FreePBX Asterisk SIP Settings: transport, NAT and media boundaries

Assign every control to a configuration owner

Treat Asterisk SIP Settings as several control planes sharing one screen: external and local network identity, PJSIP transports and listeners, RTP allocation, codecs and negotiation, TLS certificates, and global channel-driver behavior. Sangoma describes the module as the source of default SIP settings that an extension or trunk can override. Record whether the intended value belongs globally, to a transport, to an endpoint or trunk, or to an external firewall or DNS owner before changing it.

Do not use a global toggle to solve a single endpoint symptom until the active endpoint and transport have been inspected. Preserve the FreePBX, Asterisk and Asterisk SIP Settings module versions because the available fields, generated objects and activation boundary can differ by installed release.

Separate submitted, generated, loaded and listening state

For one intended change, preserve the submitted GUI value, Apply Config result, generated PJSIP object, loaded Asterisk object and operating-system listener. A successful save is not proof that generation completed, and a loaded transport is not proof that a consumer selected it. FreePBX-managed files remain authoritative; direct edits to generated files can disappear at the next reload.

Asterisk documents res_pjsip as a set of related objects. Record the exact transport name and the endpoint or outbound registration that references it. If the consumer has no explicit transport, Asterisk can choose the first configured transport valid for the target URI, so incidental order must not become an undocumented routing policy.

Model external address and local networks as rewrite policy

List each actual PBX-local subnet, signaling egress address, media egress address, routed private network and remote endpoint network. Asterisk applies external signaling and media rewriting when the destination is outside local_net; the NAT guide therefore makes the local-network list part of the decision, not just inventory. Do not add broad internet ranges as local or copy an old subnet without proving current routes.

Keep signaling and media evidence separate. Confirm the advertised Contact or Via path and the SDP connection address on the final call legs. When an external hostname is used, preserve its current resolution, refresh behavior and failover owner; successful DNS lookup does not prove that a loaded transport or an active dialog adopted a changed address.

Change transports and bind ports at their activation boundary

Inventory every enabled UDP, TCP, TLS, WS or WSS transport by address family, bind address and port, including any retained chan_sip listener. Sangoma’s FreePBX 17 migration guidance calls out bind-port conflicts between channel drivers. Resolve the demonstrated owner of a collision instead of moving an unrelated service or opening another public port.

Transport changes are restart-sensitive. Preserve active calls and registrations, apply the supported FreePBX configuration, read the first generation or bind error, and schedule a controlled Asterisk restart when the changed field requires it. A reload option, a visible form value or repeated Apply Config action does not establish that a structural bind, protocol or certificate change is active.

Keep RTP, codecs and TLS as separate acceptance paths

The configured RTP range must agree with the Asterisk runtime and the authorized firewall path, while negotiated codecs, media encryption and direct-media policy belong to endpoints and trunks as well as global defaults. A wide open port range does not repair a wrong SDP address or codec intersection. A successful SIP registration does not establish two-way RTP.

For TLS, identify the FreePBX-managed certificate, hostname, chain, expiry, private-key ownership and the transport that serves it. Test certificate presentation and peer verification separately from SRTP or DTLS media. Do not disable validation, anonymous-call controls or encryption broadly to make one call connect.

Accept the change with a bounded call matrix and rollback

Define one internal call, remote-endpoint call and trunk call that exercise the changed owner, plus a neighboring route expected to remain unchanged. After supported activation, confirm loaded objects, exact listeners, registration recovery, selected transport, final signaling addresses, negotiated codec or encryption and two-way media. Preserve timestamps and redact credentials.

Roll back through Asterisk SIP Settings and the same Apply Config and restart path if the first divergence remains. Record what was proven and what was not; this guide is documentation-derived and does not claim compatibility, availability or laboratory validation for an uninspected PBX. Use the linked transport and media diagnostics when the saved value, listener or call path disagrees.

Do not use one Asterisk Info row as SIP-settings acceptance

Asterisk Info is a bounded report surface, not proof that a generated transport, endpoint or media setting is active. The report guide cross-checks the exact loaded owner before changing the FreePBX source.