Configuration · guide

Setting up an Asterisk PBX with Twilio Elastic SIP Trunking

Asterisk

Verified 2026-09-24 · 60 sources · tier 2–3

For Administrators configuring an Asterisk PBX with Twilio Elastic SIP Trunking..

This guide steps through configuring an Asterisk PBX to place and receive PSTN calls through a Twilio Elastic SIP Trunk 49 34. The configuration pairs Asterisk PJSIP endpoints, transports, and dialplan logic with Twilio trunk origination and termination settings 4 37 54.

Before you start

The Asterisk project highly recommends installing a currently supported Asterisk release to receive ongoing bug and security fixes 46. An Asterisk Long Term Support (LTS) release receives 4 years of full support followed by 1 year of security-fix maintenance 26. Asterisk 22.x is an LTS release supported fully until 2028-10-16 and reaching end of life on 2029-10-16 59, while Asterisk 20.x transitions to security-fix-only maintenance on 2026-10-19 58. See also SIP trunk capacity and concurrent call planning. Asterisk 24.x is listed as an LTS release dated 2026-10-15 60.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

How will Twilio authenticate calls your Asterisk sends to it (termination)?

Will signaling and media to Twilio be encrypted?

Two questions. One permanent page you can send to your manager.

Step 1 Install Asterisk

Yes: Secure Trunking with TLS signaling and SRTP media

Do

Install libsrtp before compiling Asterisk, as Asterisk SRTP support depends on libsrtp being present prior to compilation 24. Then compile and install a currently supported Asterisk release 46.

Verify

Verify the PJSIP channel driver is loaded by executing pjsip show endpoints from the Asterisk command-line interface 11.

Rollback

Suggested rollback: uninstall the installed binaries and configuration files. If libsrtp was absent during compilation, install libsrtp and recompile Asterisk 24.

No: unencrypted SIP over UDP (or TCP) with RTP

Do

Compile and install a currently supported Asterisk release 46.

Verify

Verify the PJSIP channel driver is active by running pjsip show endpoints from the Asterisk command-line interface 11.

Rollback

Suggested rollback: uninstall the installed binaries and configuration files.

Step 2 Create the Twilio Elastic SIP Trunk and termination URI

Do

In the Twilio Console, create an Elastic SIP Trunk and define a termination SIP URI matching {example}.pstn.twilio.com, using dashes rather than dots in the chosen subdomain 49. If pinning signaling to a specific edge, configure the corresponding localized termination URI, such as {example}.pstn.ashburn.twilio.com, {example}.pstn.umatilla.twilio.com, {example}.pstn.dublin.twilio.com, or {example}.pstn.frankfurt.twilio.com 25.

Verify

Verify that the termination SIP URI is displayed in the trunk configuration in the Twilio Console 49.

Rollback

Suggested rollback: delete the created trunk in the management console.

Step 3 Configure termination authentication on the trunk

Username and password (credential list) only

Do

Create a SIP credential list in Twilio with a username of up to 32 characters and a password of at least 12 characters containing at least 1 digit and mixed case 9. Attach this credential list to the trunk termination settings to satisfy Twilio's requirement of having credential authentication or an IP access control list configured 48. Twilio highly recommends configuring credential authentication because IP access control lists alone do not protect against certain types of attacks 10.

Verify

Verify the credential list appears under the trunk termination authentication settings in the Twilio Console 48.

Rollback

Detach and delete the credential list from the trunk 48.

Source IP address (IP access control list) only

Do

Create a SIP IP access control list in Twilio containing the IP address that infrastructure uses for outbound SIP traffic 3. If configuring a range, specify an IPv4 address with a CIDR prefix length 2. Attach the IP access control list to the trunk termination settings 48.

Verify

Verify the IP access control list is attached to the trunk termination settings and contains the public IPv4 address 2 48.

Rollback

Detach and delete the IP access control list from the trunk 48.

Both credential list and IP access control list

Do

Create a credential list with a username up to 32 characters and a password of at least 12 characters containing at least 1 digit and mixed case 9. Create an IP access control list with the IPv4 address used for outbound SIP traffic 2 3. Attach both the credential list and the IP access control list to the trunk termination configuration, noting that Twilio enforces both when both are configured 48.

