Q.850 cause 21 (Call rejected): what it means

Short answer: Q.850 cause 21 (Call rejected) means the equipment that cleared the call refused it, although it was neither busy nor incompatible. The rejection can come from the user or from the network. On SIP trunks it is common after an authentication failure, an IP that is not allowed, or a caller number that is not accepted. Check the credentials and the A number sent.

How Monitor treats cause 21

When the carrier gives the Q.850 cause in the Reason header of the SIP response, Monitor keeps it beside the SIP code on every test call, and it appears in the incident's evidence, ready for the ticket with the carrier. On the English screens, cause 21 reads: the call was rejected.

Like any failure, a test call read as Down is repeated 3 times, every 2 minutes, and only 4 failures in a row open an incident.

What does cause 21 mean in practice?

Q.850 cause 21, Call rejected, means the equipment sending the cause does not want to accept the call, even though it could, because it is neither busy nor incompatible. The rejection can come from the user or from the network, through blocking rules. Under RFC 3398 (section 7.2.4.1), cause 21 becomes SIP 403 Forbidden; if the cause’s location is the user, the gateway may send SIP 603 Decline. In the other direction, 401, 402, 403, 407 and 603 map back to 21, which explains why authentication errors show up as rejected calls on the PBX. The cause arrives in the ISUP REL, the ISDN DISCONNECT or a Reason: Q.850;cause=21 (RFC 6432). In Asterisk, ${HANGUPCAUSE} is set to 21, and the CDR shows hangupcause 21 when the field is recorded.

When it appears

• A wrong trunk password or username, or an expired registration: a 401 or 407 without re-authentication becomes 21.
• Your PBX’s IP address not allowed by the carrier, which responds 403.
• A caller number (From or P-Asserted-Identity) that does not belong to the contracted trunk.
• A destination that blocks calls, such as a block list or a restriction on anonymous calls.
• Destinations outside the plan, such as international numbers, when the carrier responds 403 instead of 404.
• A person on a mobile phone who rejects the call, on networks that use 21 in that case.

How to diagnose it

1. Look at the original SIP response in sngrep: 401 or 407 points to authentication, 403 to permissions, 603 to a refusal by the destination.
2. Check pjsip show registrations (or sip show registry in chan_sip) and the trunk status in FreePBX, Issabel or 3CX.
3. Compare the A number sent in From and P-Asserted-Identity with the numbers in the contract.
4. Test another destination over the same trunk. If they all fail, it is the trunk; if only one fails, it is the destination.
5. Read the Warning or the Reason text: many carriers explain the reason for the rejection there.

What to send the carrier

• Date, time and time zone of the attempts.
• The A and B numbers exactly as they went out, including From and P-Asserted-Identity.
• The Call-ID and the SIP/2.0 403 Forbidden line (or 603), with the Reason and the Warning.
• The public IP address the call went out from.
• Whether the trunk was registered at the time of the failure.

Frequently asked questions

Why does a password error show up as cause 21?

Because RFC 3398 maps SIP 401 Unauthorized and 407 Proxy Authentication Required to Q.850 cause 21 when authentication is not successfully retried. The PBX or gateway, when it translates the rejection into telephony terms, shows a rejected call. The real cause is in the SIP response, so it pays to look at the signaling before blaming the destination.

What is the difference between 403 and 603 for cause 21?

RFC 3398 maps cause 21 to SIP 403 Forbidden by default. When the cause comes with the user location, meaning the destination itself refused, the gateway may use SIP 603 Decline. In practice, a 403 suggests a block by the network or the trunk, and a 603 suggests a refusal by the destination.