# Setting up an Asterisk PBX with Twilio Elastic SIP Trunking

Systems: Asterisk

For Administrators configuring an Asterisk PBX with Twilio Elastic SIP Trunking.

Canonical: https://warmtransfer.net/guides/asterisk-twilio-pbx-setup

Last verified: 2026-09-24

This guide steps through configuring an Asterisk PBX to place and receive PSTN calls through a Twilio Elastic SIP Trunk[^49][^34]. The configuration pairs Asterisk PJSIP endpoints, transports, and dialplan logic with Twilio trunk origination and termination settings[^4][^37][^54].

## Before you start

The Asterisk project highly recommends installing a currently supported Asterisk release to receive ongoing bug and security fixes[^46]. An Asterisk Long Term Support (LTS) release receives 4 years of full support followed by 1 year of security-fix maintenance[^26]. Asterisk 22.x is an LTS release supported fully until 2028-10-16 and reaching end of life on 2029-10-16[^59], while Asterisk 20.x transitions to security-fix-only maintenance on 2026-10-19[^58]. See also [SIP trunk capacity and concurrent call planning](https://warmtransfer.net/knowledge/sip-trunk-capacity-planning). Asterisk 24.x is listed as an LTS release dated 2026-10-15[^60].

## What changes by situation

- How will Twilio authenticate calls your Asterisk sends to it (termination)? Username and password (credential list) only; Source IP address (IP access control list) only; Both credential list and IP access control list.
- Will signaling and media to Twilio be encrypted? Yes: Secure Trunking with TLS signaling and SRTP media; No: unencrypted SIP over UDP (or TCP) with RTP.

## Step 1: Install Asterisk

**Yes: Secure Trunking with TLS signaling and SRTP media**

### Do
Install libsrtp before compiling Asterisk, as Asterisk SRTP support depends on libsrtp being present prior to compilation[^24]. Then compile and install a currently supported Asterisk release[^46].

### Verify
Verify the PJSIP channel driver is loaded by executing `pjsip show endpoints` from the Asterisk command-line interface[^11].

### Rollback
Suggested rollback: uninstall the installed binaries and configuration files. If libsrtp was absent during compilation, install libsrtp and recompile Asterisk[^24].

**No: unencrypted SIP over UDP (or TCP) with RTP**

### Do
Compile and install a currently supported Asterisk release[^46].

### Verify
Verify the PJSIP channel driver is active by running `pjsip show endpoints` from the Asterisk command-line interface[^11].

### Rollback
Suggested rollback: uninstall the installed binaries and configuration files.

## Step 2: Create the Twilio Elastic SIP Trunk and termination URI

### Do
In the Twilio Console, create an Elastic SIP Trunk and define a termination SIP URI matching `{example}.pstn.twilio.com`, using dashes rather than dots in the chosen subdomain[^49]. If pinning signaling to a specific edge, configure the corresponding localized termination URI, such as `{example}.pstn.ashburn.twilio.com`, `{example}.pstn.umatilla.twilio.com`, `{example}.pstn.dublin.twilio.com`, or `{example}.pstn.frankfurt.twilio.com`[^25].

### Verify
Verify that the termination SIP URI is displayed in the trunk configuration in the Twilio Console[^49].

### Rollback
Suggested rollback: delete the created trunk in the management console.

## Step 3: Configure termination authentication on the trunk

**Username and password (credential list) only**

### Do
Create a SIP credential list in Twilio with a username of up to 32 characters and a password of at least 12 characters containing at least 1 digit and mixed case[^9]. Attach this credential list to the trunk termination settings to satisfy Twilio's requirement of having credential authentication or an IP access control list configured[^48]. Twilio highly recommends configuring credential authentication because IP access control lists alone do not protect against certain types of attacks[^10].

### Verify
Verify the credential list appears under the trunk termination authentication settings in the Twilio Console[^48].

### Rollback
Detach and delete the credential list from the trunk[^48].

**Source IP address (IP access control list) only**

### Do
Create a SIP IP access control list in Twilio containing the IP address that infrastructure uses for outbound SIP traffic[^3]. If configuring a range, specify an IPv4 address with a CIDR prefix length[^2]. Attach the IP access control list to the trunk termination settings[^48].

### Verify
Verify the IP access control list is attached to the trunk termination settings and contains the public IPv4 address[^2][^48].

### Rollback
Detach and delete the IP access control list from the trunk[^48].

**Both credential list and IP access control list**

### Do
Create a credential list with a username up to 32 characters and a password of at least 12 characters containing at least 1 digit and mixed case[^9]. Create an IP access control list with the IPv4 address used for outbound SIP traffic[^2][^3]. Attach both the credential list and the IP access control list to the trunk termination configuration, noting that Twilio enforces both when both are configured[^48].

