A provider-neutral starting point for inbound and outbound calling. It shows which file owns each decision, how ARI receives the channel, how media reaches an AI service, and what to check before a real caller hears it.
Use a currently supported point release and test the exact modules you deploy.
The dialplan hands the live channel to your application.
Choose by Asterisk version and adapter capability.
Asterisk is the telephony edge. It should not contain your prompt, business workflow, or model credentials.
Sends the inbound INVITE or accepts the outbound dial.
Authenticates the trunk and maps the call into a dialplan context.
Answers, sets policy, and calls Stasis(voice-ai).
Creates a mixing bridge and manages call state.
Moves caller audio to the AI runtime and returns generated audio.
Runs STT, LLM, TTS, or a native realtime speech model.
A registration, auth object, address of record, endpoint, and identify rule solve different parts of the trunk. Some carriers omit registration or use IP authentication, so keep the provider's requirements beside this template.
The NAT settings advertise the public address outside your private network.direct_media=no keeps Asterisk in the audio path, which is required when your ARI application needs the media. Use carrier-published signaling networks formatch, not a broad internet range.
[transport-udp-nat]
type=transport
protocol=udp
bind=0.0.0.0:5060
local_net=<PRIVATE_CIDR>
external_signaling_address=<PUBLIC_IP>
external_media_address=<PUBLIC_IP>
[carrier-registration]
type=registration
transport=transport-udp-nat
outbound_auth=carrier-auth
server_uri=sip:<SIP_HOST>
client_uri=sip:<ACCOUNT_ID>@<SIP_HOST>
contact_user=voice-ai
retry_interval=60
[carrier-auth]
type=auth
auth_type=userpass
username=<SIP_USERNAME>
password=<SIP_PASSWORD>
[carrier-aor]
type=aor
contact=sip:<SIP_HOST>:5060
qualify_frequency=30
[carrier-endpoint]
type=endpoint
transport=transport-udp-nat
context=from-carrier
disallow=all
allow=ulaw
outbound_auth=carrier-auth
aors=carrier-aor
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
[carrier-identify]
type=identify
endpoint=carrier-endpoint
match=<CARRIER_SIGNALING_CIDR>The endpoint context is a security boundary. Keep carrier traffic out of internal extension contexts and keep outbound dialing in its own context.
[from-carrier]
exten => voice-ai,1,NoOp(Inbound Voice AI call)
same => n,Answer()
same => n,Stasis(voice-ai)
same => n,Hangup()
[voice-ai-outbound]
exten => _+X.,1,NoOp(Outbound Voice AI call to ${EXTEN})
same => n,Set(CALLERID(num)=<OWNED_CALLER_ID>)
same => n,Dial(PJSIP/${EXTEN}@carrier-endpoint,45)
same => n,Hangup()contact_user, ors. Confirm it from a SIP trace. Do not guess after the first 404.ARI uses Asterisk's HTTP server for REST and WebSocket events. Bind to loopback when the controller is on the same host. Use a private network or VPN plus TLS when it is remote.
[general]
enabled=yes
bindaddr=127.0.0.1
bindport=8088[general]
enabled=yes
pretty=no
[voice-ai]
type=user
read_only=no
password_format=crypt
password=<CRYPT_PASSWORD_HASH>The ARI user can answer, originate, bridge, record, and hang up calls. Store its secret outside source control, restrict the listener, and rotate the credential.
Asterisk selects RTP ports from the configured range. Open the same UDP range in the host firewall and upstream NAT, then verify the public address placed in SDP.
[general]
rtpstart=10000
rtpend=20000The common 10000 to 20000 range is intentionally broad. You may choose a smaller range after sizing concurrency and understanding how many RTP streams each call creates. Signal on 5060 does not carry the audio.
ARI creates an external-media channel, adds it to the call bridge, and receives or injects audio through the selected transport.
ulaw when the carrier and model adapter both support it. Every transcode adds work and another place for sample-rate mistakes.Cloudflare Workers can serve HTTP APIs and WebSockets, and Durable Objects can coordinate sessions. Asterisk still needs a Linux host that accepts SIP and RTP.
Workers currently create outbound TCP connections but do not accept arbitrary inbound TCP sockets. SIP and RTP also use transport behavior outside a normal Worker request. If you need Cloudflare in front of a TCP or UDP service, Spectrum is the relevant Layer 4 product and custom applications require an Enterprise plan. It proxies traffic to Asterisk; it does not replace Asterisk.
A practical OSS stack is Asterisk on a small regional VM, an ARI and media adapter close to it, and Cloudflare for the public API, dashboard, authentication, configuration, audit events, and deployment automation.
Toll fraud can become expensive before a dashboard notices it. Reduce what can connect, what can dial, and what every credential can do.
Run the checks before placing a test call. During the call, turn on verbose PJSIP and RTP logging only long enough to isolate the problem.
asterisk -rx "pjsip show registrations"
asterisk -rx "pjsip show endpoints"
asterisk -rx "pjsip show contacts"
asterisk -rx "dialplan show from-carrier"
asterisk -rx "http show status"
asterisk -rx "ari show users"
asterisk -rx "module show like websocket"Check auth username, realm, From identity, and whether the carrier expects registration or IP authentication.
Inspect the Request-URI and confirm the endpoint context contains the received extension.
Find the codec intersection across carrier, PJSIP endpoint, bridge, and media adapter.
Inspect SDP, public media address, RTP firewall range, and the actual source of inbound media.
Look for missing ACK traffic, NAT contact rewriting, and session-timer behavior.
Confirm the external-media channel is in the mixing bridge and the adapter uses the requested codec and direction.
The reusable template comes from Asterisk's own configuration model. Carrier-specific values still belong to the carrier's current trunk guide.
These are architecture answers. Verify the final number format, authentication, and codec rules with your carrier.