SIP 403 Forbidden
The server understood the request and refuses to fulfil it. Authenticating again won't help.
4xx Client failure · RFC 3261 · Answer to OPTIONS: Up. It refused us, often because only listed IP addresses are allowed.
What SIP 403 means
A 403 is a refusal: the server understood the request and won't carry it out. Unlike with 401, sending credentials won't change the answer. The server has decided that this sender, this destination or this request isn't allowed, and the reason phrase or a Warning header sometimes says why.
On trunks, 403 shows up on INVITE when a call isn't permitted, on REGISTER when an account is disabled, and on OPTIONS when the server only talks to known peers. Under RFC 3398 it is also what a gateway sends when the phone network rejects a call with Q.850 cause 21, call rejected.
Example response
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP 198.51.100.17:5060;branch=z9hG4bK-403-j9
From: <sip:+[email protected]>;tag=c2f0
To: <sip:+[email protected]>;tag=fx-19
Call-ID: [email protected]
CSeq: 11 INVITE
Reason: Q.850;cause=21;text="Call rejected"
Content-Length: 0Common causes of SIP 403
- The SBC accepts traffic only from listed IP addresses, and the request came from an address that isn't on the list.
- The digest retry carried credentials the server rejected, and it refuses instead of challenging again.
- The destination is barred on the account, for example international or premium-rate numbers.
- The caller ID isn't one the trunk is allowed to present, so the carrier refuses the call.
- The account is suspended or has run out of credit.
- The phone network rejected the call, and the gateway mapped Q.850 cause 21 to 403.
How to fix SIP 403
- Find out which hop sent the 403: your own SBC, the carrier's edge, or a gateway reporting a rejection from the phone network.
- Confirm that the source IP the provider sees, after any NAT, matches the address on its allow-list.
- Check the caller ID format and number against what the trunk is allowed to send.
- Ask the provider whether the destination or the account is restricted.
- If the 403 follows a digest retry, recheck the credentials as you would for a repeated 401.
SIP 403 as an answer to OPTIONS
A 403 to OPTIONS means the server is up but refused the probe, often because only listed IP addresses may send it SIP. Adding the probing agent's address to the SBC's allow-list usually turns it into a 200. A PingVo Route counts any response as reachable by default; set the Route's expected codes to 200 if a 403 should count as a failure.
Questions about SIP 403
What is the difference between SIP 401 and 403?
401 asks for credentials and expects a retry. 403 is a final refusal: the server knows what you want and won't do it, so retrying with credentials won't help.
Why do I get 403 for some numbers only?
The refusal is about the destination, not your trunk. International, premium-rate or specific prefixes may be barred on the account.
Why does my SBC answer OPTIONS with 403?
It accepts SIP only from listed peers. The answer still proves it is up; add the prober's address if you want a 200 instead.