 4.4.0-dev6 in a Debian machine. I've configured all the IMS network elements, the FHoSS and also Boghe IMS/RCS client in a Windows machine.
When an IMS user belonging to my network tries to register and IP SEC mechanism is enabled, the registration flow stops at 401 Unauthorized from S-CSCF -> I-CSCF -> P-CSCF -> client. The problem is that the HSS in MAA message does not send the SIP-Auth-Data-item that should be cointain the Confidentiality Key and the Integrity Key; so the client is not able to challenge the S-CSCF sending another REGISTER message.
Do you have any suggestions about this? When IP SEC is disabled (by managing client options), the registration works well. Maybe is there any configuration at HSS level that i'm not considering?
Thank you in advance for your help, Cristina
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing listsr-users@lists.sip-router.orghttp://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
-- Daniel-Constantin Mierlahttp://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda Book: SIP Routing With Kamailio - http://www.asipto.comhttp://miconda.eu
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
Hello,
thank you for the responsive answer! Ok, I will skip IP SEC mechanism for the moment :)
But I have another problem related to registration process. After REGISTER-401 Unauthorized-REGISTER-200 OK, the IMS client sends the SUBSCRIBE message (for the "reg" event package subscription) to the S-CSCF, the latter replies with NOTIFY and the client correctly responds with 200 OK. In order to be notified on any change of registration state for the client, also the P-CSCF sends the SUBSCRIBE message to the S-CSCF, the S-CSCF sends a NOTIFY to the proxy but, instead of replying with 200 OK, the P-CSCF replies with 404-Not Here (like it doesn't recognize that the recipient of the NOTIFY in the Req-URI is the P-CSCF itself).
Have you ever seen similar issue? I've checked the S-CSCF database and it correctly contains the P-CSCF subscription. Can you suggest any workaround or I'm missing something?
Thank you for your support,
Cristina
2016-02-04 21:26 GMT+01:00 Jason Penton jason.penton@smilecoms.com:
Hi Cristina,
Unfortunately IPSEC is not supported 100% on the P-CSCF at this time. There are pieces of code that exist for it but it is not something we focused on yet. Perhaps some of the other devs will get to it when they get the need or some spare time
Cheers Jason
On Thu, Feb 4, 2016 at 7:42 PM, Daniel-Constantin Mierla < miconda@gmail.com> wrote:
Hello,
maybe some other IMS guys are able to help more, but in general the authentication in handled in the configuration file of Kamailio by calling various auth functions. You have to spot where those are used and why is responding with 401. Eventually run it with debug=3 in kamailio.cfg to get more verbosity of what it is done in the code.
Also, it may help to check the emails from Franz Edler during January and February on this list, he provided configs and many details about building a prototype IMS platform. See next link and follow up discussion:
http://lists.sip-router.org/pipermail/sr-users/2016-January/091204.html
Cheers, Daniel
On 03/02/16 11:58, Cristina Caridi wrote:
Hello,
I'm a new starter of Kamailio (SER). I am using the version 4.4.0-dev6 in a Debian machine. I've configured all the IMS network elements, the FHoSS and also Boghe IMS/RCS client in a Windows machine.
When an IMS user belonging to my network tries to register and IP SEC mechanism is enabled, the registration flow stops at 401 Unauthorized from S-CSCF -> I-CSCF -> P-CSCF -> client. The problem is that the HSS in MAA message does not send the SIP-Auth-Data-item that should be cointain the Confidentiality Key and the Integrity Key; so the client is not able to challenge the S-CSCF sending another REGISTER message.
Do you have any suggestions about this? When IP SEC is disabled (by managing client options), the registration works well. Maybe is there any configuration at HSS level that i'm not considering?
Thank you in advance for your help, Cristina
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing listsr-users@lists.sip-router.orghttp://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
-- Daniel-Constantin Mierlahttp://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda Book: SIP Routing With Kamailio - http://www.asipto.comhttp://miconda.eu
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
--
*Jason Penton* *Senior Manager: Applications and Services* *Smile Communications Pty (Ltd)* *Mobile:* +27 (0) 83 283 7000 *Skype:* jason.barry.penton jason.penton@smilecoms.com name.surname@smilecoms.com www.smilecoms.com
This email is subject to the disclaimer of Smile Communications at http://www.smilecoms.com/home/email-disclaimer/ http://www.smilecoms.com/disclaimer
Hello Cristina,
please add a tracefile of the registration generated with “tcpdump -i any -s 3000 -w /var/tmp/trace.pcap”.
BR
Franz
From: sr-users [mailto:sr-users-bounces@lists.sip-router.org] On Behalf Of Cristina Caridi Sent: Friday, February 5, 2016 9:26 AM To: Jason Penton jason.penton@smilecoms.com Cc: Kamailio (SER) - Users Mailing List sr-users@lists.sip-router.org Subject: Re: [SR-Users] Registration Failure - IMS
Hello,
thank you for the responsive answer!
Ok, I will skip IP SEC mechanism for the moment :)
But I have another problem related to registration process. After REGISTER-401 Unauthorized-REGISTER-200 OK, the IMS client sends the SUBSCRIBE message (for the "reg" event package subscription) to the S-CSCF, the latter replies with NOTIFY and the client correctly responds with 200 OK. In order to be notified on any change of registration state for the client, also the P-CSCF sends the SUBSCRIBE message to the S-CSCF, the S-CSCF sends a NOTIFY to the proxy but, instead of replying with 200 OK, the P-CSCF replies with 404-Not Here (like it doesn't recognize that the recipient of the NOTIFY in the Req-URI is the P-CSCF itself).
Have you ever seen similar issue?
I've checked the S-CSCF database and it correctly contains the P-CSCF subscription. Can you suggest any workaround or I'm missing something?
Thank you for your support,
Cristina
2016-02-04 21:26 GMT+01:00 Jason Penton <jason.penton@smilecoms.com mailto:jason.penton@smilecoms.com >:
Hi Cristina,
Unfortunately IPSEC is not supported 100% on the P-CSCF at this time. There are pieces of code that exist for it but it is not something we focused on yet. Perhaps some of the other devs will get to it when they get the need or some spare time
Cheers
Jason
On Thu, Feb 4, 2016 at 7:42 PM, Daniel-Constantin Mierla <miconda@gmail.com mailto:miconda@gmail.com > wrote:
Hello,
maybe some other IMS guys are able to help more, but in general the authentication in handled in the configuration file of Kamailio by calling various auth functions. You have to spot where those are used and why is responding with 401. Eventually run it with debug=3 in kamailio.cfg to get more verbosity of what it is done in the code.
Also, it may help to check the emails from Franz Edler during January and February on this list, he provided configs and many details about building a prototype IMS platform. See next link and follow up discussion:
- http://lists.sip-router.org/pipermail/sr-users/2016-January/091204.html
Cheers, Daniel
On 03/02/16 11:58, Cristina Caridi wrote:
Hello,
I'm a new starter of Kamailio (SER). I am using the version 4.4.0-dev6 in a Debian machine.
I've configured all the IMS network elements, the FHoSS and also Boghe IMS/RCS client in a Windows machine.
When an IMS user belonging to my network tries to register and IP SEC mechanism is enabled, the registration flow stops at 401 Unauthorized from S-CSCF -> I-CSCF -> P-CSCF -> client.
The problem is that the HSS in MAA message does not send the SIP-Auth-Data-item that should be cointain the Confidentiality Key and the Integrity Key; so the client is not able to challenge the S-CSCF sending another REGISTER message.
Do you have any suggestions about this? When IP SEC is disabled (by managing client options), the registration works well.
Maybe is there any configuration at HSS level that i'm not considering?
Thank you in advance for your help,
Cristina
_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org mailto:sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
Hello, do you have any suggestion on this?
