Asterisk PJSIP Trunk Setup: NAT, external_media_address & IP Auth

Introduction: Why PJSIP and Why IPComms?

If you are running Asterisk in 2026, PJSIP is no longer optional -- it is the only supported SIP channel driver. The legacy chan_sip module was deprecated in Asterisk 19, marked for removal in Asterisk 20, and is completely gone in Asterisk 21 and later releases. Whether you are building a new PBX from scratch or migrating an existing deployment, understanding how to configure a PJSIP trunk is an essential skill for any Asterisk administrator.

This guide walks you through a complete Asterisk PJSIP trunk setup using IPComms as your SIP trunking provider. We will cover both IP-based authentication (ideal for production servers with static IPs) and registration-based authentication (perfect for dynamic IPs or home labs), plus TLS/SRTP encryption for secure communications.

IPComms has been providing enterprise-grade voice solutions since 2002. With rates starting at just $0.01 per minute for US and Canada, no contracts and real human support, we are the preferred Asterisk VoIP provider for businesses of all sizes. Our infrastructure is purpose-built for SIP trunking, supporting both UDP and TLS signaling with SRTP media encryption at no additional cost.

By the end of this article, you will have a fully functional, production-ready PJSIP trunk connected to IPComms, with inbound and outbound calling working perfectly on your Asterisk system.

Prerequisites

Before you begin your Asterisk SIP trunk configuration, make sure you have the following in place:

• Asterisk 18, 20, or 21+ installed and running (with the res_pjsip module loaded)
• Root or sudo access to your Asterisk server
• An IPComms account -- sign up here if you do not have one yet
• A static public IP address (for IP authentication) or DNS hostname
• Firewall configured: UDP port 5060 (SIP signaling), UDP 10000-20000 (RTP media), or TCP port 5061 for TLS

Step 1: Sign Up for IPComms SIP Trunking

Getting started with IPComms takes less than five minutes. Here is what you need to do:

1. Create your account at portal.ipcomms.net. You will receive instant access to your dashboard.
2. Choose your SIP trunking plan. Plans start at just $5/month for the base service, which includes a free DID (phone number) and unlimited concurrent channels.
3. Configure authentication. In your portal, navigate to Trunks and either whitelist your server's public IP address (recommended for production) or generate registration credentials.
4. Note your SIP server details. Your assigned SIP server is s1.ipcomms.net (IP: 34.23.59.14).

Once your account is provisioned, you are ready to configure Asterisk. There is no waiting period -- your trunk is active immediately, so you can start making and receiving calls as soon as your PJSIP trunk provider configuration is complete.

Step 2: Configure PJSIP Transport

The transport section defines how your Asterisk server communicates at the network level. This is the foundation of your PJSIP transport configuration. Open your pjsip.conf file (typically at /etc/asterisk/pjsip.conf) and add the following transport section.

UDP Transport (Standard)

The local_net directives tell Asterisk which subnets are local (private). When communicating with addresses outside these ranges, Asterisk uses the external addresses, ensuring RTP media packets carry the correct public IP in SDP.

If your server has a public IP directly assigned (no NAT), you can omit the external_media_address, external_signaling_address, and local_net lines entirely.

Step 3: Configure the SIP Trunk (IP Authentication)

IP authentication is the recommended method for production Asterisk deployments. With IP auth, IPComms recognizes your server by its public IP address -- no usernames or passwords are transmitted over the network, making it both simpler and more secure.

This Asterisk SIP trunk configuration uses three PJSIP objects: an endpoint (defines call settings), an AOR (Address of Record, where to send calls), and an identify section (matches incoming traffic from IPComms by IP).

