Setup guide · PJSIP

Connect a SIP trunk to Asterisk

This guide connects SIPTrunkHub to Asterisk 18 or newer using chan_pjsip. You will add an endpoint, an AOR and either an identify section (IP auth) or a registration (digest auth), then route outbound calls from the dialplan.

Get Rates Talk to NOC

Before you start

What you need

Asterisk 18+ with chan_pjsip loaded (module show like pjsip)
A public IP or a static NAT mapping for your server
Your SIPTrunkHub account details: SIP server, auth method, tech prefix if any
Shell access to edit /etc/asterisk/pjsip.conf and extensions.conf

IP auth or register auth?

IP authentication

Recommended

We whitelist your server’s public IP. Asterisk matches our inbound traffic with an identify section. No password to leak, no registration to drop.

Register (digest) authentication

Asterisk registers with a username and password. Use this when your public IP changes or you are behind carrier-grade NAT.

Step by step

Configure Asterisk

sip.example-host.net and 203.0.113.10 are documentation placeholders. Replace them, and the username, password and tech prefix, with the values from your account.

Add the transport

If you do not already have a UDP transport, add one. Set external addresses when the server sits behind NAT so the SDP carries your public IP.

/etc/asterisk/pjsip.conf

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060
; behind NAT only:
; external_media_address=YOUR_PUBLIC_IP
; external_signaling_address=YOUR_PUBLIC_IP
; local_net=10.0.0.0/8

Create the trunk (IP authentication)

Endpoint, AOR and identify share the same name. The identify section tells Asterisk that traffic from our signalling IP belongs to this endpoint.

/etc/asterisk/pjsip.conf

[siptrunkhub]
type=endpoint
transport=transport-udp
context=from-siptrunkhub
disallow=all
allow=ulaw,alaw,g729
aors=siptrunkhub
from_domain=sip.example-host.net
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
dtmf_mode=rfc4733

[siptrunkhub]
type=aor
contact=sip:sip.example-host.net:5060
qualify_frequency=30

[siptrunkhub]
type=identify
endpoint=siptrunkhub
match=203.0.113.10

Or: use register authentication

Add an auth section and a registration, then point the endpoint at the auth with outbound_auth. Keep the identify section so inbound calls still match.

/etc/asterisk/pjsip.conf (additions)

[siptrunkhub-auth]
type=auth
auth_type=userpass
username=YOUR_SIP_USERNAME
password=YOUR_SIP_PASSWORD

[siptrunkhub-reg]
type=registration
transport=transport-udp
outbound_auth=siptrunkhub-auth
server_uri=sip:sip.example-host.net
client_uri=sip:[email protected]
retry_interval=60
expiration=600

; then add to the [siptrunkhub] endpoint:
; outbound_auth=siptrunkhub-auth

Route outbound calls

Users dial 00 + country code + number. The dialplan strips the 00 and sends E.164 digits. If your account has a tech prefix, put it in front of the number.

/etc/asterisk/extensions.conf

[from-internal]
exten => _00X.,1,Set(CALLERID(num)=442079460000)
 same => n,Dial(PJSIP/${EXTEN:2}@siptrunkhub,60)
 same => n,Hangup()

; with a tech prefix (example 1234#):
; same => n,Dial(PJSIP/1234#${EXTEN:2}@siptrunkhub,60)

05
Handle inbound DID calls
DIDs arrive in the context set on the endpoint, in E.164 format without the +. Match the full number and send it to an extension, queue or IVR.
/etc/asterisk/extensions.conf
```
[from-siptrunkhub]
exten => 442079460000,1,Dial(PJSIP/1001,30)
 same => n,Voicemail(1001@default)
exten => _X.,1,Hangup(1)
```
06
Reload and check
Reload PJSIP and confirm the endpoint is reachable. For register auth, confirm the registration shows Registered.
Asterisk CLI
```
asterisk -rx "pjsip reload"
asterisk -rx "pjsip show endpoint siptrunkhub"
asterisk -rx "pjsip show registrations"
```

Media

Codec order

Order matters: Asterisk offers codecs in the order of the allow line. Put ulaw or alaw first for best quality.
Add g729 last for bandwidth-limited links. It needs the G.729 codec module installed.
Fax: use alaw/ulaw only on fax endpoints and enable t38_udptl=yes if your fax device supports T.38.

