A 3CX SIP trunk that won't register, or that registers but fails calls, almost always shows one of three errors. 403 Forbidden means the provider received your request and refused it: wrong authentication ID or password, or your IP is not allowed. 408 Request Timeout means nothing came back: the provider address does not resolve, the port is wrong, or a firewall blocks outbound SIP. 488 Not Acceptable Here means the call reached the far end but the two sides share no codec. Check the error in the 3CX Event Log or the trunk status in Voice & Chat, then follow the matching fix below.
In the 3CX admin console, open Voice & Chat and look at the trunk's status, then check Event Log for the exact message. The SIP response code tells you which side failed:
| Code | Meaning | Whose side |
|---|
| 401 / 407 | Provider wants a login (normal first reply) | Not an error on its own |
| 403 Forbidden | Login or source IP refused | Your credentials or the provider's allow list |
| 404 Not Found | Number or account unknown | Provider configuration or dialled format |
| 408 Request Timeout | No reply at all | Network, DNS, port or firewall |
| 488 Not Acceptable Here | No common codec or media setting | Codecs or transport |
| 503 Service Unavailable | Provider busy or route down | Provider |
The provider saw your REGISTER or INVITE and rejected it.
- Check the Authentication ID. It is usually a generated SIP username, not your phone number. Many providers, Sautikit included, issue a separate username (Sautikit's start with
ep).
- Copy the password again. Paste it into a plain text editor first to catch trailing spaces.
- Check the IP allow list. Some providers only accept traffic from IPs you register with them. If your office's public IP changed, register the new one.
- On outbound calls only: a 403 on INVITE can mean the caller ID is not one you own, the destination is blocked, or the account has no credit.
Watch for 3CX blocking itself. After repeated failed logins, 3CX's anti-hacking protection can blacklist an address for about a day (3CX docs). If a phone or trunk suddenly can't connect after you fixed the password, check the IP blacklist in the admin console and remove the entry.
3CX sent the request and heard nothing back. The 3CX log often says "408 Request Timeout / REGISTER from local".
- Registrar address. Check the spelling, and that the server can resolve it (
nslookup sip.example.com from the 3CX host).
- Port. If the provider does not use 5060, turn Auto-discovery off next to the Registrar/Server field and enter the port by hand. Sautikit listens on 5080; a trunk left on 5060 times out.
- Transport. Match the provider: UDP, TCP or TLS. A trunk on TCP pointed at a UDP-only server times out.
- Outbound firewall. Allow the 3CX host to send UDP to the provider's address and port.
- Two network cards. On servers with more than one interface, 3CX can send from the wrong one. Check the network settings.
If none of that clears it, take a packet capture from the 3CX console during a registration attempt. If the REGISTER leaves and nothing returns, the problem is upstream of 3CX.
The call reached the far end but the media offer was refused. The 3CX log usually says "Application Rejected Sdp (usually no common codec)".
- Codecs. Put G.711 U-law (PCMU) and G.711 A-law (PCMA) first on the trunk. Remove or lower G.729 and G.722 unless your provider supports them.
- Encryption. If SRTP is required on the trunk but the provider does not offer it, calls fail. Set the trunk to match the provider.
- Fax. Fax only works over G.711 or T.38, and only if the provider supports T.38.
The trunk shows green, outbound works, but inbound calls go to the default route or nowhere:
- The DID on the trunk must match the number the provider sends, in the same format (
+254709000000 versus 254709000000 versus 0709000000).
- Check the inbound rule points at the right destination.
- On the provider side, make sure the number is actually routed to this trunk. On Sautikit, set the number's Forward to the extension of the device you created for 3CX.
If you are setting up a Sautikit number as your 3CX trunk, these are the values that avoid all three errors:
| 3CX field | Value |
|---|
| Registrar/Server | sip.sautikit.com |
| Auto-discovery | off |
| Port | 5080 |
| Transport | UDP |
| Authentication ID | your Sautikit SIP username |
| Codecs | G.711 U-law, G.711 A-law |
The full walkthrough is in Connect 3CX to a Kenyan SIP trunk. A Sautikit number costs KES 500 a month, inbound calls are free and outbound calls cost KES 3.00 a minute billed per second, with no trunk fee.
The provider received the request and refused it. Check the authentication ID and password, and whether the provider only accepts your registered public IP.
3CX sent a request and got no reply. Check the registrar address resolves, the port and transport match the provider, and the firewall allows outbound SIP.
Put G.711 (PCMU and PCMA) first in the trunk's codec list and match the provider's encryption setting. For fax, use G.711 or T.38.
Auto-discovery is on next to the Registrar/Server field. Untick it and type the provider's port, for example 5080 for Sautikit.
Yes. Repeated failed registrations can put an address on the 3CX IP blacklist for about a day. Remove it under the IP blacklist settings after fixing the password.