Configuration Explained

• context = from-ipcomms: Inbound calls from IPComms enter this dialplan context (defined in Step 5).
• allow = ulaw / alaw: G.711 codecs provide the best voice quality. IPComms supports both ulaw (North America) and alaw (international).
• direct_media = no: Forces all RTP media through Asterisk. Essential when behind NAT.
• trust_id_inbound = yes: Accepts caller ID information from IPComms, including CNAM.
• rtp_symmetric = yes: Sends RTP back to the address/port it was received from. Critical for NAT traversal.
• qualify_frequency = 60: Sends OPTIONS every 60 seconds to verify trunk reachability and keep NAT pinholes open.
• match = 34.23.59.14: Identifies incoming SIP traffic from IPComms and routes it to this endpoint.

Step 4: Configure the SIP Trunk (Registration Authentication)

If your Asterisk server has a dynamic IP address (common for home labs, development environments, or residential ISPs), you will need registration-based authentication. Your Asterisk server registers with IPComms periodically, and IPComms uses the registration to know where to send inbound calls.

The key differences are the auth and registration sections. The expiration = 3600 tells IPComms to expect re-registration every hour. The retry_interval = 60 means Asterisk retries every 60 seconds if registration fails.

Your credentials are available in the IPComms portal under Trunk Settings. Replace your_username and your_password with your actual credentials.

Step 5: Create the Dialplan

The dialplan in /etc/asterisk/extensions.conf controls call routing. You need two contexts: outbound (calls to PSTN via IPComms) and inbound (calls from IPComms to your extensions).

Outbound Dialplan

Inbound Dialplan

Understanding NANPA Patterns

The pattern _1NXXNXXXXXX is a standard North American Numbering Plan pattern:

• _ -- Pattern match prefix
• 1 -- Country code (US/Canada)
• N -- Digits 2-9
• X -- Digits 0-9
• . -- One or more of any digit

Add include => outbound-ipcomms to your phones' context to enable outbound calling through the IPComms trunk.

Step 6: Enable TLS/SRTP Encryption (Recommended)

For production environments, we strongly recommend TLS for SIP signaling and SRTP for media encryption. IPComms supports TLS 1.2 and TLS 1.3 with SRTP at no additional cost.

TLS encrypts SIP signaling (preventing eavesdropping on call metadata), while SRTP encrypts the audio stream. Together they provide end-to-end encryption between your Asterisk server and the IPComms network. For a deeper dive into encryption protocols, compliance requirements, and troubleshooting, see our SIP TLS & SRTP encryption guide.

TLS Transport

Enable SRTP on the Endpoint

Add to your [ipcomms] endpoint:

Update your AOR contact for TLS:

Step 7: Apply Configuration and Test

Reload the PJSIP module and verify connectivity. PJSIP can reload without restarting the Asterisk service, so existing calls are not interrupted.

Expected Output

The Avail status confirms Asterisk can reach IPComms. Make a test call and check the CDR in the IPComms portal.

Troubleshooting Common Issues

Here are the most common problems and solutions when setting up your Asterisk PJSIP trunk:

One-Way Audio or No Audio

Almost always a NAT issue. Verify:

• external_media_address set to your correct public IP
• direct_media = no on the endpoint
• rtp_symmetric = yes on the endpoint
• Firewall allows UDP 10000-20000 in both directions

Registration Failures (401/403)

• Double-check credentials in [ipcomms-auth]
• Verify client_uri format: sip:username@s1.ipcomms.net
• Ensure account is active in the portal

403 Forbidden on Outbound

• IP auth: Verify your public IP is whitelisted in the portal
• Check if IP changed (cloud instance reboot)
• Reg auth: Confirm registration is active via pjsip show registrations

Codec Mismatch (488)

• IPComms supports G.711 ulaw and G.711 alaw
• Ensure disallow=all comes before allow=ulaw

Debug Commands

Why Choose IPComms for Your Asterisk Trunk

Not all SIP trunking providers are equal. Here is why thousands of Asterisk administrators trust IPComms as their Asterisk VoIP provider:

Whether you run a home lab, small business PBX, or enterprise call center, IPComms scales with you. Learn more or get started today.