### Verify
Verify that both the credential list and the IP access control list appear under trunk termination authentication in the Twilio Console[^48].

### Rollback
Detach either authentication method to leave a single mechanism, or detach both to remove all termination authentication[^48].

## Step 4: Configure trunk origination and Secure Trunking

**Yes: Secure Trunking with TLS signaling and SRTP media**

### Do
Enable Secure Trunking in the Twilio trunk general settings[^42]. Add an origination SIP URI pointing to Asterisk's host or IP, appending `;transport=tls` and specifying a port only if different from the default TLS port 5061[^51][^37]. Up to 10 origination URIs may be added with a priority from 0 to 65535 and a weight to balance traffic across equal priorities[^36]. A Disaster Recovery URL pointing to a TwiML application may optionally be set for delivery failures[^14].

### Verify
Verify the origination URI lists `;transport=tls` and Secure Trunking is shown as enabled[^51][^42].

### Rollback
Disable Secure Trunking and delete the origination URI from the Twilio Console[^42][^37].

**No: unencrypted SIP over UDP (or TCP) with RTP**

### Do
Leave Secure Trunking disabled on the trunk[^42]. Add an origination SIP URI pointing to Asterisk's IP address or fully qualified domain name, such as `sip:172.56.42.132` or `sip:mysbc.com`[^37]. Twilio routes originating requests over UDP by default unless `;transport=tcp` is appended[^35]. Configure priority and weight if defining multiple origination URIs[^36]. A Disaster Recovery URL pointing to a TwiML application may optionally be added[^14].

### Verify
Verify the origination URI is displayed in the trunk origination settings[^37].

### Rollback
Suggested rollback: delete the origination URI from the trunk in the management console.

## Step 5: Associate Twilio phone numbers with the trunk

### Do
Associate at least 1 Twilio phone number with the trunk in the Twilio Console, which is required for the trunk to receive inbound PSTN calls[^34]. Record the assigned phone numbers in E.164 format, which Twilio uses when delivering calls to customer equipment[^15] and which Twilio accepts as valid caller ID values for outbound calls[^7].

### Verify
Verify that the numbers appear in the Numbers section of the trunk configuration[^34].

### Rollback
Remove the assigned phone numbers from the trunk in the Twilio Console[^34].

## Step 6: Configure PJSIP transport and NAT settings

**Yes: Secure Trunking with TLS signaling and SRTP media**

### Do
In Asterisk `pjsip.conf`, define a TLS transport section with `protocol=tls`, `bind=0.0.0.0:5061`, `cert_file`, `priv_key_file`, and a `method` setting, following the secure-calling tutorial's transport pattern[^52]; Twilio requires TLS 1.2 or above for Secure Trunking[^53]. Configure the host operating system to trust Twilio's TLS certificate using Twilio's published root CAs[^55]. If Asterisk is located behind NAT, define `local_net` for internal subnets to exempt them from NAT handling[^32], and configure `external_signaling_address` and `external_media_address` with the public address Asterisk writes into SIP and SDP headers sent outside `local_net`[^31].

### Verify
Suggested check: inspect the loaded PJSIP transport using Asterisk CLI commands.

### Rollback
Suggested rollback: remove the TLS transport section from `pjsip.conf` and reload the module.

**No: unencrypted SIP over UDP (or TCP) with RTP**

### Do
In Asterisk `pjsip.conf`, define a transport section with `protocol=udp` for signaling on port 5060, since Twilio sends originating SIP requests over UDP by default and its signaling uses port 5060 for UDP[^35][^43]. If Asterisk is behind NAT, configure `local_net` to define the local network where NAT rewriting is avoided[^32], and set `external_signaling_address` and `external_media_address` to Asterisk's external address[^31].

### Verify
Suggested check: check Asterisk CLI output to ensure the UDP transport is active.

### Rollback
Suggested rollback: remove the UDP transport block from `pjsip.conf` and reload Asterisk.

## Step 7: Define the Twilio endpoint, AOR, and identify sections

**Yes: Secure Trunking with TLS signaling and SRTP media**

### Do
In `pjsip.conf`, configure the Twilio trunk objects without an outbound registration section, as Twilio instructs customers not to register[^33][^40]. Create an AOR holding a static contact that points to Twilio's termination URI, as an endpoint cannot be contacted without an AOR[^4][^54]. Create an identify section linking the Twilio endpoint to incoming traffic using `match`, entering Twilio's signaling CIDR ranges such as `54.172.60.0/30` and `54.244.51.0/30`[^21][^20][^43]. Include all published ranges because Twilio may send traffic from any of them[^1] and matching providers by IP prevents From-header mismatch issues[^22]. Define an endpoint section pointing to the TLS transport, set `media_encryption=sdes` (which enforces RFC 4568 keys used by Twilio)[^28][^44], set `context` to the inbound dialplan context[^17], and configure `direct_media=no` to prevent direct media traversal[^30][^13]. Origination calls from Twilio support only the AES_CM_128_HMAC_SHA1_80 SRTP suite[^45].

