FreePBX SIP trunk registration fails or stays rejected

Confirm whether this trunk is supposed to register

Start with the exact provider, product, account or order, direction, signaling host and current implementation worksheet. FreePBX PJSIP examples published by Sangoma include both registration-free, source-IP-matched trunks and other trunks that use outbound registration. A missing registration therefore is not a fault until the ordered service says this PBX must send REGISTER.

Record the trunk's effective Authentication and Registration choices in Connectivity → Trunks, the provider-assigned identity and the inbound-delivery model. Do not copy a registration template from another provider, convert a hosted seat into a trunk, or enable REGISTER merely to make a status icon appear. A fixed-peer trunk can carry calls without an outbound registration object.

Prove that FreePBX generated and Asterisk loaded the object

Submit the supported trunk form and Apply Config, then use pjsip show registrations to list outbound registration objects and pjsip show registration <name> to inspect the intended one. If no object exists for a trunk that should register, investigate the FreePBX trunk mode, empty or malformed provider fields and configuration-generation or reload errors before checking passwords.

Asterisk's troubleshooting guide explains that a registration may fail to load when its object type or option set is invalid, or when server_uri or client_uri is not a valid SIP URI. On a FreePBX-managed host, treat that as evidence about the generated configuration and its GUI owner; do not repair it by editing generated PJSIP files. Preserve the Apply Config result and the first relevant Asterisk error.

Follow one REGISTER exchange to its exact outcome

For a loaded object, correlate its status with a short authorized PJSIP trace. Separate no outbound REGISTER, a sent request with no response, a 401 or 407 challenge followed by a credentialed retry, a 403 or other final rejection, a 423 interval correction and a successful 200 response. Keep the server URI, client identity, realm, transport, source address, response code and timestamp attached to the same exchange.

Do not publish passwords, Authorization values or reusable account identifiers in tickets or shared captures. A network timeout, DNS result, TLS failure, authentication rejection and provider account block have different owners. Likewise, a registrar accepting one binding does not prove that the provider will route an inbound number, authorize an outbound identity or deliver media.

Read runtime status and retry policy without forcing traffic

Asterisk documents Registered, Unregistered, Rejected and Stopped status values. Inspect the exact object rather than relying on a generic dashboard label. Its retry interval, maximum retries, authentication-rejection policy and any forbidden or fatal retry interval explain whether another automatic attempt is expected. AMI's outbound-registration detail also exposes NextReg; zero can mean the configured retry limit has been reached.

Do not shorten intervals or enable retries simply to make packets visible. First classify the response and correct the demonstrated identity, credential, URI, certificate, DNS, firewall or provider-account cause. Repeated 401, 403 or other permanent failures can trigger upstream protection and obscure the original evidence. Plan one supported Apply Config or version-appropriate activation after the correction.

Verify renewal and calls as separate acceptance stages

After the controlled correction, preserve the next REGISTER, challenge if used, 200 response, accepted Contact and expiration. Confirm at least one renewal at the expected interval and verify that the object remains loaded after the approved reload or restart. A transient Registered label without a renewal is not a completed acceptance result.

Then test provider-controlled inbound delivery and FreePBX inbound routing separately from outbound route selection, caller-identity authorization, two-way media, DTMF and hangup. Record the tested number, direction, route, Call-ID and timestamps without exposing secrets. No account, PBX, trunk, credential, registrar, registration, route, call or media path was tested for this guide.

core show version
module show like res_pjsip_outbound_registration
pjsip show registrations
pjsip show registration <registration-name>
pjsip set logger on
# Observe one authorized registration attempt, then stop the trace.
pjsip set logger off

Continue NFON registration evidence into Primary/Backup selection

After proving endpoint registration or static trust, use the NFON backup-PBX workflow to establish trunk-set membership, priority and new-call selection.

Do not turn a FreePBX trunk failure into a blind AMI loop

Use the PJSIP registration-control diagnostic to trace the generated object, action, packet, response and later timer while keeping persistent FreePBX ownership explicit.

Distinguish the Registries report from inbound trunk identity

The Asterisk Info workflow confines Registries to Asterisk acting as the registering client. A report row does not prove inbound endpoint identification, number routing, authorization or media.