Freeze one attempt without copying the credential
Record the caller's authorized test source, called number, timestamp and timezone, ingress trunk, SIP Call-ID or Asterisk linked identifier, expected DISA entry and exact symptom. Classify whether the call misses DISA, never answers, has no prompt, rejects the PIN, gives no second dial tone, ignores post-authentication digits, chooses the wrong route, receives a carrier rejection or connects with a separate media problem.
Preserve the event sequence and redact the PIN. Compare one known-good inbound path and one authorized internal call to the same non-emergency destination only when those controls are safe. Do not reset the trunk or widen dial permissions before the failing boundary is known.
Prove the inbound call selected this DISA destination
Start with the number and caller identity seen by FreePBX, the matched inbound route, IVR or schedule branch and the final destination. A ringback tone or carrier answer does not prove the DISA application ran. Inspect the generated and loaded destination for the configured DISA entry and correlate it with the live channel.
If the call never reaches DISA, remain on the inbound route, DID normalization, schedule or IVR boundary. If it reaches the entry, preserve the moment FreePBX answers and begins authentication. Avoid compensating for an inbound mismatch by duplicating the DISA entry or exposing it through a broader route.
Separate DTMF receipt from PIN acceptance
Asterisk documents a numeric passcode followed by #; FreePBX's current source generates an authentication step when PINs are configured. Prove first that Asterisk received the intended digit events on the correct leg, then determine whether the loaded DISA configuration accepted or rejected them. A keypad sound and ordinary two-way audio are not DTMF evidence.
If no usable events arrive, follow the DTMF method, negotiation and media path rather than changing the PIN. If events arrive but authentication fails, compare the installed module's saved and generated state without printing the credential. Check recent Apply Config, rotation and stale-session boundaries. Never switch to no-password mode as a diagnostic shortcut on a reachable system.
Prove the loaded dial context and post-authentication digits
After acceptance, preserve the digits Asterisk matched, digit and response timeout results, the context carried by the DISA entry and the local channel created for the attempt. Asterisk matches the entered extension in the configured context; FreePBX's release/17.0 source passes the dialed digits into that selected context. The second dial tone alone does not prove that a destination is permitted.
Classify an invalid extension, timeout, forbidden class, feature-code collision and number-normalization mismatch separately. Compare the loaded context with the intended restricted policy before editing it. Broadening the context to a general internal context may make a test pass while expanding toll-fraud and feature access.
Continue through outbound route and trunk only after context match
When the selected context accepts the digits, follow the normal outbound path: route order and pattern, prefix transformation, caller-ID policy, trunk sequence, request sent, remote response, answer and media. A congestion tone generated after a failed local or remote attempt is not proof of carrier capacity. Preserve Asterisk DIALSTATUS, hangup cause and the original SIP response with the exact attempt.
If the intended trunk was never attempted, stay with context and route selection. If it was attempted, use the provider's correlation identifier and published policy to interpret rejection. Keep emergency validation under its separately approved procedure; never place a live emergency call as a routine DISA test.
Repair the smallest proven boundary and close the exposure
Correct only the demonstrated owner: inbound destination, installed DISA state, DTMF path, credential rotation, loaded context, digit normalization, outbound route, caller-ID permission or provider policy. Apply configuration through the supported workflow and verify generated and loaded state. Do not edit FreePBX-managed dialplan files or leave a temporary broad context in service.
Retest a valid allowed call, invalid PIN, old PIN, forbidden destination, timeout, after-hours path and an unaffected normal call. Verify session termination, monitoring and billing records without exposing the credential, then remove captures. If the PIN appeared in any evidence, rotate it and prove the old value fails. No PBX, installed module, PIN, DTMF event, route, trunk, provider response or call was inspected or tested for this guide.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- FreePBX DISA release/17.0 source repository ↗
- FreePBX DISA release/17.0 dialplan generation source ↗
- Asterisk DISA application documentation ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.