June 2026 - sr-users - kamailio.org

6.0.5 Teams Direct Routing SBC: inbound 400 cause=95 + outbound 2xx ACK not completing (dual-transport TLS/UDP record_route_preset)
by George Hanousek 08 Jul '26

08 Jul '26

Hello, Kamailio 6.0.5 (distro packages) on Ubuntu 26.04 as an SBC between Microsoft Teams Direct Routing (TLS/5061) and Twilio Elastic SIP Trunking (UDP/5060), RTPEngine 13.5.1 bridging SRTP<->RTP (userspace, table=-1). Outbound (Teams->Twilio) negotiates fully and rings; two symptoms remain that I suspect share a Record-Route / dual-transport root. ENVIRONMENT - SBC FQDN sbc.ms-teams-dev.intiveo.com - Public IP 108.132.63.71 (UDP/TCP 5060 to Twilio) - Private IP 10.0.0.164 (TLS 5061 to Teams, advertised as FQDN) - TLS 1.2, LetsEncrypt cert + custom CA bundle (outbound TLS to sip.pstnhub.microsoft.com validates fine; calls reach Teams) - listen=udp:10.0.0.164:5060 advertise 108.132.63.71:5060 - listen=tcp:10.0.0.164:5060 advertise 108.132.63.71:5060 - listen=tls:10.0.0.164:5061 advertise sbc.ms-teams-dev.intiveo.com:5061 SYMPTOM 1 - OUTBOUND (Teams->Twilio): rings, cannot be answered. On answer, Twilio's 200 OK retransmits every 4s and is never confirmed; the ACK from Teams does not complete back to Twilio. The outbound INVITE to Twilio leaves over UDP from the public IP, but the first inserted Record-Route is transport=tls: Record-Route: <sip:sbc.ms-teams-dev.intiveo.com:5061 ;transport=tls;ftag=...;lr=on> Record-Route: <sip:10.0.0.164:5060;ftag=...;lr=on> sngrep of the outbound call (Teams answered ~09:19:48): INVITE (SDP) 10.0.0.164:5060 -> 54.172.60.3:5060 100 trying <- 183 Session prog. <- (rings) 200 OK (SDP) <- (answered) INVITE (SDP) -> (re-INVITE/ACK path) 200 OK <- 100 trying <- 200 OK (SDP) <- 183 Session prog. <- 200 OK (SDP) <- } 200 OK repeats every ~4s, never ACKed 200 OK (SDP) <- } CANCEL -> 200 canceling <- 487 Request Term. <- ACK -> SYMPTOM 2 - INBOUND (Twilio->Teams): the forwarded INVITE reaches Teams over TLS, and Teams returns: SIP/2.0 400 Bad Request Reason: Q.850;cause=95;text="Invalid unknown header: Cannot add a parameter known to SipUri as a generic parameter" The Teams client never rings. I have tried removing a hand-built Contact header and setting uac restore_mode=none; neither changed the cause=95. QUESTIONS 1. With one UDP listen (public IP) and one TLS listen (private IP, advertised FQDN), is record_route_preset() the correct approach, or does the dual-transport case need record_route() with per-leg handling so the 2xx ACK bridges TLS->UDP? Is the transport=tls on the first RR entry causing the ACK to come back on the wrong leg? 2. For the inbound cause=95, which header/parameter is Teams objecting to with this config? FULL kamailio.cfg BELOW: #!KAMAILIO #!define WITH_TLS #!substdef "!MY_PUB_IP!108.132.63.71!g" #!substdef "!MY_PRIV_IP!10.0.0.164!g" #!substdef "!MY_FQDN!sbc.ms-teams-dev.intiveo.com!g" #!substdef "!TWILIO_TRUNK!intiveo-ms-teams-dev.pstn.twilio.com!g" debug=2 log_stderror=no fork=yes children=2 auto_aliases=no listen=udp:MY_PRIV_IP:5060 advertise MY_PUB_IP:5060 listen=tcp:MY_PRIV_IP:5060 advertise MY_PUB_IP:5060 listen=tls:MY_PRIV_IP:5061 advertise MY_FQDN:5061 enable_tls=yes tcp_connection_lifetime=3605 tls_max_connections=2048 loadmodule "tm.so" loadmodule "sl.so" loadmodule "rr.so" loadmodule "pv.so" loadmodule "maxfwd.so" loadmodule "textops.so" loadmodule "textopsx.so" loadmodule "siputils.so" loadmodule "xlog.so" loadmodule "sanity.so" loadmodule "ctl.so" loadmodule "kex.so" loadmodule "corex.so" loadmodule "tls.so" loadmodule "rtpengine.so" loadmodule "uac.so" loadmodule "dispatcher.so" modparam("tls", "config", "/etc/kamailio/tls.cfg") modparam("rtpengine", "rtpengine_sock", "udp:127.0.0.1:2223") modparam("rr", "enable_full_lr", 1) modparam("rr", "append_fromtag", 1) modparam("uac", "restore_mode", "none") modparam("dispatcher", "list_file", "/etc/kamailio/dispatcher.list") modparam("dispatcher", "ds_ping_interval", 30) modparam("dispatcher", "ds_ping_method", "OPTIONS") modparam("dispatcher", "ds_probing_threshold", 3) modparam("dispatcher", "ds_inactive_threshold", 3) modparam("dispatcher", "ds_probing_mode", 1) request_route { if (!($si=="54.172.60.0" || $si=="54.172.60.1" || $si=="54.172.60.2" || $si=="54.172.60.3" || $si =~ "^52\.11[2-5]\." || $si =~ "^52\.12[0-3]\.")) { xlog("L_WARN","Drop SIP from untrusted $si\n"); sl_send_reply("403","Forbidden"); exit; } if (!mf_process_maxfwd_header("10")) { sl_send_reply("483","Too Many Hops"); exit; } if (has_totag()) { if (loose_route()) { route(RELAY); exit; } sl_send_reply("404","Not Here"); exit; } if (is_method("ACK")) { if (t_check_trans()) { route(RELAY); } exit; } if (is_method("CANCEL")) { if (t_check_trans()) { route(RELAY); } exit; } if (is_method("OPTIONS")) { sl_send_reply("200","OK"); exit; } if (!is_method("INVITE")) { sl_send_reply("405","Method Not Allowed"); exit; } record_route_preset("sbc.ms-teams-dev.intiveo.com:5061;transport=tls", " 10.0.0.164:5060"); if ($si =~ "^52\.11[2-5]\." || $si =~ "^52\.12[0-3]\.") { route(TO_TWILIO); } else { route(TO_TEAMS); } exit; } route[TO_TWILIO] { rtpengine_manage("replace-origin replace-session-connection RTP"); sethostport("intiveo-ms-teams-dev.pstn.twilio.com:5060"); $du = "sip:TWILIO_TRUNK:5060;transport=udp"; route(RELAY); } route[TO_TEAMS] { rtpengine_manage("replace-origin replace-session-connection SRTP"); sethostport("sip.pstnhub.microsoft.com:5061"); uac_replace_from("sip:$fU@MY_FQDN"); $du = "sip:sip.pstnhub.microsoft.com:5061;transport=tls"; t_on_failure("TEAMS_FAILOVER"); route(RELAY); } route[RELAY] { if (is_method("INVITE")) { t_on_reply("MANAGE_REPLY"); } if (!t_relay()) { sl_reply_error(); } exit; } failure_route[TEAMS_FAILOVER] { if (t_is_canceled()) { exit; } if (t_check_status("503|408") || t_branch_timeout()) { if ($avp(tdc) == $null) { $avp(tdc) = 1; $du = "sip:sip2.pstnhub.microsoft.com:5061;transport=tls"; t_on_failure("TEAMS_FAILOVER"); t_relay(); exit; } else if ($avp(tdc) == 1) { $avp(tdc) = 2; $du = "sip:sip3.pstnhub.microsoft.com:5061;transport=tls"; t_relay(); exit; } } } onreply_route[MANAGE_REPLY] { if (status =~ "[12][0-9][0-9]") { rtpengine_manage(); } } event_route[tm:local-request] { if (is_method("OPTIONS") && $ru =~ "pstnhub.microsoft.com") { append_hf("Contact: <sip:sbc.ms-teams-dev.intiveo.com:5061 ;transport=tls>\r\n"); } } (tls.cfg uses method=TLSv1.2, server+client sections both with the LetsEncrypt cert/key and a custom CA bundle including DigiCert Global Root CA. dispatcher.list has the three pstnhub proxies, setid 1, with socket=tls:10.0.0.164:5061;ping_from=sip:sbc.ms-teams-dev.intiveo.com.) Thanks for any pointers. George

