SIP 403 Forbidden: what it means and how to fix it

Short answer: SIP 403 Forbidden means the server understood the request and refused to carry it out, and authenticating again does not help. On trunks in Brazil, the most common cause is the carrier not recognizing the calling number sent. Check the number in the From and P-Asserted-Identity headers and confirm with the carrier which numbers the trunk may use.

How Monitor treats SIP 403

The reading depends on what should answer the number, which is the question 2N5 answers when it adds each circuit. These are the rules the product applies today, generated from the same function that judges every test call.

What should answer the number	Reading
A greeting or recorded message (the IVR)	Down
A test tone or echo service	Down
Other: it may ring or be answered	Down

What Monitor records for an IVR: The provider refused this call. The usual cause is that the provider does not recognize the number the call comes from; it can also mean this number is barred or suspended, or the account is out of credit (SIP 403).

A call read as Down alerts nobody on its own: it is repeated 3 times, every 2 minutes, and only 4 failures in a row open an incident, with each call's SIP code and Q.850 cause as evidence for the carrier. At the default pace, every circuit is tested every 15 minutes.

If the carrier returns SIP 403 when 2N5's calling account registers, before any call, the test is monitoring blind: it is a problem on 2N5's side, it does not count against the circuit and it does not alert the customer.

What does SIP 403 mean in practice?

Under RFC 3261, SIP 403 Forbidden indicates that the server understood the request but refuses to fulfill it. Authorization will not help, and the request should not be repeated. It differs from SIP 401: with a 401 the server does not yet know who you are; with a 403 it knows and has decided to say no.

On SIP trunks in Brazil, the 403 is one of the most frequent codes when “the trunk registers but cannot call out.” The carrier accepted the registration or the IP, but a business rule blocked that particular call: the calling number, the destination, the account status or the address the call came from. The reason phrase and the Warning header sometimes say which rule was applied, and it is worth reading both before opening a ticket about the SIP 403 error.

Common causes in Brazil

• A calling number (caller ID) that does not belong to the trunk, sent in the From or P-Asserted-Identity header by an extension or a PBX rule.
• A calling number in a format other than the one the carrier expects, for example with or without the area code (DDD), with a leading 0 or in E.164 (+55...).
• A blocked or suspended line or trunk, for example for non-payment or an administrative block.
• A prepaid or allowance-based plan with no credit left for that type of call.
• A destination blocked under the contract: mobile, long distance, international or premium-rate numbers.
• An unauthorized source IP on an IP-based trunk, after switching internet links or migrating Asterisk, Issabel, FreePBX or 3CX.

How to diagnose it

1. Capture with sngrep port 5060 and note the 403’s reason phrase, the Warning header and Reason: Q.850;cause=21, if present (Q.850 cause 21, call rejected).
2. On Asterisk or FreePBX, turn on pjsip set logger on (or sip set debug on with chan_sip) and check the From, P-Asserted-Identity and Remote-Party-ID headers in the INVITE.
3. Call the same destination using the trunk’s main number as the calling number. If that works, the problem is the calling number of the extension or route.
4. Call different kinds of destinations (local landline, mobile, long distance) to see whether the block is by destination type.
5. On 3CX, enable “Verbose logging” and review the outbound caller ID configured on the trunk and in the outbound rule.
6. Confirm in the carrier’s portal or with its billing team that the account is active and has credit.

What to send the carrier

• Date and time, with the time zone, of a few rejected attempts.
• Calling number (A) and called number (B), exactly as they went out in the INVITE.
• The Call-ID of at least one rejected call.
• The full response line, with the reason phrase, the Warning header and the Reason header with the Q.850 cause.
• The public IP the calls go out from and how many attempts failed.
• The pcap of the capture, when available.

Frequently asked questions

Why do I get 403 on only some calls?

When the 403 shows up only for certain destinations, the carrier is usually blocking that type of call under your contract, such as mobile, long distance, international or premium-rate numbers. When it shows up only for certain extensions, the problem is usually the calling number those extensions send, which does not belong to the trunk.

Which Q.850 cause comes with a 403?

Under RFC 3398, Q.850 cause 21 (Call rejected) is the most common, and a 403 is translated back as cause 21. Causes 55 and 87, which relate to closed user groups, and cause 57, bearer capability not authorized, are also converted into 403. In practice, cause 21 is the one you will see most.