### Verify
Execute `pjsip show endpoint <name>` in the Asterisk CLI and verify that the endpoint lists the associated AOR, the TLS transport, and the Identify match lines[^11].

### Rollback
Remove the Twilio endpoint, AOR, and identify sections from `pjsip.conf` and reload Asterisk PJSIP[^11].

**No: unencrypted SIP over UDP (or TCP) with RTP**

### Do
In `pjsip.conf`, create an AOR with a static contact set to Twilio's termination URI, as an endpoint cannot be contacted without an associated AOR[^4][^54]. Create an identify section mapping Twilio's signaling IP ranges in `match` using CIDR notation, covering all regions including `54.172.60.0/30` and `54.244.51.0/30`[^21][^20][^43][^1][^22]. Define the Twilio endpoint with its `context` pointing to the inbound dialplan context[^17], set `direct_media=no`[^30][^13], and leave `media_encryption` defaulted to `no`[^28]. Do not configure a registration section[^33][^40].

### Verify
Run `pjsip show endpoint <name>` from the Asterisk CLI to confirm the endpoint, AOR, and identify configuration[^11].

### Rollback
Remove the endpoint, AOR, and identify sections from `pjsip.conf` and reload Asterisk PJSIP[^11].

## Step 8: Configure Asterisk termination authentication

**Username and password (credential list) only**

### Do
In `pjsip.conf`, create an authentication section of `type=auth` with `auth_type=userpass`, setting the username of up to 32 characters and password of at least 12 characters configured for Twilio termination[^5][^9]. In the Twilio endpoint configuration, reference this section with `outbound_auth` so Asterisk responds to Twilio's authentication challenges on outbound calls[^54].

### Verify
Execute `pjsip show endpoint <name>` in the Asterisk CLI to verify the auth object is listed under `Outbound Auth`[^11].

### Rollback
Remove `outbound_auth` from the endpoint, remove the auth section from `pjsip.conf`, and reload PJSIP[^54].

**Source IP address (IP access control list) only**

### Do
Ensure no auth section or `outbound_auth` setting is associated with the Twilio endpoint, as Twilio authenticates termination calls based entirely on source IP address matching the ACL[^48][^3].

### Verify
Verify in Asterisk CLI with `pjsip show endpoint <name>` that no outbound auth object is attached[^11].

### Rollback
Suggested rollback: no configuration removal is necessary on Asterisk.

**Both credential list and IP access control list**

### Do
In `pjsip.conf`, define an auth block of `type=auth` with `auth_type=userpass` using the configured username and password[^5][^9]. Add `outbound_auth` to the Twilio endpoint block[^54]. Ensure Asterisk's SIP signaling originates from the IP address placed on Twilio's IP ACL, as Twilio enforces both credential and ACL verification[^48][^3].

### Verify
Run `pjsip show endpoint <name>` in the Asterisk CLI and verify that the auth object appears under outbound auth[^11].

### Rollback
Remove `outbound_auth` and the auth block from `pjsip.conf`, noting that Twilio still enforces credential checks until detached in the console[^48].

## Step 9: Configure internal SIP phone endpoints

### Do
In `pjsip.conf`, configure an endpoint, an inbound `auth` section, and an AOR for each local SIP phone[^38]. Ensure `max_contacts` is explicitly configured on each phone AOR, as registrations will fail if `max_contacts` is not set[^27]. For phones connecting across a remote NAT, configure `rtp_symmetric`, `force_rport`, and `rewrite_contact` on the endpoint to return traffic to the observed public source address and port[^39].

### Verify
Run `pjsip show aor <name>` in the Asterisk CLI to confirm each phone has successfully registered its contact binding[^27].

### Rollback
Suggested rollback: remove the endpoint, auth, and AOR sections for the phones from the configuration and reload the PJSIP channel driver.

## Step 10: Configure inbound dialplan routing

### Do
In `extensions.conf`, navigate to the dialplan context specified by the Twilio endpoint's `context` parameter[^17]. Twilio sends numbers to customer infrastructure in E.164 format[^15].

