Q.850 cause 27 (Destination out of order): what it means

Short answer: Q.850 cause 27 (Destination out of order) means the destination cannot be reached because the interface to it is not working: a physical link down, a PBX switched off, or a customer trunk not responding. It is a real failure, common with 0800 numbers and IVRs that terminate on the company's own PBX. Check the destination's equipment and link.

How Monitor treats cause 27

When the carrier gives the Q.850 cause in the Reason header of the SIP response, Monitor keeps it beside the SIP code on every test call, and it appears in the incident's evidence, ready for the ticket with the carrier. On the English screens, cause 27 reads: the destination is out of order.

Cause 27 also decides how a SIP 480 is read, since on its own a 480 does not say whether the destination rang or nothing answered:

What should answer the number	SIP 480 with cause 27
A greeting or recorded message (the IVR)	Down
A test tone or echo service	Down
Other: it may ring or be answered	Down

Like any failure, a test call read as Down is repeated 3 times, every 2 minutes, and only 4 failures in a row open an incident.

What does cause 27 mean in practice?

Q.850 cause 27, Destination out of order, means the destination cannot be reached because the interface to it is not working properly. The signaling message could not be delivered to the remote user, for example because of a failure at the physical or data link layer, or because the user’s equipment is disconnected. Unlike the busy or absent causes, there is a real failure here. Under RFC 3398 (section 7.2.4.1), cause 27 becomes SIP 502 Bad Gateway. In the other direction, the same RFC maps 502 to cause 38, so the cause can change when it crosses two gateways. It arrives in the ISUP REL, the ISDN DISCONNECT and a Reason: Q.850;cause=27. In Asterisk, ${HANGUPCAUSE} is set to 27. In LTE, the “cause code 27” in ESM messages (Missing or unknown APN) has nothing to do with this cause.

When it appears

• The E1 on the customer’s PBX is in alarm or out of sync: the carrier’s switch sees the link as down.
• The SIP trunk between the carrier and the customer’s PBX is not responding (OPTIONS unanswered) and is marked out of service.
• The internet link at the customer’s site is down, for an 0800 number or an IVR that terminates on the local PBX.
• The PBX is switched off, restarting, or its SIP service has stopped.
• The customer’s firewall is blocking the carrier’s IP address after a rule change.

How to diagnose it

1. Confirm on the destination PBX that it is up and the service is running (core show uptime in Asterisk).
2. On an E1 through DAHDI, use dahdi show status to see alarms and pri show spans for the state of the D channel.
3. On a SIP trunk, check whether the carrier’s OPTIONS are arriving and being answered with 200 OK; in sngrep, filter by the OPTIONS method.
4. Test the site’s internet link and the firewall rules for the carrier’s signaling and media IP addresses.
5. In 3CX, check the trunk status on the dashboard and the Activity Log at the time of the failure.
6. If everything is up on your side, ask the carrier for the state of the circuit as seen from its switch.

What to send the carrier

• Date, time and time zone when the failure started, and whether it is still going on.
• The called number (for example, the 0800 number) and the A numbers used in the tests.
• The Call-ID and the response received (SIP/2.0 502 Bad Gateway), with the Reason.
• The E1 circuit ID or the SIP trunk identifier.
• The state on your side: E1 alarms, OPTIONS status, current public IP address.

Frequently asked questions

Is cause 27 my fault or the carrier's?

It depends on where the destination is. If the number terminates on your own PBX, the cause means the network cannot deliver the call to it: a link, equipment or firewall on your side, or the circuit between the two. If the destination belongs to someone else, the failure is in their equipment. The trace and the cause's location field help tell them apart.

Does a real test call catch cause 27 on an 0800 number?

Yes, because it is a real call placed to the number: it gets the same final SIP response a customer would get when the destination is out of service. A failure is retried before it becomes an alert, so nobody is notified over an isolated event, and the alert goes out by email and SMS.