Verify

Verify that both the credential list and the IP access control list appear under trunk termination authentication in the Twilio Console 48.

Rollback

Detach either authentication method to leave a single mechanism, or detach both to remove all termination authentication 48.

Step 4 Configure trunk origination and Secure Trunking

Yes: Secure Trunking with TLS signaling and SRTP media

Do

Enable Secure Trunking in the Twilio trunk general settings 42. Add an origination SIP URI pointing to Asterisk's host or IP, appending ;transport=tls and specifying a port only if different from the default TLS port 5061 51 37. Up to 10 origination URIs may be added with a priority from 0 to 65535 and a weight to balance traffic across equal priorities 36. A Disaster Recovery URL pointing to a TwiML application may optionally be set for delivery failures 14.

Verify

Verify the origination URI lists ;transport=tls and Secure Trunking is shown as enabled 51 42.

Rollback

Disable Secure Trunking and delete the origination URI from the Twilio Console 42 37.

No: unencrypted SIP over UDP (or TCP) with RTP

Do

Leave Secure Trunking disabled on the trunk 42. Add an origination SIP URI pointing to Asterisk's IP address or fully qualified domain name, such as sip:172.56.42.132 or sip:mysbc.com 37. Twilio routes originating requests over UDP by default unless ;transport=tcp is appended 35. Configure priority and weight if defining multiple origination URIs 36. A Disaster Recovery URL pointing to a TwiML application may optionally be added 14.

Verify

Verify the origination URI is displayed in the trunk origination settings 37.

Rollback

Suggested rollback: delete the origination URI from the trunk in the management console.

Step 5 Associate Twilio phone numbers with the trunk

Do

Associate at least 1 Twilio phone number with the trunk in the Twilio Console, which is required for the trunk to receive inbound PSTN calls 34. Record the assigned phone numbers in E.164 format, which Twilio uses when delivering calls to customer equipment 15 and which Twilio accepts as valid caller ID values for outbound calls 7.

Verify

Verify that the numbers appear in the Numbers section of the trunk configuration 34.

Rollback

Remove the assigned phone numbers from the trunk in the Twilio Console 34.

Step 6 Configure PJSIP transport and NAT settings

Yes: Secure Trunking with TLS signaling and SRTP media

Do

In Asterisk pjsip.conf, define a TLS transport section with protocol=tls, bind=0.0.0.0:5061, cert_file, priv_key_file, and a method setting, following the secure-calling tutorial's transport pattern 52; Twilio requires TLS 1.2 or above for Secure Trunking 53. Configure the host operating system to trust Twilio's TLS certificate using Twilio's published root CAs 55. If Asterisk is located behind NAT, define local_net for internal subnets to exempt them from NAT handling 32, and configure external_signaling_address and external_media_address with the public address Asterisk writes into SIP and SDP headers sent outside local_net 31.

Verify

Suggested check: inspect the loaded PJSIP transport using Asterisk CLI commands.

Rollback

Suggested rollback: remove the TLS transport section from pjsip.conf and reload the module.

No: unencrypted SIP over UDP (or TCP) with RTP

Do

In Asterisk pjsip.conf, define a transport section with protocol=udp for signaling on port 5060, since Twilio sends originating SIP requests over UDP by default and its signaling uses port 5060 for UDP 35 43. If Asterisk is behind NAT, configure local_net to define the local network where NAT rewriting is avoided 32, and set external_signaling_address and external_media_address to Asterisk's external address 31.

Verify

Suggested check: check Asterisk CLI output to ensure the UDP transport is active.

Rollback

Suggested rollback: remove the UDP transport block from pjsip.conf and reload Asterisk.