### Verify
Suggested check: verify the dialplan extensions are loaded using Asterisk dialplan CLI commands.

### Rollback
Suggested rollback: remove the inbound extension patterns from the dialplan configuration and reload the dialplan.

## Step 11: Configure outbound dialplan and caller ID

### Do
In `extensions.conf`, within the context used by internal phones, configure outbound routing using `Dial(PJSIP/${EXTEN}@twilio)`, which routes calls using the Twilio endpoint's AOR contact while populating the request URI username with the dialed digits[^12]. Ensure all dialed numbers sent to Twilio are formatted in E.164 with a leading `+`, as Twilio rejects non-E.164 numbers with SIP 400 Bad Request[^16]. Set the outbound caller ID to a Twilio number on the account or an authorized caller ID verified in the Twilio Console[^7]. If no caller ID is set in the SIP From header, Twilio checks the Remote-Party-ID or P-Asserted-Identity headers[^8]. See also [Enterprise dial plan design and normalization](https://warmtransfer.net/knowledge/dial-plan-design).

### Verify
Suggested check: review the outbound dialplan pattern using Asterisk dialplan CLI commands.

### Rollback
Suggested rollback: remove the outbound dialplan patterns from the dialplan configuration and reload the dialplan.

## Step 12: Configure RTP port ranges and firewall rules

**Yes: Secure Trunking with TLS signaling and SRTP media**

### Do
In Asterisk `rtp.conf`, configure `rtpstart` and `rtpend` under `[general]` (the Asterisk sample configuration specifies ports 10000 to 20000, while built-in defaults are 5000 and 31000)[^41]. In your firewall, permit incoming TCP traffic on port 5061 from all Twilio signaling CIDR ranges, including `54.172.60.0/30` and `54.244.51.0/30`[^43][^51]. Twilio requires the customer firewall to allow all published signaling and media ranges and ports, which include the global media range 168.86.128.0/18 with RTP ports 10000 to 60000[^29][^1].

### Verify
Suggested check: verify firewall rules and port listening states on the Asterisk host.

### Rollback
Suggested rollback: restore previous firewall filtering rules and revert changes in `rtp.conf`.

**No: unencrypted SIP over UDP (or TCP) with RTP**

### Do
In Asterisk `rtp.conf`, set `rtpstart` and `rtpend` in `[general]` to define the media port range[^41]. On the network firewall, permit incoming UDP (and TCP if used) on port 5060 from all Twilio signaling CIDRs, including `54.172.60.0/30` and `54.244.51.0/30`[^43]. Twilio requires the customer firewall to allow all of its published signaling and media ranges and ports, including the media range 168.86.128.0/18[^29][^1].

### Verify
Suggested check: inspect firewall table entries to ensure required signaling and media blocks are permitted.

### Rollback
Suggested rollback: remove the opened firewall ports and reload the firewall configuration.

## Step 13: Perform end-to-end call testing

### Do
Enable SIP message logging in Asterisk by running `pjsip set logger on` from the Asterisk CLI[^11]. Place a test outbound call from an internal SIP phone to an external PSTN number, and place an inbound call from an external number to the Twilio number associated with the trunk[^34].

### Verify
Monitor the Asterisk console during both test calls:
- For outbound calls, verify that the INVITE request URI contains a properly formatted E.164 number, as unformatted numbers receive a 400 Bad Request error from Twilio[^16].
- For inbound calls, verify that the call matches the Twilio endpoint; log messages stating `Could not identify endpoint by username` or `Source address does not match identify` indicate Twilio's signaling IP is missing from the identify `match` parameter[^19]. Asterisk issues 401 Unauthorized responses if a request fails endpoint identification, requiring IP identification checks before suspecting credentials[^57].
- When Secure Trunking is enabled, verify signaling and media are encrypted, as unencrypted calls are rejected by Twilio[^42].
- If one-way audio occurs, inspect the NAT external IP settings in `pjsip.conf`[^31]; Twilio's Symmetric RTP setting can be enabled on the trunk to direct return audio to the actual received source address[^47].

### Rollback
Turn off Asterisk SIP debugging from the CLI with `pjsip set logger off`[^11].

## Applicability

Applies to: Twilio Elastic SIP Trunking, Twilio Programmable Voice SIP API, and Sangoma Asterisk. Deployments: multi-tenant and self-hosted. Sources checked 2026-09-24. Asterisk LTS release 22.x has full support until 2028-10-16 and end-of-life on 2029-10-16[^59], Asterisk 20.x moves to security-fix-only on 2026-10-19 with end-of-life on 2027-10-19[^58], and Asterisk 24.x is listed as an LTS release dated 2026-10-15[^60]. The Asterisk interconnection guide linked from Twilio's configuration-guides page is version 2.1 dated 2018[^56].

