Your trunk is saved but calls aren’t flowing — the status chip is stuck on error or disconnected, the carrier’s REGISTER is being rejected, or inbound INVITEs never reach an agent. Almost every trunk problem traces back to one of five things: the peer address or credentials don’t match, the registration expiry is wrong, you’ve hit the channel limit, the carrier dislikes your identity headers, or a firewall is eating the packets. Work top to bottom. The status chip narrows it down first, then the tables below map each symptom to a cause and a fix grounded in the trunk fields you set on SIP Trunking.

​
Start with the status chip

Open Admin → Trunks on agent.telequick.dev and read the live chip next to the trunk:
ChipMeaningLook at
connectedRegistration (or static peering) is healthy. If calls still fail, the problem is routing, not the trunk being up.Routing failures
errorThe trunk tried to register and the carrier rejected it.Registration failures
disconnectedNo registration attempt is completing — usually the peer is unreachable or a firewall is dropping packets.Firewall & ports
A trunk that does not require registration (static IP peering) has no registration to fail — it shows healthy as soon as it’s saved. For those trunks, skip straight to routing: the gateway matches the carrier purely by source IP and the dialed DID.

​
The trunk will not register

Registration only applies when you enabled Require SIP REGISTER and set a SIP Username / SIP Password. If the chip is error, the carrier is answering your REGISTER with a rejection.
SymptomLikely causeFix
Chip flips to error the instant you saveWrong SIP Username / SIP Password, or the credential drifted after a rotationRe-save the trunk with the correct values. Passwords are sealed and never read back, so a blank-looking field is not the bug — always re-enter the full password to rotate it.
Carrier returns 403 Forbidden / 404 Not Found on REGISTERThe SIP Domain (registration realm) doesn’t match what the carrier expects in the From/To user@domainSet SIP Domain to the exact host your carrier assigned (often the SBC host), not your workspace subdomain.
Registers, then drops a minute or two later, then re-registersRegister Expires longer than the carrier’s binding TTL — the carrier expires the contact before your refreshLower Register Expires (register_expires_sec, default 3600) to at or below the carrier’s maximum; many carriers cap at 3600 or 300s.
Constant re-REGISTER churn / high signalling loadRegister Expires set very low (e.g. tens of seconds)Raise it back toward the carrier’s recommended value. Short expiries multiply REGISTER traffic without improving reliability.
401/407 challenge loop that never settlesDigest auth mismatch — username, password, or realm off by oneConfirm all three against the carrier’s provisioning portal; the realm in the 401 challenge must equal your SIP Domain.
Chip is disconnected, REGISTER never even gets a replyPeer unreachable — wrong SBC IP / Destination Port, or a firewallSee Firewall & ports.
SIP passwords are sealed at rest and never returned when you read a trunk back. An empty password box in the editor is expected — it does not mean the credential was lost. To change it, type the new secret and save.

​
The trunk is up but calls do not route

The chip says connected (or the trunk is static-IP peered) yet callers still can’t reach an agent. Now the trunk edge is fine and the problem is matching, capacity, or identity.
SymptomLikely causeFix
Inbound INVITE arrives but is rejected before ringing (403)The carrier is sending from an IP that is not the configured SBC IP — so it hits the registrar ACL instead of matching the trunkAdd every source IP the carrier uses (SBCs often front a pool) to the trunk’s SBC IP / peer address. A matched trunk peer bypasses the registrar ACL; an unmatched one is treated as an untrusted endpoint.
Inbound INVITE matches the trunk but the caller hears nothing / dropsinbound_rule still on reject, or no agent/skill/VDN bound to the DIDSet an inbound handler (Handle with AI, or bind a skill/VDN) — see Inbound Calls. New trunks default to reject.
Calls fail only at peak; fine off-peakChannel Limit reached — concurrent calls beyond it are rejected (busy)Raise Channel Limit (channel_limit, default 50) to match your carrier contract. An over-tight limit silently sheds traffic at the busy hour.
Outbound calls return only 100 Trying, then time outThe carrier drops calls whose edge asserts caller identitySwitch Compliance Headers from Full to Minimal — this suppresses Remote-Party-ID, P-Asserted-Identity, and P-Access-Network-Info.
Caller connects but there’s no audio (one-way or dead air)RTP media addressing / NAT — external_rtp_ip wrong, or RTP ports blockedVerify External RTP IP is your public address and that the RTP/UDP media range is open (see below). Deep-dive: One-Way / No Audio.
Carrier BYEs the call right after answerSDP negotiation edge case (e.g. 180 Ringing sent without SDP where the carrier needs early media)The gateway answers 100 Trying → 183 with SDP → 200 with the same SDP by design; if a carrier still BYEs, capture the exchange in the SIP trace (below) and check the offered codecs against Codecs.

