| Protocol | ims | Network | 5G and LTE |
|---|---|---|---|
| Spec | RFC 3261 / 3GPP TS 24.229 | Spec Section | SIP 407 Proxy Authentication Required challenge in IMS |
| Direction | IMS network -> UE | Message Type | SIP request-failure response |
| Full message name | IMS SIP 407 Proxy Authentication Required |
|---|---|
| Protocol | IMS |
| Technology | 5G and LTE |
| Common deployment | VoNR and VoLTE |
| Direction | IMS network -> UE |
| Interface | Gm |
| Signaling bearer / channel | IMS SIP signaling / Proxy authentication challenge response |
| Typical trigger | The proxy requires authentication credentials before forwarding the request. |
| Main purpose | Starts proxy-side authentication before the request can continue. |
| Main specification | RFC 3261 / 3GPP TS 24.229, SIP 407 Proxy Authentication Required challenge in IMS |
| Release added | See specification history |
| Procedures where used | IMS Registration, IMS Session Authentication |
407 Proxy Authentication Required challenges the sender to authenticate through a SIP proxy, commonly the P-CSCF path.
Starts proxy-side authentication before the request can continue.
407 means the request must usually be retried with proxy authentication.
Previous message(s): IMS SIP REGISTER, IMS SIP INVITE
Next message(s): Authenticated retry with Proxy-Authorization
Security context: Commonly tied to IMS AKA or digest-style authentication through the proxy path.
SIP/2.0 407 Proxy Authentication Required
Via:
From:
To:
Call-ID:
CSeq:
Proxy-Authenticate:
Content-Length: 0
This is SIP response syntax rather than ASN.1.
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP ue.example.net;branch=z9hG4bK-reg1
From: <sip:alice@example.net>;tag=reg1
To: <sip:alice@example.net>;tag=pcscf1
Call-ID: reg-001@example.net
CSeq: 1 REGISTER
Proxy-Authenticate: Digest realm="ims.example.net", nonce="abc123"
Content-Length: 0
| IE | Required | Description |
|---|---|---|
Status-Line | Yes | Shows the 407 challenge code. |
Proxy-Authenticate | Yes | Carries the proxy authentication challenge. |
Status-LineShows the 407 challenge code.
Presence: Required
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
Proxy-AuthenticateCarries the proxy authentication challenge.
Presence: Required
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
Likely cause: The challenge is normal, but the retry may be missing or use wrong credentials.
What to inspect: Check the next request for Proxy-Authorization and credential correctness.
Next step: Treat 407 as an authentication step before treating it as a hard failure.
It means a SIP proxy requires authentication before it will forward the request.
Decode this message with the 3GPP Decoder, inspect the related message database, or open the matching call flow to see where this signaling step fits in the full procedure.