## What remains uncertain

Sizing considerations prior to deployment are not covered by the sources below. Whether Twilio validates the certificate presented by Asterisk during TLS origination or termination handshakes is not covered by the sources below. The exact syntax for configuring the TLS contact URI in Asterisk PJSIP AOR sections to reach Twilio's secure termination URI is not covered by the sources below. Whether reloading Asterisk PJSIP transport configuration requires a full process restart rather than a module reload is not covered by the sources below. When Call Transfer is enabled on the trunk, Twilio consumes a SIP REFER from customer infrastructure and creates a new INVITE[^6]. Emergency calling provisioning, caller ID attestation, calls-per-second restrictions, and graphical management interfaces are not covered by the sources below.

## Sources

[^1]: Twilio requires the customer firewall to allow all of its published signaling and media ranges and ports, and the SIP infrastructure to accept signaling from any of those addresses at all times. Source: [Elastic SIP Trunking IP addresses](https://www.twilio.com/docs/sip-trunking/ip-addresses), Operational notes. Checked 2026-09-24.
[^2]: A Twilio SIP IP access control list entry accepts only an IPv4 address, optionally with a CIDR prefix length; by default the entire address is matched. Source: [SIP IpAddress resource](https://www.twilio.com/docs/voice/sip/api/sip-ipaddress-resource), Parameters > ip_address; cidr_prefix_length. Checked 2026-09-24.
[^3]: The addresses placed in a Twilio IP access control list for termination should be the IP addresses your infrastructure uses for outbound SIP traffic. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Termination > Authentication > IP Access Control Lists. Checked 2026-09-24.
[^4]: An Asterisk PJSIP AOR tells Asterisk where an endpoint can be contacted, and without an associated AOR an endpoint cannot be contacted. Source: [PJSIP Configuration Sections and Relationships](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/PJSIP-Configuration-Sections-and-Relationships/), AOR. Checked 2026-09-24.
[^5]: An Asterisk PJSIP auth section with auth_type=userpass holds a username and password. Source: [res_pjsip Configuration Examples](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/res_pjsip-Configuration-Examples/), A SIP trunk to your service provider (auth section). Checked 2026-09-24.
[^6]: When the trunk's Call Transfer option is enabled, Twilio consumes a SIP REFER from the customer infrastructure and creates a new INVITE. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), General settings > Call Transfer. Checked 2026-09-24.
[^7]: The caller ID number on a termination call must be a Twilio number on the account or a caller ID verified in the Twilio Console. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Termination Settings > Allowed Caller ID Numbers in Termination calls. Checked 2026-09-24.
[^8]: If no caller ID number is in the INVITE From field, Twilio uses the Remote-Party-ID or P-Asserted-Identity header instead. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Termination Settings > Allowed Caller ID Numbers in Termination calls. Checked 2026-09-24.
[^9]: A Twilio SIP credential password must be at least 12 characters, contain at least one digit and have mixed case, and the username can be up to 32 characters long. Source: [SIP Credential resource](https://www.twilio.com/docs/voice/sip/api/sip-credential-resource), Parameters > Password; Username. Checked 2026-09-24.
[^10]: Twilio highly recommends configuring credential authentication for termination because IP access control lists alone do not protect against certain types of attacks. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Termination > Authentication. Checked 2026-09-24.
[^11]: Asterisk's PJSIP troubleshooting guide uses pjsip set logger on to show SIP traffic, pjsip show endpoints to confirm endpoints loaded, and pjsip show endpoint <name> to confirm its auth, AOR, transport and Identify lines. Source: [Asterisk PJSIP Troubleshooting Guide](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Asterisk-PJSIP-Troubleshooting-Guide/), Essential Diagnostic Commands; Verifying Endpoint Configuration. Checked 2026-09-24.
[^12]: Dial(PJSIP/${EXTEN}@mytrunk) dials the contact in the AOR associated with the mytrunk endpoint while setting the user part of the request URI from the dial string. Source: [Dialing PJSIP Channels](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Dialing-PJSIP-Channels/), Dialing a trunk with a specific user. Checked 2026-09-24.
[^13]: The PJSIP endpoint direct_media option, which determines whether media may flow directly between endpoints, defaults to yes. Source: [res_pjsip - Asterisk Documentation](https://docs.asterisk.org/Latest_API/API_Documentation/Module_Configuration/res_pjsip/), endpoint > direct_media. Checked 2026-09-24.
