How to connect Asterisk to a SIP trunk: working sip.conf and extensions.conf

This is a working how-to for connecting an Asterisk PBX to a NumberGroup SIP trunk. It uses our standard register-and-authenticate delivery model (your PBX registers to sip.numbergroup.com with the credentials we issue on the trunk) and covers the two config files you'll touch — sip.conf + extensions.conf for legacy chan_sip, or pjsip.conf + extensions.conf for modern chan_pjsip.

Key thing to know up front: when you ask us to set up the trunk, mention you want the User-Agent Type set to "DDI in R-URI (Asterisk)" and Send Numbers As set to "International (xx)". That presents the dialled DDI to your dialplan as 441214001262 in extension form — so a regex on exten = _44XXXXXXXXXX routes inbound by the real number rung.

chan_sip (Asterisk 13 and older defaults)

Edit /etc/asterisk/sip.conf — add a registration line and a peer entry for NumberGroup:

[general]
context=incoming                       ; default inbound context (define below)
bindaddr=0.0.0.0                       ; bind to all interfaces, or your WAN IP
allowoverlap=no
srvlookup=yes
language=en_GB
externip=YOUR.WAN.IP.HERE              ; required if you're behind NAT
localnet=192.168.0.0/255.255.0.0       ; your local subnet
nat=force_rport,comedia                ; standard NAT traversal

disallow=all
allow=ulaw
allow=alaw
allow=g722

; Register with NumberGroup so they know where to deliver inbound calls
register => T-102377-001:YOUR_PASSWORD@sip.numbergroup.com/T-102377-001

[numbergroup]
type=peer
host=sip.numbergroup.com
username=T-102377-001
fromuser=T-102377-001
fromdomain=sip.numbergroup.com
secret=YOUR_PASSWORD
context=incoming
insecure=port,invite
qualify=yes
canreinvite=no
dtmfmode=rfc2833
disallow=all
allow=ulaw
allow=alaw
allow=g722

Replace T-102377-001 with your real Authorisation ID and YOUR_PASSWORD with the trunk password from us.

extensions.conf — route inbound by DDI

Because we set the trunk's User-Agent Type to DDI in R-URI (Asterisk), the dialled number lands as the extension. So if you own 0121 400 1262 and someone rings it, Asterisk sees exten = 441214001262 (E.164).

[incoming]
; Route the main switchboard number to an IVR
exten => 441214001262,1,Answer()
exten => 441214001262,n,Wait(1)
exten => 441214001262,n,Goto(menu,start,1)

; Route a direct dial straight to an extension
exten => 441214001263,1,Dial(SIP/100,30)
exten => 441214001263,n,Voicemail(100@default,u)
exten => 441214001263,n,Hangup()

; Catch-all — useful while you're setting things up
exten => _X.,1,NoOp(Inbound to ${EXTEN})
exten => _X.,n,Dial(SIP/100,30)
exten => _X.,n,Voicemail(100@default,u)
exten => _X.,n,Hangup()

[outgoing]
; Outbound — route any external dial through the NumberGroup trunk
exten => _X.,1,Dial(SIP/numbergroup/${EXTEN},60)
exten => _X.,n,Hangup()

[menu]
exten => start,1,Background(custom/welcome)
exten => start,n,WaitExten(5)

exten => 1,1,Dial(SIP/100,30)            ; sales
exten => 2,1,Dial(SIP/200,30)            ; support
exten => i,1,Playback(invalid)
exten => i,n,Goto(start,1)
exten => t,1,Voicemail(100@default,u)
exten => t,n,Hangup()

chan_pjsip (Asterisk 18+ default)

chan_sip is deprecated. New installs should use chan_pjsip. Edit /etc/asterisk/pjsip.conf:

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0
external_media_address=YOUR.WAN.IP
external_signaling_address=YOUR.WAN.IP
local_net=192.168.0.0/16

; --- NumberGroup trunk -------------------------------------------------

[numbergroup]
type=registration
outbound_auth=numbergroup_auth
server_uri=sip:sip.numbergroup.com
client_uri=sip:T-102377-001@sip.numbergroup.com
retry_interval=60

[numbergroup_auth]
type=auth
auth_type=userpass
username=T-102377-001
password=YOUR_PASSWORD

[numbergroup]
type=aor
contact=sip:sip.numbergroup.com
qualify_frequency=30

[numbergroup]
type=endpoint
context=incoming
disallow=all
allow=ulaw,alaw,g722
outbound_auth=numbergroup_auth
aors=numbergroup
from_user=T-102377-001
from_domain=sip.numbergroup.com
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes

[numbergroup-identify]
type=identify
endpoint=numbergroup
match=sip.numbergroup.com

The dialplan in extensions.conf is identical to the chan_sip example — match the inbound extension to the dialled DDI in E.164 form.

Reload with:

asterisk -rx "pjsip reload"
asterisk -rx "dialplan reload"
asterisk -rx "pjsip show registrations"
asterisk -rx "pjsip show endpoint numbergroup"

Firewall and NAT

Open the following on your office firewall to sip.numbergroup.com:

• UDP 5060 outbound (SIP signalling)
• UDP 10000–20000 outbound (RTP audio — Asterisk default range)

Two NAT gotchas that catch ~80% of failed setups:

• Disable SIP ALG on your router. SIP ALG tries to be helpful and breaks signalling. Almost always wrong. Look for it under your router's WAN settings.
• Set externip / external_media_address to your real WAN IP. Otherwise inbound audio gets advertised with a 192.168.x.y address and goes nowhere. Symptom: phones ring, calls answer, no audio either way.

Debugging when it doesn't work

asterisk -rvvvv          ; verbose console
sip set debug on         ; chan_sip
pjsip set logger on      ; chan_pjsip
sip show registry        ; chan_sip — registration status
pjsip show registrations ; chan_pjsip — registration status
core show channels       ; active calls
rtp set debug on         ; trace RTP if audio is broken

Common failure modes

• Registration shows "Auth" or 401/403 — wrong Auth ID or password, or your fromdomain isn't sip.numbergroup.com.
• Trunk is "Unreachable" on our side — your firewall is blocking outbound 5060, or your router is dropping our return packets. SIP ALG is the usual suspect. Ring us and we'll confirm what we see.
• Calls ring but no audio (one-way audio) — NAT misconfigured. Set externip, localnet, nat=force_rport,comedia (or the chan_pjsip equivalents).
• 488 Not Acceptable Here — codec mismatch. Make sure you offer at least ulaw or alaw.

Advanced trunk options

• Allowed IP / DNS Addresses on the trunk — an extra security layer: lock the trunk to only register from your office IPs.
• Voice Mode → secure encrypted voice — ask us to enable this on the trunk to switch on TLS for signalling and SRTP for audio. Use the transport-tls + srtp_tag_32 equivalent on the Asterisk side.
• Fraud Detection (Simultaneous Calls + Daily Spend) — set sensible ceilings on the trunk so a compromised extension can't run up a bill over a weekend. See our telecom fraud guide for recommended thresholds.

Or skip Asterisk entirely

If you're running Asterisk because you love tinkering, brilliant — this config will get you live in minutes. If you're running it because you didn't know there was an alternative, NumberGroup Membership includes a hosted cloud PBX with the same features (IVR, hunt groups, recording, voicemail-to-email) — nothing to maintain, automatic updates, configured by our UK team for how your business actually answers calls. Same £149/mo flat.

Source: the device navigation in this guide follows Asterisk documentation. We keep the click-path with the manufacturer so it stays current — the NumberGroup trunk values above are the part specific to your account.