SIP Error Codes 401, 403, 404, 408, 480, 486, 503: Causes and Fixes

When a call fails on a SIP trunk, the carrier sends back a numbered response. The number tells you roughly what went wrong — but on a trunk, the real cause is often different from the textbook definition. This guide covers the seven codes we see most in support tickets, what each one usually means in practice, where to look, and the fix that typically works.

How SIP responses work

SIP responses are grouped by their first digit:

A 4xx doesn't always mean your fault. On a trunk, a downstream carrier's failure can arrive at your PBX as almost any code, depending on how each hop translates it. Always read the full response, including the Reason header if one is present.

Before you start: get a trace

You'll fix problems much faster with a SIP trace than with PBX logs alone.

# Asterisk
asterisk -rx "pjsip set logger on"

# FreeSWITCH / FusionPBX
fs_cli -x "sofia global siptrace on"

# Any Linux server
sngrep port 5060

sngrep is the most readable option: it shows each call as a ladder diagram and lets you open every message.

401 Unauthorized

What it means: the server wants credentials. On a registered trunk, a single 401 is normal — your PBX sends a request, gets a 401 with a challenge, and replies with the password. It's only a problem when it repeats.

Common causes:

• Wrong username or password
• The auth username differs from the "from" user, and your PBX is sending the wrong one
• Your PBX isn't configured to respond to the challenge (outbound auth not set on the endpoint)
• The trunk is set to IP authentication on the carrier side, but your PBX is trying to register

Fix: check the credentials character by character, confirm which username field the carrier expects, and make sure the PBX has outbound authentication enabled. If you're meant to be on IP authentication, remove the registration entirely.

403 Forbidden

What it means: the server understood you and refused. On a trunk it usually means "I know who you are, and you're not allowed to do this."

Common causes:

• Your source IP isn't on the carrier's whitelist — common after a server move or when NAT changes your outbound IP
• No balance, or your account has hit a spend limit
• The destination is blocked on your account (premium ranges, high-fraud countries)
• Your caller ID is invalid or not permitted — see CLI rules
• Wrong number format (for example sending +44… when the carrier expects 44…)

Fix: confirm your public IP with curl ifconfig.me from the PBX and compare it with what's whitelisted. Check your balance and any destination blocks in the portal. Try a test call with a known-good caller ID to a domestic number.

404 Not Found

What it means: the number you dialled doesn't exist — or the carrier can't find a route for it.

Common causes:

• Wrong number format — missing country code, extra leading zero, or an international prefix like 00 or 011 the carrier doesn't expect
• The number genuinely isn't in service
• On inbound calls: the DID isn't assigned to anything on your PBX, so your PBX returns the 404

Fix: look at the Request-URI in the trace. Most trunks want E.164 without the plus: country code then the national number without its leading zero — 447700900123, not 07700900123 or +447700900123. Adjust your outbound route or dial pattern to strip and prepend digits as needed. For inbound, check the DID's destination in your PBX.

408 Request Timeout

What it means: no final response arrived in time (usually 32 seconds).

Common causes:

• A firewall is blocking responses from the carrier, so your PBX never hears back
• SIP ALG on the router is mangling packets
• UDP fragmentation: a large INVITE (many codecs, long headers) is split and one fragment is dropped
• The far end is genuinely unreachable or overloaded

Fix: make sure your firewall allows SIP from the carrier's IP ranges and that responses aren't being dropped. Disable SIP ALG on the router — it causes more trouble than it solves. If INVITEs are large, reduce the codec list or switch to TCP. If only one destination times out, it's probably a downstream route issue: send us the Call-ID.

480 Temporarily Unavailable

What it means: the callee exists but can't take the call right now.

Common causes:

• The mobile is switched off or out of coverage
• The registered phone (on inbound) is offline
• A downstream carrier uses 480 as a catch-all for "no route available right now"

Fix: if it's a handful of numbers, it's usually the callees — nothing to fix. If 480s jump suddenly on one destination, it's more likely a route problem. Compare with the same period last week, and contact support with examples. On inbound, check the extension or ring group is registered and reachable.

486 Busy Here

What it means: the callee is on another call, or rejected it.

Common causes:

• The person really is busy, or pressed "decline"
• Your own channel limit: the trunk is full and the carrier rejects the extra call — some platforms signal this as 486
• On inbound: all your extensions are busy and there's no voicemail or overflow

Fix: check concurrent calls at the moment of failure. If you're at your channel cap, raise it or spread traffic. If not, it's normal callee behaviour and simply part of your ASR.

503 Service Unavailable

What it means: the server can't handle the request right now.

Common causes:

• You've exceeded your channel limit or calls-per-second (CPS) limit
• Your PBX has no working route — Asterisk returns 503 locally when the trunk is unreachable
• The carrier, or a downstream carrier, is overloaded or failing over
• All routes for that destination are down

Fix: first work out who sent the 503: look at the Via and Server headers in the trace. If it came from your own PBX, the trunk may be marked unavailable (check qualify/OPTIONS status). If it came from the carrier, check your CPS and channel limits. Dialers that burst hundreds of calls in a second commonly hit CPS limits. If neither applies, send us the Call-ID and we'll look at the downstream hop.

Quick reference

Problems that don't produce an error

Some of the most frustrating faults don't show up as a code at all: the call connects with 200 OK, but there's no audio, or audio in one direction only. That's almost always NAT or RTP ports, not signalling. We cover it fully in one-way audio: 9 causes and fixes.

Platform-specific setup

Many of these errors come from small configuration mistakes. Our setup guides walk through the settings that matter for Asterisk, FreePBX, 3CX, FusionPBX and others — including number formats and NAT options.

If you've worked through this list and calls still fail, open a ticket. Our NOC is staffed around the clock.