[^14]: A trunk can have a Disaster Recovery URL pointing to a TwiML application that handles calls Twilio cannot deliver to the origination URIs. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Origination settings > Disaster Recovery URL. Checked 2026-09-24.
[^15]: Twilio sends numbers to the customer's SIP element in E.164 format. Source: [A Step-by-Step Guide to Set Up Twilio Elastic SIP Trunking](https://www.twilio.com/en-us/blog/elastic-sip-trunking-step-by-step-setup), Termination settings section, E.164 sentence. Checked 2026-09-24.
[^16]: Phone numbers sent to Twilio over SIP must be E.164-formatted, such as +12128675309, or Twilio rejects the call with SIP 400 Bad Request. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Termination (E.164 note). Checked 2026-09-24.
[^17]: The PJSIP endpoint context option names the dialplan context used for inbound sessions from that endpoint and defaults to default. Source: [res_pjsip - Asterisk Documentation](https://docs.asterisk.org/Latest_API/API_Documentation/Module_Configuration/res_pjsip/), endpoint > context. Checked 2026-09-24.
[^18]: The firewall in front of Asterisk likely needs to admit UDP from Twilio's 168.86.128.0/18 media range to Asterisk's own rtpstart-rtpend range, since Twilio requires its media ranges allowed and Asterisk receives RTP only on that range (inferred). Source: [Elastic SIP Trunking IP addresses](https://www.twilio.com/docs/sip-trunking/ip-addresses), Media gateways table and operational notes (combined with rtp.conf sample). Checked 2026-09-24.
[^19]: Debug messages such as Could not identify endpoint by username or Source address does not match identify mean an incoming request was not matched to a configured endpoint. Source: [Asterisk PJSIP Troubleshooting Guide](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Asterisk-PJSIP-Troubleshooting-Guide/), Inbound Call Issues > Unrecognized Endpoint Problem. Checked 2026-09-24.
[^20]: The identify match option takes a comma-delimited list of IP addresses or hostnames, and an IP address may carry a subnet mask in CIDR or dotted-decimal notation. Source: [res_pjsip_endpoint_identifier_ip module configuration reference](https://docs.asterisk.org/Latest_API/API_Documentation/Module_Configuration/res_pjsip_endpoint_identifier_ip/), identify > match. Checked 2026-09-24.
[^21]: An Asterisk PJSIP identify section maps incoming SIP traffic to an endpoint by the source IP address given in its match option. Source: [PJSIP Configuration Sections and Relationships](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/PJSIP-Configuration-Sections-and-Relationships/), IDENTIFY. Checked 2026-09-24.
[^22]: The Asterisk sample configuration matches trunk-provider calls by IP address rather than From user because the From user may differ on every call. Source: [configs/samples/pjsip.conf.sample](https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample), ENDPOINT CONFIGURED AS A TRUNK, OUTBOUND AUTHENTICATION (identify comment). Checked 2026-09-24.
[^23]: Because Twilio delivers the dialled number in E.164 form, inbound dialplan extensions for Twilio DIDs should be written to match the number including its leading plus sign (inferred). Source: [A Step-by-Step Guide to Set Up Twilio Elastic SIP Trunking](https://www.twilio.com/en-us/blog/elastic-sip-trunking-step-by-step-setup), Termination settings section, E.164 sentence. Checked 2026-09-24.
[^24]: Asterisk SRTP support is provided by libsrtp, which must be installed before Asterisk is compiled. Source: [Secure Calling Tutorial](https://docs.asterisk.org/Deployment/Secure-Calling/Secure-Calling-Tutorial/), Secure Calling Tutorial > SRTP prerequisites. Checked 2026-09-24.
[^25]: Twilio offers localized termination URIs that pin traffic to an edge, such as {example}.pstn.ashburn.twilio.com for North America Virginia, {example}.pstn.umatilla.twilio.com for Oregon, {example}.pstn.dublin.twilio.com for Ireland and {example}.pstn.frankfurt.twilio.com for Frankfurt. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Termination > Localized Termination URIs. Checked 2026-09-24.
[^26]: An Asterisk Long Term Support release is fully supported for 4 years with one additional year of security-fix maintenance. Source: [Asterisk Versions](https://docs.asterisk.org/About-the-Project/Asterisk-Versions/), Asterisk Versions > LTS policy. Checked 2026-09-24.
[^27]: An Asterisk AOR must have max_contacts configured or registrations to it fail, and pjsip show aor displays the contacts bound to it. Source: [Asterisk PJSIP Troubleshooting Guide](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Asterisk-PJSIP-Troubleshooting-Guide/), Registration Problems. Checked 2026-09-24.