Step 7 Define the Twilio endpoint, AOR, and identify sections

Yes: Secure Trunking with TLS signaling and SRTP media

Do

In pjsip.conf, configure the Twilio trunk objects without an outbound registration section, as Twilio instructs customers not to register 33 40. Create an AOR holding a static contact that points to Twilio's termination URI, as an endpoint cannot be contacted without an AOR 4 54. Create an identify section linking the Twilio endpoint to incoming traffic using match, entering Twilio's signaling CIDR ranges such as 54.172.60.0/30 and 54.244.51.0/30 21 20 43. Include all published ranges because Twilio may send traffic from any of them 1 and matching providers by IP prevents From-header mismatch issues 22. Define an endpoint section pointing to the TLS transport, set media_encryption=sdes (which enforces RFC 4568 keys used by Twilio) 28 44, set context to the inbound dialplan context 17, and configure direct_media=no to prevent direct media traversal 30 13. Origination calls from Twilio support only the AES_CM_128_HMAC_SHA1_80 SRTP suite 45.

Verify

Execute pjsip show endpoint <name> in the Asterisk CLI and verify that the endpoint lists the associated AOR, the TLS transport, and the Identify match lines 11.

Rollback

Remove the Twilio endpoint, AOR, and identify sections from pjsip.conf and reload Asterisk PJSIP 11.

No: unencrypted SIP over UDP (or TCP) with RTP

Do

In pjsip.conf, create an AOR with a static contact set to Twilio's termination URI, as an endpoint cannot be contacted without an associated AOR 4 54. Create an identify section mapping Twilio's signaling IP ranges in match using CIDR notation, covering all regions including 54.172.60.0/30 and 54.244.51.0/30 21 20 43 1 22. Define the Twilio endpoint with its context pointing to the inbound dialplan context 17, set direct_media=no 30 13, and leave media_encryption defaulted to no 28. Do not configure a registration section 33 40.

Verify

Run pjsip show endpoint <name> from the Asterisk CLI to confirm the endpoint, AOR, and identify configuration 11.

Rollback

Remove the endpoint, AOR, and identify sections from pjsip.conf and reload Asterisk PJSIP 11.

Step 8 Configure Asterisk termination authentication

Username and password (credential list) only

Do

In pjsip.conf, create an authentication section of type=auth with auth_type=userpass, setting the username of up to 32 characters and password of at least 12 characters configured for Twilio termination 5 9. In the Twilio endpoint configuration, reference this section with outbound_auth so Asterisk responds to Twilio's authentication challenges on outbound calls 54.

Verify

Execute pjsip show endpoint <name> in the Asterisk CLI to verify the auth object is listed under Outbound Auth 11.

Rollback

Remove outbound_auth from the endpoint, remove the auth section from pjsip.conf, and reload PJSIP 54.

Source IP address (IP access control list) only

Do

Ensure no auth section or outbound_auth setting is associated with the Twilio endpoint, as Twilio authenticates termination calls based entirely on source IP address matching the ACL 48 3.

Verify

Verify in Asterisk CLI with pjsip show endpoint <name> that no outbound auth object is attached 11.

Rollback

Suggested rollback: no configuration removal is necessary on Asterisk.

Both credential list and IP access control list

Do

In pjsip.conf, define an auth block of type=auth with auth_type=userpass using the configured username and password 5 9. Add outbound_auth to the Twilio endpoint block 54. Ensure Asterisk's SIP signaling originates from the IP address placed on Twilio's IP ACL, as Twilio enforces both credential and ACL verification 48 3.

Verify

Run pjsip show endpoint <name> in the Asterisk CLI and verify that the auth object appears under outbound auth 11.

Rollback

Remove outbound_auth and the auth block from pjsip.conf, noting that Twilio still enforces credential checks until detached in the console 48.

Step 9 Configure internal SIP phone endpoints

Do

In pjsip.conf, configure an endpoint, an inbound auth section, and an AOR for each local SIP phone 38. Ensure max_contacts is explicitly configured on each phone AOR, as registrations will fail if max_contacts is not set 27. For phones connecting across a remote NAT, configure rtp_symmetric, force_rport, and rewrite_contact on the endpoint to return traffic to the observed public source address and port 39.

Verify

Run pjsip show aor <name> in the Asterisk CLI to confirm each phone has successfully registered its contact binding 27.

Rollback

Suggested rollback: remove the endpoint, auth, and AOR sections for the phones from the configuration and reload the PJSIP channel driver.

