Fixing SIP 403 Forbidden Errors During Outbound Carrier Authentication

Problem

Outbound INVITE requests sent to a SIP carrier trunk are rejected with a '403 Forbidden' response during or immediately following digest authentication challenge handling.

Symptoms

• Outbound calls terminate immediately with Asterisk cause code 21 (Call Rejected).
• SIP trace shows an initial INVITE followed by 401 Unauthorized/407 Proxy Auth, then the challenge-authenticated INVITE receives 403 Forbidden.
• Carrier returns reason header text like '403 Invalid Credentials', '403 From Domain Mismatch', or '403 IP Not Allowed'.
• Asterisk CLI displays 'WARNING[12345]: res_pjsip_outbound_authenticator_digest.c: Endpoint carrier-trunk: Digest authentication failed'.

Root cause

The carrier sends a 403 Forbidden due to one of three common issues: incorrect digest credentials (username/password/realm) in the PJSIP auth object, a mismatch between the 'From' domain/user header and the carrier's provisioned trunk identity, or sending traffic from an IP address not whitelisted in the carrier's portal.

Resolution steps

1. step #1

   Enable full PJSIP logging in the Asterisk CLI to capture detailed SIP header interactions with the carrier.

   pjsip set logger on

2. step #2

   Capture live SIP traffic using sngrep on the network interface to inspect the Authorization header and response parameters sent to the carrier.

   sngrep -d eth0 proto SIP and host <CARRIER_IP_OR_FQDN>

3. step #3

   Inspect `/etc/asterisk/pjsip.conf` to verify that the `auth` section credentials, `realm`, and the `endpoint` section's `from_domain` and `from_user` match the provider configuration exactly.

   [carrier-auth]
   type=auth
   auth_type=userpass
   username=provisioned_trunk_username
   password=ProvisionedSecretPass123!
   realm=sip.carrier.com
   
   [carrier-endpoint]
   type=endpoint
   transports=transport-udp
   context=from-carrier
   outbound_auth=carrier-auth
   server_uri=sip:sip.carrier.com
   from_user=provisioned_trunk_username
   from_domain=sip.carrier.com
   direct_media=no

4. step #4

   Check the Asterisk dialplan to confirm the outbound Caller ID format complies with carrier requirements (e.g., E.164 +1NXXNXXXXXX vs 10-digit).

   exten => _NXXNXXXXXX,1,NoOp(Outbound Call to Carrier)
    same => n,Set(CALLERID(num)=+12025550199)
    same => n,Dial(PJSIP/${EXTEN}@carrier-endpoint)

5. step #5

   Reload the PJSIP module in Asterisk to apply the configuration updates.

   module reload res_pjsip.so

6. step #6

   Initiate a test call via Asterisk CLI to confirm the trunk accepts the authenticated INVITE and responds with 100 Trying and 180 Ringing/200 OK.

   channel originate PJSIP/+12025550123@carrier-endpoint application Playback tt-monkeys

Verification evidence

A captured SIP dialog shows Asterisk responding to a 401/407 challenge with an Authorization header containing an invalid digest MD5 response, or an unauthenticated initial INVITE rejected directly with 403 due to IP or From-URI header ACL violations.