Zone - IP Peer - CLI

authentication

Use this object to support local authentication autonomously on a per-IP trunk group basis in situations where an IP-PBX does not perform a registration and the service provider does not require/want registrations (see IP Trunk Group Authentication additional feature functionality).

• intChallengeResponse – Enable this flag on the ingress IP Peer to allow the SBC to reply to local authentication challenges autonomously. If this flag is disabled, the SBC will not reply to authentication challenges locally even if credentials are configured on the egress IP Trunk Group (IPTG).
  
  • disabled (default)
  • enabled
• incInternalCredentials– Enable this flag on the ingress IP Peer to allow egress IPTG authentication to be internally created using the authorization information in mid-dialogue without being challenged.
  • disabled (default)
  • enabled

NOTE: If intChallengeResponse is disabled, incInternalCredentials is not used.

NOTE: If IPTG authentication is configured for both ingress IPTG and IP Peer, the IP Peer configuration takes precedence. If you wish to use the flags configured on IPTG, the IP Peer must not be present in the configurations. Otherwise, the IP Peer flags default to 'disabled' state and take precedence over IPTG flags.

Set flag to “true” to use this peer for the ipAddress and ephemeral port on ingress.

• false (default)
• true

Use this parameter to define Options ping settings. (See Path Check Parameters table below for details)

Use this parameter to specify policy parameters and profiles associated with this IP peer.

• description – IP peer policy description.
• ipSignalingProfile – The IP signaling profile name.
• packetServiceProfile – Packet service profile name. 
• sip – Use this parameter to specify SIP FQDN and FQDN port for IP peer policy.
  • fqdn <string> – The FQDN used to send egress calls or requests to this peer. (range: 1-63 characters).
  • fqdnPort – Specify the FQDN port. (range: 0-65535).

Use this parameter to specify the SIP endpoint CAC profile for the IP peer using .

• cacProfile – SIP endpoint CAC profile for the IP peer.

Use this parameter to configure the SBC to act as a surrogate registration entity between a non-registering IP PBX or SIP UA and REGISTRAR (which mandates registration) for this IP Peer. Do not use FQDN format when configuring a Surrogate Peer.

When configuring surrogate registration, be sure to set the expires value of ingress trunk group toward IAD to the maximum default value of “3600”.

(See Surrogate Registration Parameters table below for details.)

<TCP/UDP port number of the peer> (Default = 5060) – The peer's servers are pinged using SIP OPTIONS requests at this port. When the pathCheck profile is attached to an FQDN-based IP peer with hostPort set to 0, the pathCheck task performs SRV lookup to resolve the port numbers. The resolved port numbers are used to send OPTIONS ping to the IP peer. If FQDN-based IP peer is configured with a hostPort set to a value other than 0. the pathCheck task does not perform SRV lookups. It instead uses the configured port to send OPTIONS ping to the IP peer.

<profile name> – The Path Check profile name used when pinging this peer (OPTONS ping).

Use this flag to enable/disable active pinging.

• disabled (default)`
• enabled

Enable this flag to provide Options-based status update support.

• • disabled (default)
  • enabled

NOTE: If ipAddress/ipPort is configured and pathCheck needs to be enabled for that ipAddress/ipPort, ensure hostName/hostPort is not configured.

NOTE: Status updates only apply when new calls are sent to a peer. They do not impact messages belonging to existing calls or new calls received from the peer.

NOTE:  If regAuthPassword contains ASCII characters, enclose the entire password string with " " (double quotes).

% set addressContext default zone ZONE1 ipPeer basu surrogateRegistration userPart 452613 regAuthPassword "1234567890123456789012340\!$$@#$!@#!@#!@#" 

NOTE: "Field Service" and "Guest" users do not have access to regAuthPassword field.

Use this parameter to control how credentials are sent on receiving a challenge from AS for methods REGISTER, INVITE,PRACK, REINVITE, UPDATE and BYE.

• challengeForAnyMessage – The SBC sends credentials for REGISTER, INVITE, PRACK, UPDATE, REINVITE and BYE when these messages are challenged.
• challengeForAnyMessageAndInDialogRequests – The SBC sends credentials for REGISTER, INVITE, PRACK, UPDATE, REINVITE and BYE when these messages are challenged. The SBC also sends credentials by default as per last challenge in the in-dialog requests such as PRACK, UPDATE, REINVITE and BYE when any one of these methods is challenged earlier in the call.
• challengeForRegister  (default) – The SBC sends credentials only for REGISTER when challenged. Challenges for any other messages are returned to the IP-PBX.

Use this flag to disable/enable surrogate registration on IP peer.

• disabled (default)

• enabled

Use this flag to control the sending of registration retries when a REGISTER with credentials is challenged (with stale ≠ true and realm is identical to previous realm received). When stale = true or realm is not identical to previous realm received, the SBC immediately sends REGISTER.

• disabled (default) – Send REGISTER when a 401 or 407 in response to REGISTER with credentials is received.
• enabled – Do not attempt to send REGISTER after receiving a 401 or 407 response.

Enable this flag to use the next available pilot number to resend the INVITE.

• disabled (default)

• enabled
  

NOTE: If using this flag, be sure to configure Crankback profile for 4xx (403) response (refer to Crankback Profile - CLI page for details). 

Enable this flag to use the configured userName in surrogateRegistraion as userName in the outgoing INVITE.

• disabled (default)
• enabled
  

NOTE: Because this flag sends PAI in outgoing INVITE, the includePrivacy flag must be disabled (refer to Egress IP Attributes - SIP - CLI page to disable flag).

<userpart identity> – User part name for the IP-PBX/SIP UA for which surrogate registration is being enabled. This is a mandatory parameter. Any character in ABNF format is allowed except a semi-colon ( ; ).

NOTE: Refresh REGISTER and De-REGISTER are always sent without credentials. If such a REGISTER is challenged, then SBC responds with a new REGISTER with credentials.

NOTE: The SBC mirrors the credentials to the standby of an HA System. If the sendCredentials is set to 'challengeForAnyMessageAndInDialogRequests', upon a switchover the SBC can send in-dialog requests such as REINVITE/UPDATE/BYE with credentials.