Thank You, Cristina
---------- Forwarded message ---------- From: Cristina Caridi cri.caridi@gmail.com Date: 2016-02-05 9:26 GMT+01:00 Subject: Re: [SR-Users] Registration Failure - IMS To: Jason Penton jason.penton@smilecoms.com Cc: Daniel-Constantin Mierla miconda@gmail.com, "Kamailio (SER) - Users Mailing List" sr-users@lists.sip-router.org
Hello,
thank you for the responsive answer! Ok, I will skip IP SEC mechanism for the moment :)
But I have another problem related to registration process. After REGISTER-401 Unauthorized-REGISTER-200 OK, the IMS client sends the SUBSCRIBE message (for the "reg" event package subscription) to the S-CSCF, the latter replies with NOTIFY and the client correctly responds with 200 OK. In order to be notified on any change of registration state for the client, also the P-CSCF sends the SUBSCRIBE message to the S-CSCF, the S-CSCF sends a NOTIFY to the proxy but, instead of replying with 200 OK, the P-CSCF replies with 404-Not Here (like it doesn't recognize that the recipient of the NOTIFY in the Req-URI is the P-CSCF itself).
Have you ever seen similar issue? I've checked the S-CSCF database and it correctly contains the P-CSCF subscription. Can you suggest any workaround or I'm missing something?
Thank you for your support,
Cristina
2016-02-04 21:26 GMT+01:00 Jason Penton jason.penton@smilecoms.com:
Hi Cristina,
Unfortunately IPSEC is not supported 100% on the P-CSCF at this time. There are pieces of code that exist for it but it is not something we focused on yet. Perhaps some of the other devs will get to it when they get the need or some spare time
Cheers Jason
On Thu, Feb 4, 2016 at 7:42 PM, Daniel-Constantin Mierla < miconda@gmail.com> wrote:
Hello,
maybe some other IMS guys are able to help more, but in general the authentication in handled in the configuration file of Kamailio by calling various auth functions. You have to spot where those are used and why is responding with 401. Eventually run it with debug=3 in kamailio.cfg to get more verbosity of what it is done in the code.
Also, it may help to check the emails from Franz Edler during January and February on this list, he provided configs and many details about building a prototype IMS platform. See next link and follow up discussion:
http://lists.sip-router.org/pipermail/sr-users/2016-January/091204.html
Cheers, Daniel
On 03/02/16 11:58, Cristina Caridi wrote:
Hello,
I'm a new starter of Kamailio (SER). I am using the version 4.4.0-dev6 in a Debian machine. I've configured all the IMS network elements, the FHoSS and also Boghe IMS/RCS client in a Windows machine.
When an IMS user belonging to my network tries to register and IP SEC mechanism is enabled, the registration flow stops at 401 Unauthorized from S-CSCF -> I-CSCF -> P-CSCF -> client. The problem is that the HSS in MAA message does not send the SIP-Auth-Data-item that should be cointain the Confidentiality Key and the Integrity Key; so the client is not able to challenge the S-CSCF sending another REGISTER message.
Do you have any suggestions about this? When IP SEC is disabled (by managing client options), the registration works well. Maybe is there any configuration at HSS level that i'm not considering?
Thank you in advance for your help, Cristina
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing listsr-users@lists.sip-router.orghttp://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
-- Daniel-Constantin Mierlahttp://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda Book: SIP Routing With Kamailio - http://www.asipto.comhttp://miconda.eu
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
--
*Jason Penton* *Senior Manager: Applications and Services* *Smile Communications Pty (Ltd)* *Mobile:* +27 (0) 83 283 7000 *Skype:* jason.barry.penton jason.penton@smilecoms.com name.surname@smilecoms.com www.smilecoms.com
This email is subject to the disclaimer of Smile Communications at http://www.smilecoms.com/home/email-disclaimer/ http://www.smilecoms.com/disclaimer
Hello Franz,
sorry but I missed your previuos mail. In the attach you can find the trace of the registration.
Thank you, Cristina
2016-02-16 17:06 GMT+01:00 Cristina Caridi cri.caridi@gmail.com:
Hello, do you have any suggestion on this?
