Ims calling failed for tcp syn failure in PCSCF

[lglhust]

ims-reg-fail.zip

@herlesupreeth

I use kamailio v5.3.2, the lte ue sends ims register to pcscf. After 401 Unauthorized , UE send register to pcscf with authentication response .
But it seemed pcscf not sending

the message to icscf, i don't know why.
The attached is the pacp and log.

Thanks a lot.

[lglhust]

I cannot find the log about the register message of CSeq: 53419 REGISTER, but it's in wireshark pcap file.
Does the message(ESP/udp/sip) is discarded by pcscf ? I guess the Encapsulation of register is not accept by pcscf.
But i haven't find the cause.

[herlesupreeth]

I would suggest checking the SIM details entered in pyHSS i.e. whether Ki, OP/OPc is correct. If they are incorrect the following can happen

1. IPSec tunnel incorrectly setup resulting in ESP packets not getting decoded
2. SIP registration fails

Also, ensure that your SIP client supports Digest AKAv1-MD5 authentication algorithm

[lglhust]

@herlesupreeth
Thanks. Register is ok now, the cause is the ki parameter of volte authertication is not same with the HSS.
But the call is fail, "SIP/2.0 500 Server error on LIR select next S-CSCF".
I saw icscf sent LIR to HSS and HSS returned LIA with Result-Code: DIAMETER_SUCCESS (2001),and with Server-Name of S-CSCF.

By the way, how to add time stamp to the logs when i use ''kamailio -f /etc/kamailio_pcscf/kamailio_pcscf.cfg -P /kamailio_pcscf.pid -DD -E -e" to run kamailio.

The attached is the pcap and log file.

call-500error.zip

Thanks very much.

[lglhust]

From pcscf log， i found the cause：

85(1916510) ERROR: <script>: request sent to sip:460091328205001@172.10.0.13:32468 completed with code: 408, Type 2
85(1916510) DEBUG: htable [ht_var.c:89]: pv_set_ht_cell(): set value for $sht(natpingfail=>sip:172.10.0.13:32468;transport=tcp)
85(1916510) ERROR: <script>: request sent to sip:460091328205001@172.10.0.13:32468: Fail Counter is 1

Although the caller sent invite over udp, but when pcscf tried to send invite to the callee over TCP, the tcp syn was fail.
I don't why PCSCF must use tcp instead of using UDP when dealing with calling?

I guess the length of invite to the callee is over the MTU, so the pcscf try to use TCP. Right?

[herlesupreeth]

@lglhust Here are couple of observations

"SIP/2.0 500 Server error on LIR select next S-CSCF".

This happens if a request is not being forwarded to S-CSCF due to lack to connectivity to S-CSCF or S-CSCF is not present

In your pcap, I dont see the 2 UEs sending SIP SUBSCRIBE with the IMPU (P-Associated-URI) sent in 200 OK. This is required for calling to be successful.

[lglhust]

@herlesupreeth

I tried call again using the newest kamailio-docker version. Version: kamailio 6.1.0-dev1 (x86_64/linux) 1f022a
Steps:

1. the caller and callee were all ims registered
2. the caller send sip invite to the callee
3. icscf and scscf found the callee, then pcscf try to connect the callee

Expected behaviour
pcscf sends tcp syn to the callee from security port and with esp encapsulation, and the tcp connection is setup successfully to send invite to the callee.

Observed Behaviour
pcscf sent tcp syn to the callee not from security port, but from port 5060 and without esp encapsulation. So when the callee returned tcp syn,ack in esp and security port , pcscf seemed to discard it.

