diff --git a/node/IncomingPacket.cpp b/node/IncomingPacket.cpp
index 6f5a49f0b..ff8f9e5bd 100644
--- a/node/IncomingPacket.cpp
+++ b/node/IncomingPacket.cpp
@@ -194,6 +194,7 @@ bool IncomingPacket::_doERROR(const RuntimeEnvironment *RR,void *tPtr,const Shar
 		case Packet::ERROR_NETWORK_AUTHENTICATION_REQUIRED: {
 			const SharedPtr<Network> network(RR->node->network(at<uint64_t>(ZT_PROTO_VERB_ERROR_IDX_PAYLOAD)));
 			if ((network)&&(network->controller() == peer->address())) {
+				bool noUrl = true;
 				int s = (int)size() - (ZT_PROTO_VERB_ERROR_IDX_PAYLOAD + 8);
 				if (s > 2) {
 					const uint16_t errorDataSize = at<uint16_t>(ZT_PROTO_VERB_ERROR_IDX_PAYLOAD + 8);
@@ -204,11 +205,12 @@ bool IncomingPacket::_doERROR(const RuntimeEnvironment *RR,void *tPtr,const Shar
 						if (authInfo.get("aU", authenticationURL, sizeof(authenticationURL)) > 0) {
 							authenticationURL[sizeof(authenticationURL) - 1] = 0; // ensure always zero terminated
 							network->setAuthenticationRequired(authenticationURL);
-						} else {
-							network->setAuthenticationRequired("");
+							noUrl = false;
 						}
 					}
 				}
+				if (noUrl)
+					network->setAuthenticationRequired("");
 			}
 		}	break;
 
diff --git a/node/Network.cpp b/node/Network.cpp
index 32e4bcec4..e2b033770 100644
--- a/node/Network.cpp
+++ b/node/Network.cpp
@@ -1379,6 +1379,8 @@ ZT_VirtualNetworkStatus Network::_status() const
 			return ZT_NETWORK_STATUS_NOT_FOUND;
 		case NETCONF_FAILURE_NONE:
 			return ((_config) ? ZT_NETWORK_STATUS_OK : ZT_NETWORK_STATUS_REQUESTING_CONFIGURATION);
+		case NETCONF_FAILURE_AUTHENTICATION_REQUIRED:
+			return ZT_NETWORK_STATUS_AUTHENTICATION_REQUIRED;
 		default:
 			return ZT_NETWORK_STATUS_PORT_ERROR;
 	}