Pre-Configuration Checklist
Before configuring your SIP trunk, ensure the following prerequisites are met:
| Check Item | Requirement | Verification |
|---|---|---|
| Network Bandwidth | G.711: 87kbps/call, G.729: 31kbps/call | Formula: calls × per-call bandwidth × 1.3 overhead |
| SIP Signaling Port | 5060 UDP/TCP or 5061 TLS | telnet/traceroute port reachability test |
| RTP Media Ports | 10000-65535 UDP (open sub-range as needed) | Firewall rule confirmation |
| DNS Resolution | SIP domain resolves correctly | nslookup/dig verification |
| Static IP | Static public IP recommended | curl ifconfig.me to confirm |
| Time Sync | NTP synchronized, drift <1 second | ntpstat check |
Asterisk Configuration
sip.conf Example
; /etc/asterisk/sip.conf
[cainiao-trunk]
type=peer
host=sip.cainiaovoice.com
port=5060
transport=udp
context=from-cainiao
disallow=all
allow=g711
allow=g729
allow=g722
dtmfmode=rfc2833
insecure=port,invite
qualify=yes
qualifyfreq=60
nat=force_rport,comedia
canreinvite=no
; SIP registration (if required)
register => username:password@sip.cainiaovoice.com:5060/100extensions.conf Dialplan
; /etc/asterisk/extensions.conf
[from-cainiao]
; Inbound call handling
exten => _X.,1,NoOp(Inbound call from ${CALLERID(num)})
exten => _X.,n,Dial(SIP/1001,30)
exten => _X.,n,Hangup()
[outbound-cainiao]
; Domestic outbound
exten => _NXXXXXXXXX,1,NoOp(Calling ${EXTEN})
exten => _NXXXXXXXXX,n,Dial(SIP/cainiao-trunk/${EXTEN})
exten => _NXXXXXXXXX,n,Hangup()
; International outbound
exten => _011X.,1,NoOp(International call to ${EXTEN})
exten => _011X.,n,Dial(SIP/cainiao-trunk/${EXTEN:3})
exten => _011X.,n,Hangup()Key Configuration Notes
- dtmfmode=rfc2833: Recommended for best DTMF compatibility
- nat=force_rport,comedia: NAT traversal — resolves one-way audio issues
- qualify=yes: Enables keepalive heartbeat to monitor gateway connectivity
- canreinvite=no: Prevents direct RTP, ensuring media flows through Asterisk
FreeSWITCH Configuration
Gateway Configuration
<!-- /etc/freeswitch/sip_profiles/external/cainiao.xml -->
<include>
<gateway name="cainiao-trunk">
<param name="realm" value="sip.cainiaovoice.com"/>
<param name="username" value="your_username"/>
<param name="password" value="your_password"/>
<param name="register" value="true"/>
<param name="caller-id-in-from" value="true"/>
<param name="ping-interval" value="30"/>
<param name="extension" value="100"/>
</gateway>
</include>Dialplan
<!-- /etc/freeswitch/conf/dialplan/default.xml -->
<extension name="outbound-cainiao">
<condition field="destination_number" expression="^(.+)$">
<action application="set" data="effective_caller_id_number=your_did"/>
<action application="bridge" data="sofia/gateway/cainiao-trunk/$1"/>
</condition>
</extension>3CX Quick Setup
- Navigate to 3CX Admin → SIP Trunks → Add SIP Trunk
- Select "Generic SIP Trunk" template
- Enter: Main Server=sip.cainiaovoice.com, Port=5060
- Authentication ID=your_username, Password=your_password
- Select Bridge mode, configure STUN server (stun.3cx.com)
- Choose G.711 and G.729 codecs
- Create inbound/outbound routing rules
Cisco CUCM Setup
- Create SIP Trunk Security Profile: Device → Device Settings → SIP Trunk Security Profile
- Create SIP Profile: Select standard SIP Profile, enable SIP OPTIONS Ping
- Create SIP Trunk: Device → Trunk, select Security Profile and SIP Profile created above
- Configure Destination Address: sip.cainiaovoice.com:5060
- Create Route Pattern: Call Routing → Route/Hunt → Route Pattern
- Set Calling Search Space and Partition permissions
Troubleshooting Checklist
| Issue | Possible Cause | Troubleshooting Steps |
|---|---|---|
| One-way audio | NAT issues, RTP ports blocked | 1) Check firewall RTP ports 2) Configure nat parameters 3) Verify SDP IP reachable 4) Use rtp debug |
| Registration failure | Wrong credentials, port blocked | 1) sip debug for 401/403 2) telnet test port 5060 3) Verify username/password |
| DTMF not working | DTMF mode mismatch | 1) Verify matching dtmfmode 2) Prefer rfc2833 3) Avoid SIP INFO |
| Codec negotiation failure | No common codec | 1) sip debug for 488 response 2) Check disallow/allow 3) Ensure G.711 enabled |
| Call drops | SIP timeout, route instability | 1) Check qualify heartbeat 2) Review BYE reason code 3) Check jitter/packet loss |
| SIP 503 error | Service unavailable, capacity exceeded | 1) Check concurrent channels 2) Contact provider 3) Configure failover route |
Security Hardening Checklist
- IP Whitelisting: Only allow SIP provider IPs on ports 5060/5061 and RTP range
- SIP TLS: Use TLS (port 5061) to encrypt SIP signaling
- SRTP: Enable SRTP to encrypt RTP media streams
- Strong Passwords: 16+ character random passwords, rotate regularly
- fail2ban: Auto-ban malicious IPs attempting brute force
- International Call ACLs: Whitelist permitted international destinations to prevent toll fraud
- Spending Limits: Configure daily/monthly limits with anomaly alerts
- Disable Public AMI/HTTP: Never expose management interfaces to the internet
Cainiao Voice Security: Our SIP trunk service supports IP whitelist authentication by default, optional SIP TLS + SRTP encryption, and provides real-time traffic monitoring with anomaly alerts.
Frequently Asked Questions
Q: What ports need to be open for Asterisk SIP trunk?
A: Open SIP signaling port 5060 (UDP/TCP) or 5061 (TLS), and the RTP media port range (typically 10000-20000 UDP). Configure IP whitelisting on your firewall to only allow the SIP provider's IP addresses.
Q: How to configure FreeSWITCH SIP trunk gateway?
A: Create an XML gateway config file in /etc/freeswitch/sip_profiles/external/, setting realm (server address), username, password, and register parameters. Use sofia/gateway/gatewayname/number format in your dialplan.
Q: How to troubleshoot one-way audio?
A: One-way audio is typically caused by NAT issues. Steps: 1) Check RTP port firewall rules; 2) Configure nat=force_rport,comedia in Asterisk; 3) Set ext-rtp-ip and ext-sip-ip in FreeSWITCH; 4) Verify SDP IP addresses are reachable.
Q: Which DTMF mode should I use?
A: RFC2833 is recommended (dtmfmode=rfc2833 in Asterisk). SIP INFO has poor compatibility. INBAND requires G.711 codec. Most SIP trunk providers support RFC2833.
Q: How to prevent SIP toll fraud?
A: Measures include: 1) IP whitelisting for provider IPs only; 2) International call permission whitelists; 3) Daily spending limits; 4) fail2ban for brute force protection; 5) Strong passwords (16+ random characters); 6) Abnormal call pattern monitoring.
Need SIP Trunk Integration Support?
Cainiao Voice's technical team provides free Asterisk/FreeSWITCH/3CX configuration assistance
Free Consultation