Before you start
- Asterisk 16 or later with
res_pjsiploaded (module show like pjsip). - Your public IP on the CLIRoutes endpoint, or SIP credentials from the portal.
- An authorised caller ID in the portal.
- A transport defined in pjsip.conf with your external addresses if the server sits behind NAT.
Placeholders in angle brackets, such as <ACCOUNT_ID>, come from your portal. The host shown is a placeholder; use the one listed under Portal → Network.
Set up Asterisk (PJSIP)
- 01
Define the transport
If you already have a UDP transport, add the external addresses to it. Behind NAT, these two lines are what keep audio flowing in both directions.
pjsip.conf · transport [transport-udp] type=transport protocol=udp bind=0.0.0.0:5060 external_media_address=<SERVER_PUBLIC_IP> external_signaling_address=<SERVER_PUBLIC_IP> local_net=10.0.0.0/8 local_net=192.168.0.0/16 - 02
Add the endpoint and AOR
The endpoint holds codec and caller ID behaviour.
send_paiandtrust_id_outboundmake Asterisk send the P-Asserted-Identity header we use to validate your caller ID.pjsip.conf · endpoint + aor [cliroutes] type=endpoint transport=transport-udp context=from-cliroutes disallow=all allow=ulaw,alaw,g729 aors=cliroutes outbound_auth=cliroutes-auth ; omit for IP authentication from_domain=sip.example-carrier.net send_pai=yes trust_id_outbound=yes direct_media=no rtp_symmetric=yes force_rport=yes rewrite_contact=yes dtmf_mode=rfc4733 [cliroutes] type=aor contact=sip:sip.example-carrier.net:5060 qualify_frequency=30 - 03
Add identify (and auth plus registration if needed)
Identify matches inbound requests from our signalling range to this endpoint. Only add the auth and registration objects if your account uses credentials.
pjsip.conf · identify, auth, registration [cliroutes] type=identify endpoint=cliroutes match=sip.example-carrier.net [cliroutes-auth] type=auth auth_type=userpass username=<ACCOUNT_ID> password=<SIP_PASSWORD> [cliroutes-reg] type=registration transport=transport-udp outbound_auth=cliroutes-auth server_uri=sip:sip.example-carrier.net client_uri=sip:<ACCOUNT_ID>@sip.example-carrier.net retry_interval=60 - 04
Write the outbound dialplan
Set the caller ID explicitly per call so it never depends on the extension that dialled. Numbers are dialled as country code plus national number.
extensions.conf [outbound-cliroutes] exten => _X.,1,Set(CALLERID(num)=<AUTHORISED_CLI>) same => n,Set(CALLERID(name)=) same => n,Dial(PJSIP/${EXTEN}@cliroutes,60,T) same => n,Hangup() [from-cliroutes] exten => _X.,1,NoOp(Inbound DID ${EXTEN}) same => n,Goto(inbound-dids,${EXTEN},1) - 05
Reload and verify
Reload PJSIP and check the endpoint is reachable before placing a test call. The logger shows the exact INVITE and response, which is what our support team will ask for if something fails.
Asterisk CLI asterisk -rx "pjsip reload" asterisk -rx "pjsip show endpoint cliroutes" asterisk -rx "pjsip show registrations" asterisk -rx "pjsip set logger host sip.example-carrier.net"
Caller ID headers Asterisk sends
With the settings above Asterisk sends your caller ID in both the From user part and a P-Asserted-Identity header. We validate the PAI first and fall back to From. If you set CALLERID(num) in E.164 without the plus, both headers carry the same value and the CLI format checker will pass it. For US and Canada destinations, attestation depends on the number being authorised to you, as explained in STIR/SHAKEN for call centers.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
403 Forbidden | Source IP not allow-listed, wrong credentials, or caller ID not authorised | Check Portal → Endpoints and Caller IDs |
484 Address Incomplete | Number sent in national format or with a leftover prefix | Send country code + number, no + or 00 |
| One-way or no audio | NAT not handled or RTP blocked | Set external address, open the RTP range |
| Endpoint Unavailable | OPTIONS qualify blocked | Allow SIP from our signalling range; check qualify_frequency |
401 loop on registration | Username or password mismatch | Re-copy credentials from the portal; check client_uri |
Last verified by the CLIRoutes routing team. Menus can change between releases; if a field has moved, tell us.