Step 10 Configure inbound dialplan routing

Do

In extensions.conf, navigate to the dialplan context specified by the Twilio endpoint's context parameter 17. Twilio sends numbers to customer infrastructure in E.164 format 15.

Verify

Suggested check: verify the dialplan extensions are loaded using Asterisk dialplan CLI commands.

Rollback

Suggested rollback: remove the inbound extension patterns from the dialplan configuration and reload the dialplan.

Step 11 Configure outbound dialplan and caller ID

Do

In extensions.conf, within the context used by internal phones, configure outbound routing using Dial(PJSIP/${EXTEN}@twilio), which routes calls using the Twilio endpoint's AOR contact while populating the request URI username with the dialed digits 12. Ensure all dialed numbers sent to Twilio are formatted in E.164 with a leading +, as Twilio rejects non-E.164 numbers with SIP 400 Bad Request 16. Set the outbound caller ID to a Twilio number on the account or an authorized caller ID verified in the Twilio Console 7. If no caller ID is set in the SIP From header, Twilio checks the Remote-Party-ID or P-Asserted-Identity headers 8. See also Enterprise dial plan design and normalization.

Verify

Suggested check: review the outbound dialplan pattern using Asterisk dialplan CLI commands.

Rollback

Suggested rollback: remove the outbound dialplan patterns from the dialplan configuration and reload the dialplan.

Step 12 Configure RTP port ranges and firewall rules

Yes: Secure Trunking with TLS signaling and SRTP media

Do

In Asterisk rtp.conf, configure rtpstart and rtpend under [general] (the Asterisk sample configuration specifies ports 10000 to 20000, while built-in defaults are 5000 and 31000) 41. In your firewall, permit incoming TCP traffic on port 5061 from all Twilio signaling CIDR ranges, including 54.172.60.0/30 and 54.244.51.0/30 43 51. Twilio requires the customer firewall to allow all published signaling and media ranges and ports, which include the global media range 168.86.128.0/18 with RTP ports 10000 to 60000 29 1.

Verify

Suggested check: verify firewall rules and port listening states on the Asterisk host.

Rollback

Suggested rollback: restore previous firewall filtering rules and revert changes in rtp.conf.

No: unencrypted SIP over UDP (or TCP) with RTP

Do

In Asterisk rtp.conf, set rtpstart and rtpend in [general] to define the media port range 41. On the network firewall, permit incoming UDP (and TCP if used) on port 5060 from all Twilio signaling CIDRs, including 54.172.60.0/30 and 54.244.51.0/30 43. Twilio requires the customer firewall to allow all of its published signaling and media ranges and ports, including the media range 168.86.128.0/18 29 1.

Verify

Suggested check: inspect firewall table entries to ensure required signaling and media blocks are permitted.

Rollback

Suggested rollback: remove the opened firewall ports and reload the firewall configuration.

Step 13 Perform end-to-end call testing

Do

Enable SIP message logging in Asterisk by running pjsip set logger on from the Asterisk CLI 11. Place a test outbound call from an internal SIP phone to an external PSTN number, and place an inbound call from an external number to the Twilio number associated with the trunk 34.

Verify

Monitor the Asterisk console during both test calls:

For outbound calls, verify that the INVITE request URI contains a properly formatted E.164 number, as unformatted numbers receive a 400 Bad Request error from Twilio 16.
For inbound calls, verify that the call matches the Twilio endpoint; log messages stating Could not identify endpoint by username or Source address does not match identify indicate Twilio's signaling IP is missing from the identify match parameter 19. Asterisk issues 401 Unauthorized responses if a request fails endpoint identification, requiring IP identification checks before suspecting credentials 57.
When Secure Trunking is enabled, verify signaling and media are encrypted, as unencrypted calls are rejected by Twilio 42.
If one-way audio occurs, inspect the NAT external IP settings in pjsip.conf 31; Twilio's Symmetric RTP setting can be enabled on the trunk to direct return audio to the actual received source address 47.

Rollback

Turn off Asterisk SIP debugging from the CLI with pjsip set logger off 11.

