Name the failed direction and preserve the final negotiation
Record whether the caller cannot hear the callee, the callee cannot hear the caller, neither direction works, audio starts and stops after a re-INVITE, or packets leave from an unexpected interface. Preserve Call-ID, tags, endpoint names, timestamps and both Asterisk channel legs.
Capture the initial and final SDP offer and answer, including c= address, m= port, payload mapping and direction attributes. A private, stale or surprising address in an earlier body is not necessarily the active destination after an accepted update.
Compare loaded endpoint and transport ownership
Inspect the effective endpoint media_address, bind_rtp_to_media_address, rtp_symmetric and direct_media values and the selected transport's local_net, external_media_address and external_signaling_address. Record which transport the endpoint actually used and whether the destination matched a configured local network.
If FreePBX owns the configuration, identify the GUI or supported include that generated each value. Do not repair a runtime mismatch by editing a generated file without changing its owner and applying configuration.
Map both RTP five-tuples before enabling a NAT control
Capture the address and port from which Asterisk sends, where the peer sends, what Asterisk receives and where it sends in return. If media arrives from a different address or port than SDP advertised, rtp_symmetric may be relevant to the return destination; it does not rewrite SIP Contact or prove why the peer chose its outbound path.
Keep force_rport and rewrite_contact with SIP signaling evidence. They can correct response and subsequent-request routing, but enabling them is not proof that an incorrect SDP media address or RTP source has been fixed.
Account for direct media, relays and proxies
If direct_media is active, identify the accepted re-INVITE or UPDATE that moved media and capture at the endpoints or relay as authorized. If a proxy or SBC is in the path, establish whether it handles signaling only or also anchors media. Apply public-address rewriting only at the component that owns that boundary.
An RTP keepalive can maintain a mapping but is not a two-way-audio test. Asterisk receiving packets also does not prove the endpoint can decode them or that packets return through the same firewall state.
Correct one owner and repeat a bounded call
Correct the single evidenced owner: endpoint media address or bind behavior, transport local-network classification or external media address, symmetric RTP return path, direct-media policy, proxy or relay policy, interface routing, or firewall and NAT state. Reload or restart only as the documented change requires, then verify the loaded state.
Repeat one fresh authorized call and retain final SDP, both RTP directions, decoded-audio result and any direct-media transition. Remove temporary verbose logging and packet capture when complete. No Asterisk or FreePBX system, address, NAT mapping, proxy path, RTP stream or call was inspected or tested for this diagnostic.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- Asterisk 22 res_pjsip reference ↗
- Asterisk latest res_pjsip reference ↗
- Asterisk res_pjsip NAT configuration guide ↗
- Asterisk PJSIP with proxies ↗
- Asterisk chan_sip to res_pjsip migration guide ↗
- Asterisk PJSIP troubleshooting guide ↗
- RFC 3264: SDP offer/answer ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.