SIP 407 Proxy Authentication Required

What SIP 407 means

A proxy in the call path wants credentials before it will route the call. Like a 401 it is a challenge rather than a failure, but it usually appears on outbound calls rather than registration, which is why a phone can be registered and still fail to dial.

Client error (4xx)
Sent by An outbound proxy or session border controller in the call path
Common

What SIP 407 Proxy Authentication Required actually means

A proxy between you and the destination is refusing to forward the request until it can authenticate you, and it includes a Proxy-Authenticate header for the device to answer. The distinction from a 401 is which element is asking: a 401 comes from the server that owns your account, a 407 from an intermediary routing your traffic.

What causes SIP 407 on a business phone system

The trunk has credentials for registration but not for callsThis is the classic cause of a system that registers happily and fails on every outbound call. Many PBXs hold registration credentials and outbound authentication credentials in separate fields, and only the first gets filled in.
The proxy address differs from the registrar addressWhere a provider uses a separate outbound proxy, a device pointed only at the registrar can authenticate for registration and then be challenged by an intermediary it has no credentials for.
The credentials are right but the realm is notThe proxy challenges for its own realm, which may not be the realm the device registered against. A device that answers with the wrong realm gets challenged again.

How to fix SIP 407

Fill in the outbound authentication fields on the trunkIn your PBX or handset, find the authentication settings that apply to calls rather than registration and enter the same username and password. On Asterisk-derived systems this is often a separate section from the registration string.
Check the outbound proxy setting against your provider documentationWhere the provider specifies a proxy host distinct from the SIP domain, both need to be configured. Omitting the proxy is what puts an unexpected intermediary in the path.
Match the realm the proxy is challenging forRead the Proxy-Authenticate header in a SIP trace and configure the device for exactly that realm.

Fixing the underlying problem

This page explains the code. These guides walk through the fix in detail.

Questions about SIP 407

Why is my phone registered but every outbound call fails with 407?

Because registration and call authentication are configured separately on most systems. The registration credentials are in place, so the phone shows as registered, but the proxy that handles calls is challenging for credentials the device has not been given. Fill in the outbound authentication fields on the trunk.

What is the difference between 401 and 407 in SIP?

Only which element is asking. A 401 comes from the server that owns your account and is what you normally see during registration. A 407 comes from a proxy in the path and is what you normally see on an outbound call. Both are challenges, and both are answered with credentials.

Related SIP response codes

Source. SIP 407 Proxy Authentication Required is defined in RFC 3261 section 21.4.8 and registered in the IANA SIP Parameters — Response Codes. The causes and fixes above are drawn from our own experience supporting UK business phone systems.

All VoIP & SIP codes