This article describes the steps necessary to configure the SBC Edge with a SIP peer or with an Internet Telephony Service Provider (ITSP) that requires digest authentication with 401 Unauthorized challenge.
This document assumes that you have already created a Signaling Group and a SIP Server table for the ITSP.
The SBC Edge system must have the necessary licenses to make calls.
The configuration is comprised of three overall steps:
- Creating a Remote Authorization Table
- Assigning the Remote Authorization Table to the SIP Server Table
- Assigning the SIP Server Table to the Signaling Group for the ITSP
The call flow below depicts an outbound call from Lync to ITSP via Ribbon SBC 1000/2000.
- After the initial INVITE from the Mediation server, SBC Edge (UA) sends an INVITE request to the ITSP proxy server (UAS).
- SBC Edge then receives 100 Trying and then 401 Unauthorized request from the ITSP proxy server.
- SBC Edge, acting as a UA, then re-sends the request and authenticates itself by including an Authorization header field with the request.
- The Authorization field value consists of credentials containing the authentication information of the UA for the realm of the resource being requested as well as parameters required in support of authentication and replay protection.
- The Realm, Username and Password information are taken from the Remote Authorization Table entry based on the username that is provided by the realm provided by the UAS.
Call Debugging Trace
The SBC Edge debug log produced at Trace level will show the information that is used to compute the MD5 string used in the Authorization header: