SIP 407 Proxy Authentication Required
Like 401, but the client must authenticate with the proxy.
4xx Client failure · RFC 3261 · Answer to OPTIONS: Up. It wants proxy credentials, which is normal for an SBC.
What SIP 407 means
A 407 is a digest challenge from a proxy rather than from the final destination. It carries a Proxy-Authenticate header with a realm and a nonce, and the client must resend the request with a Proxy-Authorization header. It works like 401; only the header names and the role of the sender differ.
Providers often authenticate outbound calls this way: the first INVITE gets 407, the client acknowledges it, and the retry with credentials goes through. When more than one proxy on the path wants credentials, a request can collect several challenges, and the client answers each realm separately.
Example response
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 198.51.100.21:5060;branch=z9hG4bK-407-n3
From: <sip:+[email protected]>;tag=8e2b
To: <sip:+[email protected]>;tag=px-07
Call-ID: [email protected]
CSeq: 1 INVITE
Proxy-Authenticate: Digest realm="sip.example.net", nonce="a91be04c22", algorithm=MD5, qop="auth"
Content-Length: 0Common causes of SIP 407
- The provider authenticates every outbound call, and the first INVITE went out without credentials, as it normally does.
- The trunk's credentials are wrong, or were changed on the provider's side.
- The client answers the challenge with Authorization instead of Proxy-Authorization, so the proxy never sees credentials.
- Authentication isn't configured for outbound calls, so the client doesn't retry after the 407 at all.
- A second proxy on the path also challenges, and the client only answers the first realm.
How to fix SIP 407
- Check that every 407 is followed by a retry carrying Proxy-Authorization for the realm in the challenge.
- Confirm the username and password configured for outbound calls, not only the ones used for registration.
- If calls fail after the retry, look at what the retry gets back: a 403 means the credentials were refused.
- Where the provider allows it, switch to IP authentication and remove the challenge from every call.
SIP 407 as an answer to OPTIONS
A 407 to OPTIONS means the server is up and wants proxy credentials, which is normal for an SBC. The free check reports the challenge and stops there. On a PingVo Route the agent answers one challenge with the Route's credentials and records what comes back, and by default any SIP response counts as reachable.
Questions about SIP 407
Does every call have to go through a 407 first?
On trunks that use digest authentication for calls, usually yes. The extra round trip adds a little setup time, but it is normal.
Why does the call fail after the 407 retry?
The proxy didn't accept the credentials, or another hop challenged again. Look at the response to the retry, not at the 407.
Is a 407 to INVITE acknowledged?
Yes. It is a final response, so the client sends an ACK before it sends the new INVITE with credentials.