VICIdial SIP Trunk Setup: Complete Guide

Most carrier setup docs stop at a SIP proxy address and a username. If you have configured Asterisk trunks before, that is enough. If you have not — or if you have but your AMD is not detecting correctly, your DTMF is breaking IVR menus, or you are getting one-way audio behind NAT — you need more than credentials.

This guide walks through VICIdial SIP trunk configuration step by step, with the settings a SIPNEX trunk expects. SIPNEX is an FCC-licensed carrier. The examples use chan_sip (sip.conf syntax); the PJSIP equivalent follows the sip.conf blocks.

Prerequisites

Before configuring the trunk, confirm you have:

• VICIdial installed and functional (web interface accessible, Asterisk running) — GoAutoDial uses the same VICIdial engine
• SIPNEX account provisioned (you have received your SIP proxy address, authentication method, and credentials)
• At least one DID provisioned on your SIPNEX account
• Your VICIdial server’s public IP address (for IP-based authentication) or your digest auth credentials
• Firewall rules allowing SIP signaling (UDP 5060) to and from the SIPNEX signaling addresses, and your RTP port range to and from the SIPNEX media addresses — both sets of addresses are listed in your SIPNEX onboarding details. The RTP range is whatever your rtp.conf sets; Asterisk’s shipped sample file uses 10000–20000

Authentication method

SIPNEX supports two authentication methods:

IP-based authentication (recommended for fixed-location servers). We allowlist your server’s public IP address. No username or password is needed — traffic from your IP is authenticated by its source, so there is no credential to steal. If your server has a static public IP, this is the simplest method.

Digest authentication (for dynamic IPs or hosted environments). We provide a username and password. Your Asterisk registers to our proxy using these credentials. Use this when your server’s IP may change (cloud VMs with dynamic IPs, servers behind ISPs without static IP service).

sip.conf trunk configuration

On a VICIdial server, the peer block below goes in the carrier’s Account Entry field (next section), and VICIdial writes it into its auto-generated Asterisk config. On a hand-managed Asterisk box, it goes in /etc/asterisk/sip.conf. Use one place, not both, so there is a single definition of the peer to troubleshoot.

For IP-based authentication:

[sipnex]
type=peer
host=YOUR_SIPNEX_PROXY_IP
port=5060
disallow=all
allow=ulaw
allow=alaw
dtmfmode=rfc2833
insecure=invite
directmedia=no
nat=force_rport,comedia
qualify=yes
qualifyfreq=60
context=trunkinbound

For digest authentication, modify the peer:

[sipnex]
type=peer
host=YOUR_SIPNEX_PROXY_IP
port=5060
username=YOUR_USERNAME
secret=YOUR_PASSWORD
fromuser=YOUR_USERNAME
disallow=all
allow=ulaw
allow=alaw
dtmfmode=rfc2833
insecure=invite,port
directmedia=no
nat=force_rport,comedia
qualify=yes
qualifyfreq=60
context=trunkinbound

The registration line does not belong inside the peer block. In VICIdial, it goes in the carrier’s Registration String field, which the admin help text describes as the exact string the SIP configuration file needs to register to the provider. On a hand-built server, it goes in the [general] section of sip.conf:

register => YOUR_USERNAME:YOUR_PASSWORD@YOUR_SIPNEX_PROXY_IP:5060

PJSIP equivalent

VICIdial also supports PJSIP carriers (the project’s PJSIP support notes cover enabling it), and Asterisk removed chan_sip in version 21, so newer builds need this form. The same trunk with IP authentication, in pjsip.conf syntax:

[sipnex]
type=endpoint
context=trunkinbound
disallow=all
allow=ulaw,alaw
dtmf_mode=rfc4733
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
aors=sipnex

[sipnex]
type=aor
contact=sip:YOUR_SIPNEX_PROXY_IP:5060
qualify_frequency=60

[sipnex]
type=identify
endpoint=sipnex
match=YOUR_SIPNEX_PROXY_IP

For digest authentication, add a type=auth section (auth_type=userpass with your username and password), reference it with outbound_auth on the endpoint, and add a type=registration section that uses the same outbound_auth and whose server_uri points at the SIPNEX proxy. If the server sits behind NAT, set external_media_address, external_signaling_address and local_net on the PJSIP transport. The outbound dial string becomes PJSIP/${EXTEN:1}@sipnex.

Key settings explained

Codec: ulaw first. allow=ulaw as the primary codec gives you G.711u — uncompressed 64 kbps audio. It is the codec VICIdial’s own carrier examples use. Adding allow=alaw as a fallback provides G.711a compatibility for international termination. Do not add G.729 unless bandwidth is severely constrained — G.729 compression introduces subtle artifacts that can interfere with AMD accuracy.