Applicability

Applies to: Twilio Elastic SIP Trunking, Twilio Programmable Voice SIP API, and Sangoma Asterisk. Deployments: multi-tenant and self-hosted. Sources checked 2026-09-24. Asterisk LTS release 22.x has full support until 2028-10-16 and end-of-life on 2029-10-16 59, Asterisk 20.x moves to security-fix-only on 2026-10-19 with end-of-life on 2027-10-19 58, and Asterisk 24.x is listed as an LTS release dated 2026-10-15 60. The Asterisk interconnection guide linked from Twilio's configuration-guides page is version 2.1 dated 2018 56.

What remains uncertain

Sizing considerations prior to deployment are not covered by the sources below. Whether Twilio validates the certificate presented by Asterisk during TLS origination or termination handshakes is not covered by the sources below. The exact syntax for configuring the TLS contact URI in Asterisk PJSIP AOR sections to reach Twilio's secure termination URI is not covered by the sources below. Whether reloading Asterisk PJSIP transport configuration requires a full process restart rather than a module reload is not covered by the sources below. When Call Transfer is enabled on the trunk, Twilio consumes a SIP REFER from customer infrastructure and creates a new INVITE 6. Emergency calling provisioning, caller ID attestation, calls-per-second restrictions, and graphical management interfaces are not covered by the sources below.

