Learn how to set up a SIP trunk in Asterisk using pjsip: configure outbound registration, authentication, trunk identification, and routing to a specific extension. Follow the step-by-step guide with live commands and troubleshooting tips.

Mastering SIP Trunk Setup in Asterisk: From Outbound Auth to Inbound Routing

Q: How does the `identify` section match IP addresses?

The `match` option takes a domain or IP. When Asterisk receives a SIP request, it checks the source IP against this list. If it matches, the request is routed to the specified `endpoint`.

Q: Should I use `pjsip reload` or restart Asterisk after changes?

Use `pjsip reload` (or `module reload res_pjsip.so`) for most changes. Restart only when you modify core files or the Asterisk binary.

Q: How can I confirm the trunk is working?

Run `pjsip show registrations` and `pjsip show endpoint` – look for the *registration zip* and *endpoint zip* values.

Q: Can I use this configuration with any SIP provider?

The structure is generic, but you’ll need to adjust `server_uri`, `client_uri`, and the `match` IP to match your provider’s requirements.

Published by Brav

Table of Contents

TL;DR

I’ll show you how to configure a SIP trunk in Asterisk using pjsip, covering outbound registration, authentication, trunk identification, and routing to a specific extension.
You’ll learn how to edit pjsip.conf with nano, reload pjsip without a full restart, and verify registrations and endpoints.
I’ll explain why inbound authentication can be omitted and how the contact_user field maps incoming calls.
The article includes a handy table comparing key pjsip configuration sections and troubleshooting tips.

Why this matters

Running a PBX is a lot like owning a train station: you need accurate schedules, reliable tracks, and a ticket-control system that knows who can get on and off. In a VoIP world, that translates to correct trunk configuration, authentication, and routing. If the wrong authentication settings are in place, calls can drop or never connect. If the trunk identify section doesn’t match the provider’s IP, the PBX will refuse incoming calls, and your customers will hang up.

For me, the biggest pain point was getting my outbound calls authenticated with the provider sip.flagonc.com while keeping the inbound path simple and secure. I needed a way to map incoming contacts straight to extension 9999 without overcomplicating the configuration.

Core concepts

Below is a quick snapshot of the three main pjsip configuration objects I work with every day:

Section	Use case	Limitation
endpoint	Defines the local interface for a SIP device or trunk	Cannot directly register to an external provider – needs registration object
registration	Handles outbound REGISTER requests to the provider	Inbound authentication is not supported here – you must use identify for inbound
identify	Matches inbound contacts based on IP or domain, routing them to the correct endpoint	Requires the provider’s IP or domain to be known; otherwise, all contacts are rejected

The endpoint is where the PBX talks to the outside world. The registration tells Asterisk how to prove its identity to the provider. The identify section is what catches incoming calls from the provider’s IP and tells Asterisk which endpoint to hand them to.

How to apply it

Below is my step-by-step workflow for setting up a SIP trunk with pjsip. I’ll reference the official Asterisk docs for each step so you can verify the syntax.

Open the configuration file
```
sudo nano /etc/asterisk/pjsip.conf
```
I use nano because it’s simple and shows line numbers.
Create the transport – the network interface through which SIP will travel.
```
[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0
```
Citation: Asterisk — PJSIP Configuration Examples (2024)

Define the outbound registration – this is the “auth at sip.flagonc.com” part.