NAT notes

Set external_media_address and external_signaling_address on the transport, plus local_net for every private range.
Keep rtp_symmetric, force_rport and rewrite_contact on the endpoint.
Open UDP 10000–20000 (or your rtp.conf range) inbound from our media IPs.
Turn off SIP ALG on the router. It is the single most common cause of one-way audio.

Verify

Test the trunk

qualify_frequency sends an OPTIONS ping every 30 seconds. A status of Avail with a round-trip time means signalling works. Then place a test call to a mobile you own and check audio both ways.

Asterisk CLI

asterisk -rx "pjsip show contacts"
asterisk -rx "pjsip set logger on"   ; watch the INVITE and responses
asterisk -rx "channel originate PJSIP/447700900123@siptrunkhub application Playback demo-congrats"

Troubleshooting

Common SIP errors

What each response means and what to check first on Asterisk. If you still need help, send the Call-ID and timestamp to the NOC.

Common SIP error codes and fixes for Asterisk
Code	Meaning	Likely cause	Fix on Asterisk
401	Unauthorized	We challenged the INVITE or REGISTER and the credentials were wrong or missing. With IP auth it usually means the call arrived from an IP we have not whitelisted.	Check the auth section and that outbound_auth is set on the endpoint, not only on the registration.
403	Forbidden	Authenticated, but not allowed: wrong or missing tech prefix, zero prepaid balance, destination blocked on your account, or an invalid caller ID.	Check balance and tech prefix first, then the caller ID format. If both look right, send the Call-ID to the NOC.
404	Not Found	The dialled number is not in a format we can route: missing country code, an extra 00 or +, or a local trunk prefix left in.	Your Dial() string probably still contains 00 or +. Use ${EXTEN:2} after matching _00X.
408	Request Timeout	No response came back. Usually a firewall, wrong port or transport, a DNS failure, or SIP ALG on the router eating packets.	Run pjsip show contacts. Unavailable means the OPTIONS ping is not getting through the firewall.
480	Temporarily Unavailable	The far end could not be reached: handset off, out of coverage, or the route for that prefix is temporarily down.	Retry later or route to another trunk. If it hits one prefix repeatedly, send examples to the NOC.
486	Busy Here	The called party is busy, or you reached the concurrent-channel limit on your account.	Treat as a normal busy. If every call returns 486, check your active channel count against your limit.
503	Service Unavailable	Capacity limit hit (calls per second or channels), or every route for that destination failed.	Pace your dialer to the agreed CPS. Configure a second trunk for failover. Ask the NOC if it persists.

Seeing one-way audio instead of an error? Read One-Way Audio on VoIP Calls.

FAQ

Asterisk questions

Does this work with chan_sip?

chan_sip was removed in Asterisk 21. The settings translate, but we recommend PJSIP for new installs. Our Issabel and Vicidial guides cover chan_sip-style peers.

Why does the identify section matter for register auth?

Without it, inbound INVITEs from our IP do not match the endpoint and Asterisk rejects them or sends them to the anonymous endpoint.

Can I use TLS and SRTP?

Yes. Add a TLS transport on 5061, set media_encryption=sdes on the endpoint, and ask the NOC to enable TLS on your account.

Other setup guides

All 12 guides

Popular destinations

Stuck on a step?

The NOC answers 24/7. Send your platform, a SIP trace and the Call-ID of a failed attempt.

Ready to connect Asterisk?

Prepaid from $200. No setup fee, no contract. Get rates and your account details from sales.