Freepbx 13: extension plagued with 401 unauthorised

I’m trying to set up a remote extension (over the internet) in freepbx 13 but it doesn’t work, when making a call the sip debug reads ‘401 unauthorised’ and ‘Forbidden’. If I do ‘sip show peers’, the extension is registered fine. Most of my google searching comes up blank because this is freepbx 13 and most stuff is for earlier versions. What exactly is being ‘unauthorised’?
I’ve tried removing and re-creating the extension, I’ve been trawling through the freepbx settings for ages but no joy. I just don’t get this, thanks if anyone can help.

You know we’re going to be asking you for a lot more information before we can answer, right?

Which Asterisk version are you running, to start?

Chan-SIP or PJ-SIP?

Internal firewall/adaptive firewall enabled?

NAT?

Ports in use correct?

Dumps of the /var/log/asterisk/full around the time of the failure?

You get the idea, right?

thanks for your response. I tried a second additional remote extension - a linksys pap2 and it worked fine so the problem must be with the first phone, which I forgot to mention was a cisco 7940. I seem to remember these 7940’s can be difficult to set up.
The system is FreePBX 13.0.167, using chan-sip only. Firewalls all ok as confirmed by the second extension working fine. Both extensions are configured the same, both extensions on port 5060. The cisco 7940 is registered. When I try to make a call from the remote cisco extension the console shows ‘Failed to authenticate device’. I don’t know where this authentication failure is.