Sources

1
Twilio requires the customer firewall to allow all of its published signaling and media ranges and ports, and the SIP infrastructure to accept signaling from any of those addresses at all times.
Elastic SIP Trunking IP addresses · Operational notes · Checked 2026-09-24
2
A Twilio SIP IP access control list entry accepts only an IPv4 address, optionally with a CIDR prefix length; by default the entire address is matched.
SIP IpAddress resource · Parameters > ip_address; cidr_prefix_length · Checked 2026-09-24
3
The addresses placed in a Twilio IP access control list for termination should be the IP addresses your infrastructure uses for outbound SIP traffic.
Elastic SIP Trunking · Termination > Authentication > IP Access Control Lists · Checked 2026-09-24
4
An Asterisk PJSIP AOR tells Asterisk where an endpoint can be contacted, and without an associated AOR an endpoint cannot be contacted.
PJSIP Configuration Sections and Relationships · AOR · Checked 2026-09-24
5
An Asterisk PJSIP auth section with auth_type=userpass holds a username and password.
res_pjsip Configuration Examples · A SIP trunk to your service provider (auth section) · Checked 2026-09-24
6
When the trunk's Call Transfer option is enabled, Twilio consumes a SIP REFER from the customer infrastructure and creates a new INVITE.
Elastic SIP Trunking · General settings > Call Transfer · Checked 2026-09-24
7
The caller ID number on a termination call must be a Twilio number on the account or a caller ID verified in the Twilio Console.
Elastic SIP Trunking · Termination Settings > Allowed Caller ID Numbers in Termination calls · Checked 2026-09-24
8
If no caller ID number is in the INVITE From field, Twilio uses the Remote-Party-ID or P-Asserted-Identity header instead.
Elastic SIP Trunking · Termination Settings > Allowed Caller ID Numbers in Termination calls · Checked 2026-09-24
9
A Twilio SIP credential password must be at least 12 characters, contain at least one digit and have mixed case, and the username can be up to 32 characters long.
SIP Credential resource · Parameters > Password; Username · Checked 2026-09-24
10
Twilio highly recommends configuring credential authentication for termination because IP access control lists alone do not protect against certain types of attacks.
Elastic SIP Trunking · Termination > Authentication · Checked 2026-09-24
11
Asterisk's PJSIP troubleshooting guide uses pjsip set logger on to show SIP traffic, pjsip show endpoints to confirm endpoints loaded, and pjsip show endpoint <name> to confirm its auth, AOR, transport and Identify lines.
Asterisk PJSIP Troubleshooting Guide · Essential Diagnostic Commands; Verifying Endpoint Configuration · Checked 2026-09-24
12
Dial(PJSIP/${EXTEN}@mytrunk) dials the contact in the AOR associated with the mytrunk endpoint while setting the user part of the request URI from the dial string.
Dialing PJSIP Channels · Dialing a trunk with a specific user · Checked 2026-09-24
13
The PJSIP endpoint direct_media option, which determines whether media may flow directly between endpoints, defaults to yes.
res_pjsip - Asterisk Documentation · endpoint > direct_media · Checked 2026-09-24
14
A trunk can have a Disaster Recovery URL pointing to a TwiML application that handles calls Twilio cannot deliver to the origination URIs.
Elastic SIP Trunking · Origination settings > Disaster Recovery URL · Checked 2026-09-24
15
Twilio sends numbers to the customer's SIP element in E.164 format.
A Step-by-Step Guide to Set Up Twilio Elastic SIP Trunking · Termination settings section, E.164 sentence · Checked 2026-09-24
16
Phone numbers sent to Twilio over SIP must be E.164-formatted, such as +12128675309, or Twilio rejects the call with SIP 400 Bad Request.
Elastic SIP Trunking · Termination (E.164 note) · Checked 2026-09-24
17
The PJSIP endpoint context option names the dialplan context used for inbound sessions from that endpoint and defaults to default.
res_pjsip - Asterisk Documentation · endpoint > context · Checked 2026-09-24
18
The firewall in front of Asterisk likely needs to admit UDP from Twilio's 168.86.128.0/18 media range to Asterisk's own rtpstart-rtpend range, since Twilio requires its media ranges allowed and Asterisk receives RTP only on that range.inferred
Elastic SIP Trunking IP addresses · Media gateways table and operational notes (combined with rtp.conf sample) · Checked 2026-09-24
19
Debug messages such as Could not identify endpoint by username or Source address does not match identify mean an incoming request was not matched to a configured endpoint.
Asterisk PJSIP Troubleshooting Guide · Inbound Call Issues > Unrecognized Endpoint Problem · Checked 2026-09-24
20
The identify match option takes a comma-delimited list of IP addresses or hostnames, and an IP address may carry a subnet mask in CIDR or dotted-decimal notation.
res_pjsip_endpoint_identifier_ip module configuration reference · identify > match · Checked 2026-09-24
