Platform Guide
Asterisk PJSIP Configuration
10 min read · Updated April 2026
PJSIP is the modern SIP channel driver in Asterisk, replacing the legacy chan_sip. It offers better standards compliance, native IPv6, WebRTC support, and more flexible configuration. But pjsip.conf is more complex than sip.conf. Here's how to get it right.
1. Why PJSIP over chan_sip?
chan_sip is deprecated as of Asterisk 19 and will eventually be removed. PJSIP (res_pjsip) is the replacement with significant advantages:
- Multiple registrations per endpoint (desk phone + softphone + mobile simultaneously)
- Native TLS/SRTP support without workarounds
- WebRTC support (ICE, DTLS-SRTP, BUNDLE)
- IPv6 support
- Better RFC 3261 compliance
- More granular configuration (transport, auth, AOR, endpoint are separate objects)
The tradeoff: pjsip.conf is more verbose and requires understanding the object model. A single chan_sip peer becomes 4-5 PJSIP objects.
2. pjsip.conf structure
PJSIP uses separate configuration objects for each concern:
- transport — defines how to listen (UDP, TCP, TLS, WebSocket)
- auth — username/password credentials
- aor (Address of Record) — where to find the endpoint, registration expiry
- endpoint — all call handling settings, codec order, NAT, DTMF mode
- identify — maps inbound connections to endpoints by IP address
- registration — outbound registration to a SIP trunk or registrar
; Minimal working endpoint
[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060
[auth-1001]
type=auth
auth_type=userpass
username=1001
password=secretpassword
[aor-1001]
type=aor
max_contacts=2
default_expiration=120
[1001]
type=endpoint
transport=transport-udp
auth=auth-1001
aors=aor-1001
context=internal
disallow=all
allow=ulaw
allow=alaw
dtmf_mode=rfc4733
direct_media=no
3. Transport configuration
UDP (basic)
[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060
TLS (encrypted signaling)
[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
cert_file=/etc/asterisk/keys/server.crt
priv_key_file=/etc/asterisk/keys/server.key
ca_list_file=/etc/asterisk/keys/ca.crt
method=tlsv1_2
verify_server=yes
WebSocket (for WebRTC)
[transport-ws]
type=transport
protocol=ws
bind=0.0.0.0:8088
[transport-wss]
type=transport
protocol=wss
bind=0.0.0.0:8089
cert_file=/etc/asterisk/keys/server.crt
priv_key_file=/etc/asterisk/keys/server.key
4. Endpoint and AOR setup
Key endpoint settings that differ from chan_sip:
[1001]
type=endpoint
; Codec configuration
disallow=all
allow=ulaw ; G.711u (PCMU)
allow=alaw ; G.711a (PCMA)
allow=opus ; Opus (if compiled)
; DTMF
dtmf_mode=rfc4733 ; replaces dtmfmode=rfc2833
; Media
direct_media=no ; force media through Asterisk
media_encryption=sdes ; enable SRTP (or dtls for WebRTC)
; NAT
rtp_symmetric=yes
rewrite_contact=yes
force_rport=yes
The identify object maps inbound SIP from a specific IP to an endpoint — essential for trunks that don't register:
[identify-trunk]
type=identify
endpoint=mytrunk
match=203.0.113.10/32
5. SIP trunk configuration
; Outbound auth for trunk
[auth-trunk]
type=auth
auth_type=userpass
username=mytrunkuser
password=trunkpassword
; Registration to trunk
[reg-trunk]
type=registration
transport=transport-udp
outbound_auth=auth-trunk
server_uri=sip:sip.provider.com
client_uri=sip:
[email protected]
retry_interval=60
expiration=3600
; Trunk endpoint
[mytrunk]
type=endpoint
transport=transport-udp
outbound_auth=auth-trunk
aors=mytrunk
context=from-trunk
disallow=all
allow=ulaw
allow=alaw
dtmf_mode=rfc4733
direct_media=no
[mytrunk]
type=aor
contact=sip:sip.provider.com
6. NAT traversal in PJSIP
PJSIP handles NAT differently from chan_sip. The key settings:
; In transport section
[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060
local_net=192.168.0.0/16 ; your local network
local_net=10.0.0.0/8
external_media_address=203.0.113.1 ; your public IP
external_signaling_address=203.0.113.1
; In endpoint section
[1001]
type=endpoint
rtp_symmetric=yes ; send RTP to where we receive from
rewrite_contact=yes ; rewrite Contact to our external address
force_rport=yes ; use source port for responses
7. Debugging PJSIP issues
; Enable logging
pjsip set logger on
; Show all endpoints
pjsip show endpoints
; Show registered contacts
pjsip show contacts
; Show outbound registrations
pjsip show registrations
; Show specific endpoint detail
pjsip show endpoint 1001
; Reload config without restart
pjsip reload
For persistent issues, check /var/log/asterisk/full with debug level 5. PJSIP log lines are prefixed with the component name (res_pjsip, res_pjsip_registrar, res_pjsip_session) making them easy to filter.
Frequently asked questions
What is PJSIP in Asterisk?
PJSIP (res_pjsip) is the modern SIP channel driver in Asterisk, replacing the deprecated chan_sip. It offers better RFC compliance, native TLS/SRTP, WebRTC support, IPv6, and multiple simultaneous registrations per endpoint. It uses separate configuration objects for transport, auth, AOR, endpoint, and registration.
How do I configure a SIP trunk in Asterisk PJSIP?
In Asterisk PJSIP, a SIP trunk requires: an auth object with trunk credentials, a registration object pointing to the trunk provider URI, an endpoint object with the trunk context and codecs, and an identify object mapping the trunk IP to the endpoint. Use pjsip show registrations to verify registration status.
How do I fix NAT issues in Asterisk PJSIP?
For NAT in Asterisk PJSIP, set local_net and external_media_address/external_signaling_address on the transport object. On the endpoint, set rtp_symmetric=yes, rewrite_contact=yes, and force_rport=yes. These replace the nat=yes shorthand from chan_sip.
Having issues with Asterisk PJSIP configuration?
Paste your Asterisk PJSIP debug output into SIPSymposium. The analyzer parses Asterisk log format, identifies registration failures, NAT issues, and codec negotiation problems.