[mytrunk]
type=registration
outbound_auth=mytrunk
server_uri=sip:sip.flagonc.com
client_uri=sip:[email protected]
retry_interval=60
contact_user=9999 ; maps incoming contacts to extension 9999

Citation: Asterisk — Configuring Outbound Registrations (2024)

Set up the authentication credentials
```
[mytrunk]
type=auth
auth_type=userpass
username=myuser
password=mypassword
```
Citation: Asterisk — PJSIP Configuration Examples (2024)
Create the AOR (Address of Record) – this tells Asterisk where the provider will send REGISTERs.
```
[mytrunk]
type=aor
contact=sip:sip.flagonc.com:5060
```
Configure the endpoint – this is the local representation of the trunk.
```
[mytrunk]
type=endpoint
context=from-external
disallow=all
allow=ulaw
outbound_auth=mytrunk
aors=mytrunk
```
Citation: Asterisk — PJSIP Configuration Examples (2024)
Add the identify section – this tells Asterisk to accept incoming calls only from the provider’s IP.
```
[mytrunk]
type=identify
endpoint=mytrunk
match=sip.flagonc.com
```
Citation: Asterisk — PJSIP Configuration Examples (2024)
Reload the configuration – no full restart needed.
```
asterisk -rx 'module reload res_pjsip.so'
```
Citation: Asterisk — Reload (2024)
Verify the registration – the provider should now see a REGISTER.
```
asterisk -rx 'pjsip show registrations'
```
You should see the registration zip for mytrunk. Citation: Asterisk — PJSIPShowRegistrationsInbound (2024)
Check the endpoint status – confirm the endpoint zip and that the trunk is online.
```
asterisk -rx 'pjsip show endpoint mytrunk'
```
Citation: Asterisk — PJSIPShowEndpoint (2024)
Update the dial plan – route outbound calls through the trunk and inbound calls to the right extension.
```
[from-external]
exten => _X.,1,Dial(SIP/${EXTEN}@mytrunk)
```
When you receive a call, Asterisk will match the identify section and forward it to extension 9999.
Test a call – place an outbound call and see the inbound callback.

Pitfalls & edge cases

Issue	Why it happens	Fix
Inbound authentication missing	The provider doesn’t require it and we only care about outbound	Leave out the inbound auth section; use identify instead
Call drops after a few seconds	Mis-typed match IP in identify section	Double-check provider’s IP and update the match line
pjsip show registrations shows unregistered	The provider’s URI changed or authentication failed	Verify server_uri, client_uri, and credentials; re-reload
Outbound call fails with 401 Unauthorized	The outbound_auth section is missing or wrong	Re-add the auth block and reload

If you run into any of these, start by reviewing the config sections highlighted above and cross-check the output of the pjsip show commands.

Quick FAQ

Q: What does contact_user=9999 do? A: It tells Asterisk to map any incoming SIP contact to the local extension 9999. This is the same as setting the contact_user in the registration.

Q: Why is inbound authentication omitted? A: Many providers only need the PBX to prove its identity outbound. By not configuring inbound auth, you reduce complexity and the risk of mis-configuring credentials that could expose your system.

Q: How does the identify section match IP addresses? A: The match option takes a domain or IP. When Asterisk receives a SIP request, it checks the source IP against this list. If it matches, the request is routed to the specified endpoint.

Q: What is the address of record? A: It’s the SIP URI the provider uses to reach your PBX – essentially the “public” SIP address.

Q: Should I use pjsip reload or restart Asterisk after changes? A: Use pjsip reload (or module reload res_pjsip.so) for most changes. Restart only when you modify core files or the Asterisk binary.

Q: How can I confirm the trunk is working? A: Run pjsip show registrations and pjsip show endpoint – look for the registration zip and endpoint zip values.

Q: Can I use this configuration with any SIP provider? A: The structure is generic, but you’ll need to adjust server_uri, client_uri, and the match IP to match your provider’s requirements.

Conclusion

By following these steps, you’ll have a reliable SIP trunk that authenticates outbound, accepts inbound calls from a trusted provider, and routes those calls to the correct internal extension. Remember to keep the configuration file tidy, reload only the parts you change, and verify with pjsip show commands. If the trunk is working, the next step is to build the dial plan around it and monitor call quality.

This workflow works for Asterisk 18+, and the same concepts apply to newer releases with minor syntax changes. Keep your Asterisk up to date and test each change in a lab environment before deploying to production.