[^28]: The PJSIP endpoint media_encryption option accepts no, sdes or dtls, defaults to no, and enforces the chosen media encryption for that endpoint. Source: [res_pjsip - Asterisk Documentation](https://docs.asterisk.org/Latest_API/API_Documentation/Module_Configuration/res_pjsip/), endpoint > media_encryption. Checked 2026-09-24.
[^29]: Twilio Elastic SIP Trunking media uses the global range 168.86.128.0/18 with RTP ports 10000 to 60000 at all edge locations. Source: [Elastic SIP Trunking IP addresses](https://www.twilio.com/docs/sip-trunking/ip-addresses), Media gateways table. Checked 2026-09-24.
[^30]: The Asterisk NAT configuration example sets direct_media=no on the endpoint. Source: [Configuring res_pjsip to work through NAT](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Configuring-res_pjsip-to-work-through-NAT/), Example configuration (endpoint). Checked 2026-09-24.
[^31]: On a PJSIP transport, external_media_address and external_signaling_address replace Asterisk's address in SDP and SIP signaling with the given external address when the destination lies outside local_net. Source: [Configuring res_pjsip to work through NAT](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Configuring-res_pjsip-to-work-through-NAT/), external_media_address; external_signaling_address. Checked 2026-09-24.
[^32]: The PJSIP transport local_net option defines the local network, and NAT-related settings such as the external addresses are not applied to traffic within it. Source: [Configuring res_pjsip to work through NAT](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Configuring-res_pjsip-to-work-through-NAT/), local_net. Checked 2026-09-24.
[^33]: Twilio instructs customers to configure their infrastructure not to register for an Elastic SIP Trunking trunk. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Your Network. Checked 2026-09-24.
[^34]: At least one Twilio phone number must be associated with the trunk before it can receive incoming PSTN calls. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Numbers. Checked 2026-09-24.
[^35]: Twilio sends originating SIP requests over UDP by default, and a transport parameter such as ;transport=tcp or ;transport=tls on the origination URI selects another transport. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Origination > Origination SIP URI (transport parameter). Checked 2026-09-24.
[^36]: A Twilio trunk accepts up to 10 origination URIs, each with a priority from 0 to 65535 where the lowest number is most important, and a weight that shares load among URIs of equal priority. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Origination > Priority and Weight. Checked 2026-09-24.
[^37]: A Twilio origination SIP URI names where Twilio sends inbound calls, in forms such as sip:172.56.42.132 or sip:mysbc.com. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Origination > Origination SIP URI. Checked 2026-09-24.
[^38]: The Asterisk single-phone example uses an endpoint with auth (inbound authentication) and an AOR with max_contacts set so the phone can register. Source: [res_pjsip Configuration Examples](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/res_pjsip-Configuration-Examples/), An endpoint with a single SIP phone with inbound registration to Asterisk. Checked 2026-09-24.
[^39]: For phones behind a remote NAT, Asterisk documents the endpoint options rtp_symmetric, force_rport and rewrite_contact, which send RTP and SIP back to the observed source address and port. Source: [Configuring res_pjsip to work through NAT](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Configuring-res_pjsip-to-work-through-NAT/), Endpoint options for remote NAT phones. Checked 2026-09-24.
[^40]: An Asterisk PJSIP registration section configures an outbound registration from Asterisk to another system. Source: [PJSIP Configuration Sections and Relationships](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/PJSIP-Configuration-Sections-and-Relationships/), REGISTRATION. Checked 2026-09-24.
[^41]: Asterisk's rtp.conf sets its RTP port range with rtpstart and rtpend in [general]; the sample file uses 10000 to 20000 and notes the built-in defaults are 5000 and 31000. Source: [configs/samples/rtp.conf.sample](https://github.com/asterisk/asterisk/blob/master/configs/samples/rtp.conf.sample), [general] rtpstart; rtpend. Checked 2026-09-24.
[^42]: When Secure Trunking is enabled on a Twilio trunk, any non-encrypted call is rejected. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Secure Trunking. Checked 2026-09-24.
[^43]: Twilio Elastic SIP Trunking signaling uses ports 5060 UDP/TCP and 5061 TLS from per-edge /30 ranges, including 54.172.60.0/30 for North America Virginia and 54.244.51.0/30 for North America Oregon. Source: [Elastic SIP Trunking IP addresses](https://www.twilio.com/docs/sip-trunking/ip-addresses), Signaling gateways table. Checked 2026-09-24.