Thank You, Cristina
---------- Forwarded message ---------- From: Cristina Caridi cri.caridi@gmail.com Date: 2016-02-05 9:26 GMT+01:00 Subject: Re: [SR-Users] Registration Failure - IMS To: Jason Penton jason.penton@smilecoms.com Cc: Daniel-Constantin Mierla miconda@gmail.com, "Kamailio (SER) - Users Mailing List" sr-users@lists.sip-router.org
Hello,
thank you for the responsive answer! Ok, I will skip IP SEC mechanism for the moment :)
But I have another problem related to registration process. After REGISTER-401 Unauthorized-REGISTER-200 OK, the IMS client sends the SUBSCRIBE message (for the "reg" event package subscription) to the S-CSCF, the latter replies with NOTIFY and the client correctly responds with 200 OK. In order to be notified on any change of registration state for the client, also the P-CSCF sends the SUBSCRIBE message to the S-CSCF, the S-CSCF sends a NOTIFY to the proxy but, instead of replying with 200 OK, the P-CSCF replies with 404-Not Here (like it doesn't recognize that the recipient of the NOTIFY in the Req-URI is the P-CSCF itself).
Have you ever seen similar issue? I've checked the S-CSCF database and it correctly contains the P-CSCF subscription. Can you suggest any workaround or I'm missing something?
Thank you for your support,
Cristina
2016-02-04 21:26 GMT+01:00 Jason Penton jason.penton@smilecoms.com:
Hi Cristina,
Unfortunately IPSEC is not supported 100% on the P-CSCF at this time. There are pieces of code that exist for it but it is not something we focused on yet. Perhaps some of the other devs will get to it when they get the need or some spare time
Cheers Jason
On Thu, Feb 4, 2016 at 7:42 PM, Daniel-Constantin Mierla < miconda@gmail.com> wrote:
Hello,
maybe some other IMS guys are able to help more, but in general the authentication in handled in the configuration file of Kamailio by calling various auth functions. You have to spot where those are used and why is responding with 401. Eventually run it with debug=3 in kamailio.cfg to get more verbosity of what it is done in the code.
Also, it may help to check the emails from Franz Edler during January and February on this list, he provided configs and many details about building a prototype IMS platform. See next link and follow up discussion:
http://lists.sip-router.org/pipermail/sr-users/2016-January/091204.html
Cheers, Daniel
On 03/02/16 11:58, Cristina Caridi wrote:
Hello,
I'm a new starter of Kamailio (SER). I am using the version 4.4.0-dev6 in a Debian machine. I've configured all the IMS network elements, the FHoSS and also Boghe IMS/RCS client in a Windows machine.
When an IMS user belonging to my network tries to register and IP SEC mechanism is enabled, the registration flow stops at 401 Unauthorized from S-CSCF -> I-CSCF -> P-CSCF -> client. The problem is that the HSS in MAA message does not send the SIP-Auth-Data-item that should be cointain the Confidentiality Key and the Integrity Key; so the client is not able to challenge the S-CSCF sending another REGISTER message.
Do you have any suggestions about this? When IP SEC is disabled (by managing client options), the registration works well. Maybe is there any configuration at HSS level that i'm not considering?
Thank you in advance for your help, Cristina
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing listsr-users@lists.sip-router.orghttp://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
-- Daniel-Constantin Mierlahttp://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda Book: SIP Routing With Kamailio - http://www.asipto.comhttp://miconda.eu
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
--
*Jason Penton* *Senior Manager: Applications and Services* *Smile Communications Pty (Ltd)* *Mobile:* +27 (0) 83 283 7000 *Skype:* jason.barry.penton jason.penton@smilecoms.com name.surname@smilecoms.com www.smilecoms.com
This email is subject to the disclaimer of Smile Communications at http://www.smilecoms.com/home/email-disclaimer/ http://www.smilecoms.com/disclaimer
-
Cristina Caridi -
Daniel-Constantin Mierla -
Franz Edler -
Jason Penton