3 5

TLS/SRTP
by asma.bouddyach＠intelcia.com 01 Jul '26

01 Jul '26

Hi all, My Kamailio SBC (in front of 3CX,) currently runs SIP in clear text, no SRTP. Security is mainly IP-based ACLs: if ($si == PBX_IP) { route(FROM_PBX); if ($si == ITSP_IP_IN || $si == ITSP_IP_OUT) { route(FROM_ITSP); What are the concrete risks of staying without TLS/SRTP in this setup, and would you still recommend encryption given these ACLs already in place? Thanks, Asmaa BOUDDYACH

5 4

Vulnerability Reporting and Resolution Process for Kamailio
by Chandramouli P 30 Jun '26

30 Jun '26

Dear Mr. Daniel, I hope this email finds you well. We have successfully deployed the Kamailio framework in our production environment, and it has been instrumental in helping us meet our operational requirements. We truly appreciate the robustness and flexibility that Kamailio offers. As part of our organization's security policies, we conduct periodic software scans using industry-standard tools to identify potential vulnerabilities across our technology stack, including Kamailio. In this regard, I would like to understand the following: 1. If we identify any vulnerabilities in the Kamailio framework during our scans, is there a process through which these can be reported to the Kamailio development team for resolution? 2. Would such vulnerabilities be addressed and patched by the core team, or is there a community-driven process we should be aware of? 3. If there is a defined disclosure or escalation process (e.g., a security mailing list, issue tracker, or responsible disclosure policy), could you kindly point us to the relevant resource? Understanding this process will help us align our internal compliance requirements with the appropriate support channels and ensure we follow the correct procedure when reporting any findings. Thank you for your time, and I look forward to your guidance. Best regards, Chandramouli.

4 4

kamailio.org server maintenance on Tuesday, June 30, 2026
by Daniel-Constantin Mierla 30 Jun '26

30 Jun '26

Hello, there will be some maintenance work on the server that is running kamailio.org (hosting the website, html docs, wiki, mailing lists, ...) on Tuesday, June 30, 2026. Expect interruptions of the services during the day. Once the work is finished, an announcement will be sent to the lists. Cheers, Daniel -- Daniel-Constantin Mierla (@ asipto.com) twitter.com/miconda -- linkedin.com/in/miconda Kamailio Consultancy, Training and Development Services -- asipto.com

1 2

Kamailio /3CX
by asma.bouddyach＠intelcia.com 29 Jun '26

29 Jun '26

Hello everyone, Has anyone successfully deployed Kamailio together with 3CX in a production environment? More specifically, can Kamailio be used as a SIP proxy/SBC in front of a 3CX PBX? I would be interested in hearing about any real-world deployments, best practices, or challenges you encountered. Thank you!

4 4

Kamailio /3CX
by asma.bouddyach＠intelcia.com 29 Jun '26

29 Jun '26

Hello everyone, Has anyone successfully deployed Kamailio together with 3CX in a production environment? More specifically, can Kamailio be used as a SIP proxy/SBC in front of a 3CX PBX? I would be interested in hearing about any real-world deployments, best practices, or challenges you encountered. Thank you!

1 0

New to Kamailio community – questions about production readiness, security and support
by Asmaa BOUDDYACH 29 Jun '26

29 Jun '26

Hello Kamailio community, My name is Asmaa, I work as a project manager in the IT field. I am currently deploying Kamailio as an SBC in front of an IPBX system and I am looking to deepen my knowledge of the product, I would like to ask the community a few questions to help me validate my approach: 1.Production readiness: – Is Kamailio considered mature and stable enough for production environments, including medium and large deployments? Are there known limitations I should be aware of? 2.Security: – What are the recommended best practices for hardening a Kamailio instance? Are there official security guidelines or checklists available? How are CVEs and vulnerabilities handled and communicated to the community? 3.Patch management: How frequently are security patches and updates released? What is the recommended upgrade process to avoid service disruption in production? 4. Cloud environments :– Is Kamailio well-suited for cloud deployments (e.g. on-premise VM, AWS, Azure)? Are there specific considerations or known issues in virtualized or containerized environments? 5.Long-term support: – Is there a concept of LTS versions? How long are older branches maintained? 6.Cloud-hosted IPBX compatibility – Can Kamailio be used as an SBC in front of a cloud-hosted IPBX (e.g. hosted PBX, UCaaS platforms)? Are there any specific configurations or limitations to be aware of in this scenario? 7.Commercial support: – Are there trusted companies or partners offering professional support around Kamailio? I am aware that some of these questions may have answers already available in the documentation or wiki – any pointers to the right resources would also be very welcome. Thank you in advance for your time and help. Best regards, *Cordialement* *Asmaa BOUDDYACH* Team Leader – Déploiement- Exploitation- Coordination – Communications Unifiées -- *Cordialement* *Asmaa BOUDDYACH* Team Leader PBC – Déploiement- Exploitation- Coordination – Communications Unifiées Exécutive Réseau SI et Services \ Services \ Ligne de services Voix Communications unifiées et Relations clients SFR Business *Tél. **+33 (0) 1 87 64 78 13* [image: logos-signature-e-mail-sfrbusiness] -- This message and any of its attachments is intended solely for the addresses and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet cannot guarantee the integrity of this message. The INTELCIA Group shall (will) not therefore be liable for the message if modified. ——————————————— Ce message et toutes les pièces jointes sont établis à l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le détruire et d’en avertir immédiatement l’expéditeur. Toute utilisation de ce message non conforme à sa destination, toute diffusion ou toute publication, même partielle, est interdite, sauf autorisation expresse. L’internet ne permettant pas d’assurer l’intégrité de ce message, le groupe INTELCIA décline toute responsabilité au titre de ce message, dans l’hypothèse où il aurait été modifié.

