SIP Registration Failed

1. How SIP registration works

SIP registration is how a phone tells the registrar server "I'm here, and calls for this AOR should be routed to me." The flow is:

1. Phone sends a REGISTER request to the registrar
2. Registrar challenges with 401 Unauthorized (digest auth challenge)
3. Phone resends REGISTER with Authorization header containing the digest response
4. Registrar validates and responds with 200 OK containing the registration expiry

If any step fails, the phone doesn't register. The failure point determines the fix.

2. What the response code tells you

The response code to the REGISTER is your primary diagnostic signal:

• 401 Unauthorized — auth challenge (normal first step) or auth failure (wrong credentials)
• 403 Forbidden — valid credentials but access denied (account suspended, IP blocked, or policy violation)
• 404 Not Found — the AOR (SIP URI) doesn't exist on this registrar
• 407 Proxy Authentication Required — authentication required by a proxy, not the registrar
• 423 Interval Too Brief — the requested Expires value is below the server's minimum
• 480 Temporarily Unavailable — the registrar is up but can't process registrations right now
• 500 Server Internal Error — registrar-side problem, check server logs
• No response / timeout — network connectivity, DNS, or firewall issue

3. Common causes by response code

4. No response at all

When there's no response to a REGISTER — the phone just times out — the problem is before the SIP layer:

DNS resolution failure

The phone can't resolve the registrar hostname. Test with nslookup registrar.example.com from the same network segment. Check for SRV records: nslookup -type=SRV _sip._udp.example.com.

Firewall blocking SIP port

UDP port 5060 (or TCP 5060/TLS 5061) is blocked between the phone and registrar. Test connectivity with nc -u -v registrar.example.com 5060. Check firewall rules on both the phone's network and the registrar's network.

Wrong transport or port

The phone is sending UDP but the registrar only accepts TCP, or vice versa. Or the port in the phone config doesn't match the listening port on the registrar.

SIP ALG interference

Some routers and firewalls have a SIP Application Layer Gateway (ALG) that modifies SIP packets and often corrupts them. Try disabling SIP ALG on your router — it's almost always more harmful than helpful.

5. How to diagnose from a trace

Capture a SIP trace during a failed registration attempt. Look for:

1. Did the REGISTER arrive at the server? If yes, you'll see it in the server-side trace. If no, the problem is network/DNS.
2. What response did the server send? The response code is your primary diagnostic. Cross-reference with section 3 above.
3. Is the Authorization header present on retry? If the phone sends the initial REGISTER but doesn't respond to the 401 challenge with credentials, the phone has an auth configuration problem.
4. Check the Contact header — does it contain a reachable IP/port? A private IP in the Contact when registering through NAT can cause calls to fail even after successful registration.

6. Fix by response code

For 401 loop: Re-enter credentials on the phone. Verify the realm matches what the server sends in WWW-Authenticate. Enable digest auth logging on the server to see the exact hash comparison.

For 403: Check the PBX for IP restrictions, account status, and any device authorization requirements. Review server logs for the specific denial reason.

For 404: Verify the SIP domain and username in the phone provisioning. Confirm the account exists and is active on the correct server.

For 423: Increase the phone's Expires value. A value of 3600 (1 hour) works for most servers. Some hosted providers require 1800 or 600.

For no response: Confirm DNS resolves, test port connectivity, disable SIP ALG on the router, and verify the phone is sending to the correct IP/port/transport.

7. Analyze your registration trace

Paste your SIP registration trace into SIPSymposium. The analyzer identifies the failure point, checks credential exchange correctness, detects NAT issues in the Contact header, and gives you specific recommendations.