[^44]: Twilio negotiates SRTP keys using SDP Security Descriptions (SDES) as defined in RFC 4568. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Secure Trunking > SRTP. Checked 2026-09-24.
[^45]: Twilio supports only the AES_CM_128_HMAC_SHA1_80 SRTP suite on origination calls, and both AES_CM_128_HMAC_SHA1_80 and AES_CM_128_HMAC_SHA1_32 on termination calls. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Secure Trunking > SRTP. Checked 2026-09-24.
[^46]: The Asterisk project highly recommends installing one of the currently supported versions because those continue to receive bug and security fixes. Source: [What to Download?](https://docs.asterisk.org/Getting-Started/Installing-Asterisk/Installing-Asterisk-From-Source/What-to-Download/), What to Download?. Checked 2026-09-24.
[^47]: When the trunk's Symmetric RTP option is enabled, Twilio sends RTP to the address the remote stream actually arrives from rather than the one negotiated in SDP. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), General settings > Symmetric RTP. Checked 2026-09-24.
[^48]: A Twilio trunk's termination must have at least an IP access control list or credential authentication configured, and if both are configured both are enforced. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Termination > Authentication. Checked 2026-09-24.
[^49]: A Twilio Elastic SIP Trunking termination SIP URI takes the form {example}.pstn.twilio.com, and Twilio recommends dashes rather than dots in the chosen name. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Termination > Termination SIP URI. Checked 2026-09-24.
[^50]: For a TLS and SRTP trunk to Twilio, the Asterisk endpoint likely needs its transport option pointed at the TLS transport, media_encryption=sdes, and an AOR contact that reaches the termination URI on port 5061 over TLS (inferred). Source: [Secure Calling Tutorial](https://docs.asterisk.org/Deployment/Secure-Calling/Secure-Calling-Tutorial/), Asterisk chan_pjsip configuration (combined with Twilio Secure Trunking section). Checked 2026-09-24.
[^51]: With Secure Trunking, TLS uses port 5061 by default, another port may be given in the origination URI, and the origination URI must carry the transport=tls parameter. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Secure Trunking > TLS. Checked 2026-09-24.
[^52]: The Asterisk secure-calling tutorial defines a TLS transport with protocol=tls, bind=0.0.0.0:5061, cert_file, priv_key_file and a method setting. Source: [Secure Calling Tutorial](https://docs.asterisk.org/Deployment/Secure-Calling/Secure-Calling-Tutorial/), Asterisk chan_pjsip configuration. Checked 2026-09-24.
[^53]: Twilio Secure Trunking supports TLS 1.2 and above for SIP signaling. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Secure Trunking > TLS > Supported TLS versions. Checked 2026-09-24.
[^54]: In the Asterisk ITSP trunk example the endpoint references its credentials with outbound_auth, used when the provider authenticates Asterisk's outbound requests, and the AOR holds a static contact for the provider. Source: [res_pjsip Configuration Examples](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/res_pjsip-Configuration-Examples/), A SIP trunk to your service provider, including outbound registration. Checked 2026-09-24.
[^55]: Devices that communicate directly with Twilio over TLS must be configured to trust Twilio's TLS certificate, for which Twilio publishes root CA certificates. Source: [Elastic SIP Trunking](https://www.twilio.com/docs/sip-trunking), Secure Trunking > TLS > certificates. Checked 2026-09-24.
[^56]: The Asterisk interconnection guide Twilio links from its configuration-guides page is version 2.1 dated 2018. Source: [Elastic SIP Trunking Configuration Guides](https://www.twilio.com/docs/sip-trunking/sample-configuration), IP-PBX > Asterisk. Checked 2026-09-24.
[^57]: Asterisk answers 401 Unauthorized even to requests it cannot match to an endpoint, so identification should be checked before suspecting credentials. Source: [Asterisk PJSIP Troubleshooting Guide](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Asterisk-PJSIP-Troubleshooting-Guide/), Inbound Call Issues > Authentication Failures. Checked 2026-09-24.
[^58]: Asterisk 20.x moves to security-fix-only on 2026-10-19 and reaches end of life on 2027-10-19. Source: [Asterisk Versions](https://docs.asterisk.org/About-the-Project/Asterisk-Versions/), Version table, row 20.x. Checked 2026-09-24.
[^59]: Asterisk 22.x is an LTS release from 2024-10-16, fully supported until 2028-10-16 and end of life on 2029-10-16. Source: [Asterisk Versions](https://docs.asterisk.org/About-the-Project/Asterisk-Versions/), Version table, row 22.x. Checked 2026-09-24.
[^60]: Asterisk 24.x is listed as an LTS release dated 2026-10-15, after this guide's research date. Source: [Asterisk Versions](https://docs.asterisk.org/About-the-Project/Asterisk-Versions/), Version table, row 24.x. Checked 2026-09-24.