21
An Asterisk PJSIP identify section maps incoming SIP traffic to an endpoint by the source IP address given in its match option.
PJSIP Configuration Sections and Relationships · IDENTIFY · Checked 2026-09-24
22
The Asterisk sample configuration matches trunk-provider calls by IP address rather than From user because the From user may differ on every call.
configs/samples/pjsip.conf.sample · ENDPOINT CONFIGURED AS A TRUNK, OUTBOUND AUTHENTICATION (identify comment) · Checked 2026-09-24
23
Because Twilio delivers the dialled number in E.164 form, inbound dialplan extensions for Twilio DIDs should be written to match the number including its leading plus sign.inferred
A Step-by-Step Guide to Set Up Twilio Elastic SIP Trunking · Termination settings section, E.164 sentence · Checked 2026-09-24
24
Asterisk SRTP support is provided by libsrtp, which must be installed before Asterisk is compiled.
Secure Calling Tutorial · Secure Calling Tutorial > SRTP prerequisites · Checked 2026-09-24
25
Twilio offers localized termination URIs that pin traffic to an edge, such as {example}.pstn.ashburn.twilio.com for North America Virginia, {example}.pstn.umatilla.twilio.com for Oregon, {example}.pstn.dublin.twilio.com for Ireland and {example}.pstn.frankfurt.twilio.com for Frankfurt.
Elastic SIP Trunking · Termination > Localized Termination URIs · Checked 2026-09-24
26
An Asterisk Long Term Support release is fully supported for 4 years with one additional year of security-fix maintenance.
Asterisk Versions · Asterisk Versions > LTS policy · Checked 2026-09-24
27
An Asterisk AOR must have max_contacts configured or registrations to it fail, and pjsip show aor displays the contacts bound to it.
Asterisk PJSIP Troubleshooting Guide · Registration Problems · Checked 2026-09-24
28
The PJSIP endpoint media_encryption option accepts no, sdes or dtls, defaults to no, and enforces the chosen media encryption for that endpoint.
res_pjsip - Asterisk Documentation · endpoint > media_encryption · Checked 2026-09-24
29
Twilio Elastic SIP Trunking media uses the global range 168.86.128.0/18 with RTP ports 10000 to 60000 at all edge locations.
Elastic SIP Trunking IP addresses · Media gateways table · Checked 2026-09-24
30
The Asterisk NAT configuration example sets direct_media=no on the endpoint.
Configuring res_pjsip to work through NAT · Example configuration (endpoint) · Checked 2026-09-24
31
On a PJSIP transport, external_media_address and external_signaling_address replace Asterisk's address in SDP and SIP signaling with the given external address when the destination lies outside local_net.
Configuring res_pjsip to work through NAT · external_media_address; external_signaling_address · Checked 2026-09-24
32
The PJSIP transport local_net option defines the local network, and NAT-related settings such as the external addresses are not applied to traffic within it.
Configuring res_pjsip to work through NAT · local_net · Checked 2026-09-24
33
Twilio instructs customers to configure their infrastructure not to register for an Elastic SIP Trunking trunk.
Elastic SIP Trunking · Your Network · Checked 2026-09-24
34
At least one Twilio phone number must be associated with the trunk before it can receive incoming PSTN calls.
Elastic SIP Trunking · Numbers · Checked 2026-09-24
35
Twilio sends originating SIP requests over UDP by default, and a transport parameter such as ;transport=tcp or ;transport=tls on the origination URI selects another transport.
Elastic SIP Trunking · Origination > Origination SIP URI (transport parameter) · Checked 2026-09-24
36
A Twilio trunk accepts up to 10 origination URIs, each with a priority from 0 to 65535 where the lowest number is most important, and a weight that shares load among URIs of equal priority.
Elastic SIP Trunking · Origination > Priority and Weight · Checked 2026-09-24
37
A Twilio origination SIP URI names where Twilio sends inbound calls, in forms such as sip:172.56.42.132 or sip:mysbc.com.
Elastic SIP Trunking · Origination > Origination SIP URI · Checked 2026-09-24
38
The Asterisk single-phone example uses an endpoint with auth (inbound authentication) and an AOR with max_contacts set so the phone can register.
res_pjsip Configuration Examples · An endpoint with a single SIP phone with inbound registration to Asterisk · Checked 2026-09-24
39
For phones behind a remote NAT, Asterisk documents the endpoint options rtp_symmetric, force_rport and rewrite_contact, which send RTP and SIP back to the observed source address and port.
Configuring res_pjsip to work through NAT · Endpoint options for remote NAT phones · Checked 2026-09-24
40
An Asterisk PJSIP registration section configures an outbound registration from Asterisk to another system.
PJSIP Configuration Sections and Relationships · REGISTRATION · Checked 2026-09-24
41
Asterisk's rtp.conf sets its RTP port range with rtpstart and rtpend in [general]; the sample file uses 10000 to 20000 and notes the built-in defaults are 5000 and 31000.