​
Firewall and ports

A disconnected chip, REGISTERs with no reply, or INVITEs that never arrive almost always mean a packet is being dropped in transit. Confirm the path is open in both directions between your carrier’s SBC and your workspace endpoint <workspace-id>.sip.telequick.dev.
TrafficTransportPortDirection
SIP signallingUDP / TCP5060 (your Source Port)Inbound from + outbound to SBC
SIP over TLSTLS5061 (or your configured secure port)Both, when the trunk is TLS
RTP / RTCP mediaUDPThe negotiated media port range advertised in your SDPBoth, to/from the carrier’s media IP
Carrier signallingUDP / TCPThe Destination Port your carrier assignedOutbound to the SBC
1

Confirm the peer address and port

Double-check SBC IP (or Gateway IP), Source Port (default 5060), and the carrier-assigned Destination Port. A single wrong digit here presents as disconnected because nothing ever replies. If the carrier routes through an intermediary, set the Outbound Proxy (host:port).
2

Open SIP both ways

SIP is bidirectional — opening only the outbound path lets your REGISTER leave but silently drops the carrier’s 200 OK and every inbound INVITE. Allow UDP/TCP 5060 (and TLS 5061 for TLS trunks) to and from every SBC source IP.
3

Open the RTP media range

Signalling can succeed while media fails, giving you connected calls with no audio. Open the UDP media port range your workspace advertises in SDP to the carrier’s media address, and confirm External RTP IP is the reachable public address (the internal/external split is what makes the trunk work behind NAT).
4

Watch NAT keep-alive on registration trunks

Behind NAT, a Register Expires longer than your firewall’s UDP idle timeout lets the pinhole close between refreshes — the carrier then can’t reach you even though the chip last showed connected. Lower Register Expires so the refresh reopens the pinhole before it lapses.
5

Capture the exchange

If addressing and ports look right, read the actual SIP dialog. The per-tenant SIP trace viewer shows the full INVITE/REGISTER exchange, response codes, and SDP for every call on the trunk — see SIP / RTP Debugging. A 403 on INVITE points back to an unmatched SBC IP; a repeated 401/407 points at credentials; a 486/503 at the Channel Limit.

​
Quick field checklist

  • SIP Username / SIP Password exactly match the carrier (re-enter the full password — sealed fields never read back).
  • SIP Domain equals the carrier’s registration realm, not your workspace subdomain.
  • Register Expires (register_expires_sec) is at or below the carrier’s maximum and above your NAT idle timeout.
  • Every carrier source IP is listed as an SBC IP / peer so it matches the trunk and bypasses the registrar ACL.
  • inbound_rule is set to a real handler (not the default reject) and the DID is bound to an agent, skill, or VDN.
  • Channel Limit (channel_limit) matches your carrier’s contracted concurrent-call ceiling.
  • Compliance Headers set to Minimal if the carrier drops identity-asserting calls (100 Trying then timeout).
  • External RTP IP is the reachable public address; the RTP/UDP media range is open both ways.
  • Media Mode is Proxy (media anchored at the gateway is the NAT-safe default; Direct is preview and currently still proxies).

SIP Trunking

The full trunk-configuration walkthrough and field reference.

SIP / RTP Debugging

Read the raw SIP dialog and RTP quality for any call on the trunk.

Call Not Connecting

When the call never reaches an agent, across all transports.

One-Way / No Audio

Signalling succeeds but media is silent or flows one direction.