TekSIP Proxy frontend for Asterisk PBX

Transcription

1 TekSIP Proxy frontend for Asterisk PBX What you need: IP PBX--AsteriskNow 3.x Asterisk 1.8 Asterisk 10.x Asterisk 11.x and Proxy--TekSIP TekSIP Install Asterisk with or without SRTP support and Install TekSIP. This works best when TekSIP and Asterisk are on different machines. TekSIP specific configs screenshots below: First in the Endpoints tab create an endpoint user that will be our sip trunk from TekSIP to our Asterisk pbx. Unfortunately there is no domain routing as of TekSIP so each extension on our Asterisk pbx that will use the proxy must authenticate to TekSIP. Endpoints 1000, 1001 and 1002 wil also be extensions on our Asterisk pbx. Important: if your IP phone or softphone supports proxy authentication you can make the Endpoint and password anything you like here. If your device doesn t support proxy authentication then the Endpoint and password here must match the extension and password on the Asterisk pbx later in this tutorial.

2 The next step will be to configure the Settings/Service Parameters tab for TekSIP. As a proxy for external extensions to authenticate to it will be necessary in this tutorial to configure TekSIP as a STUN server for those extensions that are behind a NAT. As a proxy, the SIP domain is not all that important so leaving the internal IP address is fine. Also Use External Address is unnecessary since TekSIP should be run behind a routed firewall. Important: you can select the drop down box for TCP or UDP&TCP but I have been unable to successfully register extensions by transport TCP. Just use drop down box UDP or UDP&TCP for now.

3 Now it s time to configure authentication. Under the Settings/Authentication tab check the box for Authentication Enabled and depending on your network security requirements you can either check the box for Encrypt passwords or leave unchecked. A nice feature of TekSIP is the banning of endpoints that fail to register with the correct credentials. I suggest taking advantage of this feature to prevent hacking attempts against your SIP user s credentials. Important: when you initially setup your configuration do so with Blacklist IP Endpoints unchecked to save yourself a headache when troubleshooting.

4 Lastly, configure the Settings/Services tab with Enable RTP Proxy checked and Forward Remote REGISTER checked. Important: TekSIP can only forward REGISTER requests to SIP servers it knows about. This means the machine with TekSIP on it should point to DNS that can resolve which ever Asterisk pbx or other pbx that you are using to REGISTER your extensions. Now that s all there is to do for TekSIP. The remaining configurations are to be made on our Asterisk pbx.

5 Asterisk specific configs below: Edit users.conf and create an entry with the values from our trunk that we created earlier in TekSIP [trunk_1] host= ; IP address of our TekSIP machine username=asterisk_teksip_trunk ; username that we configured in TekSIP Endpoints tab secret=secret ; password that we configured in TekSIP Endpoints tab trunkname=teksip ; arbitrary context=did_trunk_1 ; Assigned by Asterisk GUI or arbitrary hasexten=no registeriax=no registersip=yes trunkstyle=voip allow=all

6 The trunk will immediately REGISTER to TekSIP once applied in Asterisk or if Asterisk is reloaded. Now edit users.conf and create an entry for each extension that will REGISTER to Asterisk pbx. In our example we used 1000, 1001 & 1002 [1000] fullname=john registersip=no host=dynamic callgroup=1 mailbox=1000 call-limit=1 type=peer username=1000 transfer=yes callcounter=yes context=dlpn_localcalling cid_number=1000 hasvoic =no vmsecret= = threewaycalling=no hasdirectory=no callwaiting=no hasmanager=no hasagent=no secret=secret nat=yes canreinvite=no dtmfmode=rfc2833 insecure=port,invite pickupgroup=1 macaddress= autoprov=yes label=1000 linenumber=1 LINEKEYS=1 allow=ulaw,alaw [1001] fullname=joe registersip=no host=dynamic callgroup=1 mailbox=1001 call-limit=1 type=peer username=1001 transfer=yes callcounter=yes context= DLPN_LocalCalling cid_number=1001 hasvoic =no vmsecret= = threewaycalling=no hasdirectory=no callwaiting=no hasmanager=no hasagent=no secret=secret nat=yes canreinvite=no dtmfmode=rfc2833 insecure=port,invite pickupgroup=1 macaddress= autoprov=yes label=1001 linenumber=1 LINEKEYS=1 allow=ulaw,alaw [1002] fullname=jane registersip=no host=dynamic callgroup=1 mailbox=1002 call-limit=1 type=peer username=1002 transfer=yes callcounter=yes context= DLPN_LocalCalling cid_number=1002 hasvoic =no vmsecret= = threewaycalling=no hasdirectory=no callwaiting=no hasmanager=no hasagent=no secret=secret nat=yes canreinvite=no dtmfmode=rfc2833 insecure=port,invite pickupgroup=1 macaddress= autoprov=yes label=1002 linenumber=1 LINEKEYS=1 allow=ulaw,alaw

7 Configure out IP phones and softphones In your IP phone or softphone (without outbound proxy authentication fields) enter: SIP username = 1000 and SIP domain server = Asterisk_IP_address_or_FQDN or URI = 1000@asterisk_ip_address_or_FQDN SIP password = secret and outbound proxy server = TekSIP Proxy_IP_address_or_FQDN Important: if your IP phone or softphone does not support proxy authentication Asterisk user/extension must be set insecure=port,invite which is acceptable. For this tutorial we are letting the TekSIP proxy handle authentication so it is really unnecessary for any endpoints to re-authenticate INVITE requests. In your IP phone or softphone (with outbound proxy authentication fields) enter: SIP username = 1000 and SIP domain server = Asterisk_IP_address_or_FQDN or URI = 1000@asterisk_ip_address_or_FQDN SIP password = secret and outbound proxy server = TekSIP Proxy_IP_address_or_FQDN PLUS Enter your outbound proxy Authentication ID/Username and proxy Authentication Password if you made them different than in our example. Repeat for all extensions that are required to enter through the TekSIP proxy. Asterisk REGISTRATION from our TekSIP proxy To verify you can run sip show peers from the asterisk cli. What you should see is all of your newly proxy REGISTERED endpoints coming from your TekSIP Proxy machine seen here by its IP address. Name/username Host Dyn Forcerport ACL Port Status Description 1000/ D Unmonitored 1001/ D Unmonitored 1002/ D Unmonitored trunk_1/asterisk_teksip_trunk D 5060 Unmonitored 4 sip peers [Monitored: 0 online, 0 offline Unmonitored: 4 online, 0 offline] Tutorial by pleasantview