2 1

New to Kamailio community – questions about production readiness, security and support
by asma.bouddyach＠intelcia.com 29 Jun '26

29 Jun '26

Hello Kamailio community, I am currently deploying Kamailio as an SBC in front of an IPBX system and I am looking to deepen my knowledge of the product, I would like to ask the community a few questions to help me validate my approach: 1.Production readiness: – Is Kamailio considered mature and stable enough for production environments, including medium and large deployments? Are there known limitations I should be aware of? 2.Security: – What are the recommended best practices for hardening a Kamailio instance? Are there official security guidelines or checklists available? How are CVEs and vulnerabilities handled and communicated to the community? 3.Patch management: How frequently are security patches and updates released? What is the recommended upgrade process to avoid service disruption in production? 4. Cloud environments :– Is Kamailio well-suited for cloud deployments (e.g. on-premise VM, AWS, Azure)? Are there specific considerations or known issues in virtualized or containerized environments? 5.Long-term support: – Is there a concept of LTS versions? How long are older branches maintained? 6.Cloud-hosted IPBX compatibility – Can Kamailio be used as an SBC in front of a cloud-hosted IPBX (e.g. hosted PBX, UCaaS platforms)? Are there any specific configurations or limitations to be aware of in this scenario? 7.Commercial support: – Are there trusted companies or partners offering professional support around Kamailio? I am aware that some of these questions may have answers already available in the documentation or wiki – any pointers to the right resources would also be very welcome. Thank you in advance for your time and help. Best regards, *Cordialement*

2 1

Re: New to Kamailio community – questions about production readiness, security and support
by airsay＠duck.com 29 Jun '26

29 Jun '26

1 0

generate almalinux RPM kamailio-secsipid
by frédéric Gaisnon 26 Jun '26

26 Jun '26

Hi, I've tried to build RPM kamailio 6.1.3 on almalinux 8. As I used secsipid i have added this in kamailio.spec: %package secsipid Summary: STIR/SHAKEN Group: %{PKGGROUP} Requires: kamailio = %ver %description secsipid This module implements secure SIP identity specifications - STIR (Secure Telephony Identity Revisited) and SHAKEN (Signature-based Handling of Asserted information using toKENs) IETF extensions for SIP (RFC8224, RFC8588), known together as STIR/SHAKEN. ... %build MODULES="\ ... secsipid \ secsipid_proc " ... %files secsipid %defattr(-,root,root) %doc %{_docdir}/kamailio/modules/README.secsipid %doc %{_docdir}/kamailio/modules/README.secsipid_proc %{_libdir}/kamailio/modules/secsipid.so %{_libdir}/kamailio/modules/secsipid_proc.so --------------------------------------------------------------------- I have also do: # Get and install the module: go get https://github.com/asipto/secsipidx cd $GOPATH/src/github.com/asipto/secsipidx/csecsipid/ make liba cp secsipid.h libsecsipid.h libsecsipid.a \ /path/to/kamailio/src/modules/secsipid_proc/ cd $GOPATH/src/github.com/asipto/secsipidx/ make make install But as libsecsipidx.so is not installed by any package I have dependencies problem. What is the way to genenerate all rpm and kamailio-secsipid for almalinux distribution please? Regards, Frédéric

2 1