Related logs:
[2025-10-11 14:04:27] 3(227200) DEBUG: [core/resolve.c:1282]: srv_sip_resolvehost(): 172.10.0.91:32468 proto=0
[2025-10-11 14:04:27] 3(227200) DEBUG: [core/resolve.c:1399]: srv_sip_resolvehost(): returning 0x55a873d31960 (172.10.0.91:32468 proto=1)
[2025-10-11 14:04:27] 3(227200) DEBUG: [core/msg_translator.c:1888]: check_boundaries(): no multi-part body
[2025-10-11 14:04:27] 3(227200) DEBUG: [core/msg_translator.c:164]: check_via_address(): (192.168.12.195, 192.168.12.195, 0)
[2025-10-11 14:04:27] 3(227200) DEBUG: [core/tcp_main.c:2183]: tcp_send(): no open tcp connection found, opening new one
[2025-10-11 14:04:27] 3(227200) DEBUG: [core/ip_addr.c:624]: print_ip(): tcpconn_new: new tcp connection: 172.10.0.91
[2025-10-11 14:04:27] 3(227200) DEBUG: [core/tcp_main.c:1264]: tcpconn_new(): on port 32468, type 2, socket -1
[2025-10-11 14:04:27] 3(227200) DEBUG: [core/tcp_main.c:1661]: tcpconn_add(): hashes: 2379:0:0, 102
[2025-10-11 14:04:27] 3(227200) DEBUG: [core/tcp_main.c:371]: init_sock_opt(): Set TCP_USER_TIMEOUT=10000 ms
[2025-10-11 14:04:27] 3(227200) DEBUG: [core/tcp_main.c:3078]: tcpconn_1st_send(): pending write on new connection 0x7f46fce752f0 sock 32 (-1/1810 bytes written) (err: 11 - Resource temporarily unavailable)
[2025-10-11 14:04:27] 109(227409) DEBUG: [core/tcp_main.c:4068]: handle_ser_child(): read response= 7f46fce752f0, 5, fd 171 from 3 (227200)
[2025-10-11 14:04:27] 109(227409) DEBUG: [core/io_wait.h:368]: io_watch_add(): processing io_watch_add(0x55a873d4e4c0, 171, 2, 0x7f46fce752f0) - fd_no=137

But when pcscf want to send options to the callee, it send tcp syn in the esp mode, it was the right way :

I am not clear with the code and function call stack, is it a bug?
I cannot find the cause . Please help me , thanks very much.

call-tcp-syn-fail.zip

[herlesupreeth]

@lglhust I see the below logs. So technically, the INVITE should have reach UE via IPSec tunnels unless you have incorrect IPSec configuration in your P-CSCF. Can you please check whether you have the same configuration as found in this repo for your P-CSCF?

[2025-10-11 14:04:27]  3(227200) DEBUG: <core> [core/resolve.c:1399]: srv_sip_resolvehost(): returning 0x55a873d31960 (172.10.0.91:32468 proto=1)
[2025-10-11 14:04:27]  3(227200) DEBUG: ims_ipsec_pcscf [cmd.c:1246]: ipsec_forward(): Destination changed to [1://sip:172.10.0.91:32468], from [1:5101]

kamailio-docker version

You mean the docker built by kamailio repo and not the one from this repo?

[lglhust]

I am using the newest kamailio repo in docker,but i use the kamailio_pcscf.cfg in previous version.
I compared the kamailio_pcscf.cfg i currently used with the one in the docker, i found no critical difference about dealing the call for the callee. The main difference is "WITH_N5", when using lte, it's not necessary.

Does i need to add the imperative operation such as the following in the configure file to deal with MT invite? Why doesn't the security pattern apply to pcscf as default?

route[REQINIT] {
... ...

if (is_method("INVITE") && search("Record-Route", "pcscf.ims.mnc")) {
route(MT_INVITE);
exit;
}
... ...
}

route[MT_INVITE] {
xlog("L_INFO", "Handling MT INVITE for $ru\n");
if (!lookup("location")) {
sl_send_reply("404", "User Not Found");
exit;
}
if (!ipsec_forward("location")) {
xlog("L_ERR", "ipsec_forward failed for MT INVITE\n");
sl_send_reply("500", "IPSec Forward Failed");
exit;
}
if (!t_relay()) {
sl_reply_error();
}
}

The attached is previous version.
kamailio_pcscf.zip