configs/samples/rtp.conf.sample · [general] rtpstart; rtpend · Checked 2026-09-24
42
When Secure Trunking is enabled on a Twilio trunk, any non-encrypted call is rejected.
Elastic SIP Trunking · Secure Trunking · Checked 2026-09-24
43
Twilio Elastic SIP Trunking signaling uses ports 5060 UDP/TCP and 5061 TLS from per-edge /30 ranges, including 54.172.60.0/30 for North America Virginia and 54.244.51.0/30 for North America Oregon.
Elastic SIP Trunking IP addresses · Signaling gateways table · Checked 2026-09-24
44
Twilio negotiates SRTP keys using SDP Security Descriptions (SDES) as defined in RFC 4568.
Elastic SIP Trunking · Secure Trunking > SRTP · Checked 2026-09-24
45
Twilio supports only the AES_CM_128_HMAC_SHA1_80 SRTP suite on origination calls, and both AES_CM_128_HMAC_SHA1_80 and AES_CM_128_HMAC_SHA1_32 on termination calls.
Elastic SIP Trunking · Secure Trunking > SRTP · Checked 2026-09-24
46
The Asterisk project highly recommends installing one of the currently supported versions because those continue to receive bug and security fixes.
What to Download? · What to Download? · Checked 2026-09-24
47
When the trunk's Symmetric RTP option is enabled, Twilio sends RTP to the address the remote stream actually arrives from rather than the one negotiated in SDP.
Elastic SIP Trunking · General settings > Symmetric RTP · Checked 2026-09-24
48
A Twilio trunk's termination must have at least an IP access control list or credential authentication configured, and if both are configured both are enforced.
Elastic SIP Trunking · Termination > Authentication · Checked 2026-09-24
49
A Twilio Elastic SIP Trunking termination SIP URI takes the form {example}.pstn.twilio.com, and Twilio recommends dashes rather than dots in the chosen name.
Elastic SIP Trunking · Termination > Termination SIP URI · Checked 2026-09-24
50
For a TLS and SRTP trunk to Twilio, the Asterisk endpoint likely needs its transport option pointed at the TLS transport, media_encryption=sdes, and an AOR contact that reaches the termination URI on port 5061 over TLS.inferred
Secure Calling Tutorial · Asterisk chan_pjsip configuration (combined with Twilio Secure Trunking section) · Checked 2026-09-24
51
With Secure Trunking, TLS uses port 5061 by default, another port may be given in the origination URI, and the origination URI must carry the transport=tls parameter.
Elastic SIP Trunking · Secure Trunking > TLS · Checked 2026-09-24
52
The Asterisk secure-calling tutorial defines a TLS transport with protocol=tls, bind=0.0.0.0:5061, cert_file, priv_key_file and a method setting.
Secure Calling Tutorial · Asterisk chan_pjsip configuration · Checked 2026-09-24
53
Twilio Secure Trunking supports TLS 1.2 and above for SIP signaling.
Elastic SIP Trunking · Secure Trunking > TLS > Supported TLS versions · Checked 2026-09-24
54
In the Asterisk ITSP trunk example the endpoint references its credentials with outbound_auth, used when the provider authenticates Asterisk's outbound requests, and the AOR holds a static contact for the provider.
res_pjsip Configuration Examples · A SIP trunk to your service provider, including outbound registration · Checked 2026-09-24
55
Devices that communicate directly with Twilio over TLS must be configured to trust Twilio's TLS certificate, for which Twilio publishes root CA certificates.
Elastic SIP Trunking · Secure Trunking > TLS > certificates · Checked 2026-09-24
56
The Asterisk interconnection guide Twilio links from its configuration-guides page is version 2.1 dated 2018.
Elastic SIP Trunking Configuration Guides · IP-PBX > Asterisk · Checked 2026-09-24
57
Asterisk answers 401 Unauthorized even to requests it cannot match to an endpoint, so identification should be checked before suspecting credentials.
Asterisk PJSIP Troubleshooting Guide · Inbound Call Issues > Authentication Failures · Checked 2026-09-24
58
Asterisk 20.x moves to security-fix-only on 2026-10-19 and reaches end of life on 2027-10-19.
Asterisk Versions · Version table, row 20.x · Checked 2026-09-24
59
Asterisk 22.x is an LTS release from 2024-10-16, fully supported until 2028-10-16 and end of life on 2029-10-16.
Asterisk Versions · Version table, row 22.x · Checked 2026-09-24
60
Asterisk 24.x is listed as an LTS release dated 2026-10-15, after this guide's research date.
Asterisk Versions · Version table, row 24.x · Checked 2026-09-24

Documents

tier 2 current vendor documentation

Cite this page

APA

WarmTransfer. (2026, September 24). Setting up an Asterisk PBX with Twilio Elastic SIP Trunking. WarmTransfer. https://warmtransfer.net/guides/asterisk-twilio-pbx-setup

BibTeX

@misc{warmtransfer-asterisk-twilio-pbx-setup,
  title  = {Setting up an Asterisk PBX with Twilio Elastic SIP Trunking},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/asterisk-twilio-pbx-setup},
  note   = {Verified 2026-09-24}
}