Your trunk is saved, but calls do not flow. The status chip is stuck on error or disconnected, the carrier rejects the REGISTER, or inbound INVITEs never reach an agent. Almost every trunk problem traces back to one of five causes:
  • The peer address or credentials do not match.
  • The registration expiry is wrong.
  • You hit the channel limit.
  • The carrier rejects your identity headers.
  • A firewall drops the packets.
Work from top to bottom. The status chip narrows the problem first. Then the tables below map each symptom to a cause and a fix, based on the trunk fields you set on SIP Trunking.

​
Start with the status chip

Open Admin → Trunks on agent.clutchcall.dev and read the live chip next to the trunk:
A trunk that does not require registration (static IP peering) has no registration to fail. It shows healthy as soon as you save it. For those trunks, go straight to routing. The gateway matches the carrier only by source IP and the dialed DID.

​
The trunk will not register

Registration applies only when you enabled Require SIP REGISTER and set a SIP Username / SIP Password. If the chip shows error, the carrier answers your REGISTER with a rejection.
SIP passwords are sealed at rest. The system never returns them when you read a trunk back. An empty password box in the editor is expected. It does not mean the credential was lost. To change the password, type the new secret and save.

​
The trunk is up but calls do not route

The chip says connected (or the trunk is static-IP peered), but callers still cannot reach an agent. The trunk edge is correct. The problem is matching, capacity, or identity.

​
Firewall and ports

A disconnected chip, REGISTERs with no reply, or INVITEs that never arrive almost always mean a dropped packet in transit. Check that the path is open in both directions between your carrier’s SBC and your workspace endpoint <workspace-id>.sip.clutchcall.dev.
1

Confirm the peer address and port

Check SBC IP (or Gateway IP), Source Port (default 5060), and the carrier-assigned Destination Port. One wrong digit here shows as disconnected, because nothing replies. If the carrier routes through an intermediary, set the Outbound Proxy (host:port).
2

Open SIP both ways

SIP is bidirectional. If you open only the outbound path, your REGISTER leaves, but the firewall silently drops the carrier’s 200 OK and every inbound INVITE. Allow UDP/TCP 5060 (and TLS 5061 for TLS trunks) to and from every SBC source IP.
3

Open the RTP media range

Signalling can succeed while media fails. The result is connected calls with no audio. Open the UDP media port range your workspace advertises in SDP to the carrier’s media address. Check that External RTP IP is the reachable public address. The internal/external split is what makes the trunk work behind NAT.
4

Watch NAT keep-alive on registration trunks

Behind NAT, a Register Expires longer than your firewall’s UDP idle timeout lets the pinhole close between refreshes. The carrier then cannot reach you, even though the chip last showed connected. Lower Register Expires so the refresh reopens the pinhole before it lapses.
5

Capture the exchange

If the addressing and ports look correct, read the actual SIP dialog. The per-tenant SIP trace viewer shows the full INVITE/REGISTER exchange, the response codes, and the SDP for every call on the trunk — see SIP / RTP Debugging. A 403 on INVITE points back to an unmatched SBC IP. A repeated 401/407 points at credentials. A 486/503 points at the Channel Limit.

​
Quick field checklist

  • SIP Username / SIP Password exactly match the carrier. Enter the full password again — sealed fields never read back.
  • SIP Domain equals the carrier’s registration realm, not your workspace subdomain.
  • Register Expires (register_expires_sec) is at or below the carrier’s maximum, and above your NAT idle timeout.
  • Every carrier source IP is listed as an SBC IP / peer, so the INVITE matches the trunk and bypasses the registrar ACL.
  • inbound_rule is set to a real handler (not the default reject), and the DID is bound to an agent, skill, or VDN.
  • Channel Limit (channel_limit) matches your carrier’s contracted concurrent-call ceiling.
  • Compliance Headers is set to Minimal if the carrier drops identity-asserting calls (100 Trying, then a timeout).
  • External RTP IP is the reachable public address. The RTP/UDP media range is open both ways.
  • Media Mode is Proxy. Media anchored at the gateway is the NAT-safe default. Direct is preview, and it currently still proxies.

SIP Trunking

The full trunk-configuration walkthrough and field reference.

SIP / RTP Debugging

Read the raw SIP dialog and RTP quality for any call on the trunk.

Call Not Connecting

When the call never reaches an agent, across all transports.

One-Way / No Audio

Signalling succeeds, but media is silent or flows in one direction.