DTMF: rfc2833. dtmfmode=rfc2833 sends DTMF tones as out-of-band events (RFC 2833/RFC 4733) rather than in-band audio or SIP INFO; PJSIP calls the same mode rfc4733. This is the standard for SIP trunking and provides the most reliable DTMF delivery. If your IVR menus are not responding to caller input, DTMF mode mismatch between your system and the carrier is the most likely cause. SIPNEX expects RFC 2833.

NAT: force_rport,comedia. These settings tell Asterisk how to treat a far end whose addresses may be rewritten by NAT. force_rport makes Asterisk reply to the port a request actually came from rather than the port declared in the SIP headers. comedia makes it send RTP to the address and port media actually arrives from, rather than the address in the SDP. Get these wrong and the usual result is one-way audio.

If your VICIdial server itself sits behind a NAT router, nat= is not enough. Set externaddr to your public IP and localnet to your private range in the [general] section, so Asterisk advertises the public address in SIP and SDP; Asterisk’s sample sip.conf is explicit that the external address is not applied correctly unless localnet is set.

directmedia=no. Older configs call this canreinvite. It forces all RTP media to flow through your Asterisk server rather than being sent directly between endpoints. For call recording and AMD to work, media must pass through Asterisk. Setting this to yes would allow media to bypass Asterisk, breaking recording and AMD. The PJSIP equivalent is direct_media=no.

qualify=yes with qualifyfreq=60. Sends SIP OPTIONS pings to the carrier every 60 seconds to verify the trunk is alive. If the carrier does not respond, Asterisk marks the trunk as unreachable. This enables your system to detect carrier outages and trigger failover if configured — the VICIdial backup carrier and failover guide covers the full two-carrier setup.

VICIdial admin panel configuration

After preparing the peer block, add the trunk in the VICIdial admin panel:

1. Go to Admin → Carriers and click Add A New Carrier

2. Set the carrier fields:

   • Carrier ID: SIPNEX (or any label of 2–15 characters, no spaces)
   • Carrier Name: SIPNEX
   • Registration String: (leave blank for IP auth, or your register => line for digest)
   • Template ID: (leave blank)
   • Account Entry: The [sipnex] peer block above
   • Protocol: SIP (or PJSIP, if you used the PJSIP form)
   • Globals String: (leave blank unless you have custom globals)
   • Dialplan Entry: Your outbound dial pattern for SIPNEX
   • Server IP: 0.0.0.0 puts the carrier on all active Asterisk servers

3. Set the dialplan in the Dialplan Entry to route outbound calls through the SIPNEX trunk. A basic outbound dialplan for US domestic, matching VICIdial’s default campaign Dial Prefix of 9:

exten => _91NXXNXXXXXX,1,AGI(agi://127.0.0.1:4577/call_log)
exten => _91NXXNXXXXXX,n,Dial(SIP/${EXTEN:1}@sipnex,,tTo)
exten => _91NXXNXXXXXX,n,Hangup()

VICIdial puts the campaign’s Dial Prefix in front of the 1 + 10-digit number, so the pattern matches 9 plus 11 digits, and ${EXTEN:1} strips the prefix before the number goes to SIPNEX. That is the convention VICIdial’s own carrier examples use, and it lets you add a backup carrier on a different prefix later. VICIdial’s install notes single out the o Dial option as very important for outbound calls, so keep tTo. Adjust the dial string for E.164 format if your carrier expects the + prefix: SIP/+${EXTEN:1}@sipnex.

Inbound DID routing

Configure inbound routing so calls to your SIPNEX DIDs reach the correct VICIdial destination.

There is no inbound dialplan to write. A stock VICIdial install already has a trunkinbound context that hands every inbound call to VICIdial’s DID routing script, and the context=trunkinbound line in the peer is what sends SIPNEX’s calls there. The carrier’s Dialplan Entry is for outbound calls only.

Then go to Inbound → Add A New DID for each number: set the DID Extension to the number as it arrives from SIPNEX, set DID Route to IN_GROUP, and choose the in-group (queue) that should take the calls.

Outbound caller ID configuration

For local presence dialing, configure CID groups in VICIdial:

1. Go to Admin → CID Groups and add a CID group with the type set to AREACODE (STATE and NONE are the other types)
2. Add your SIPNEX DIDs to the group, with a number for each area code you call
3. In your campaign settings, set CID Group to the group you created

VICIdial’s help text says a campaign CID Group overrides the other campaign caller ID settings and uses the area-code or state entries defined in the group; a CID Group Failover setting covers numbers the main group has no match for. For A-level STIR/SHAKEN attestation, every number in the group has to be one your SIPNEX account is authorized to use.

Troubleshooting common issues

One-way audio. Almost always a NAT issue. Verify nat=force_rport,comedia on the peer, and if the server itself is behind NAT, externaddr and localnet (chan_sip) or external_media_address, external_signaling_address and local_net on the PJSIP transport. Check that directmedia=no is set, and that the firewall passes your rtp.conf port range to and from the SIPNEX media addresses. sip set debug on (or pjsip set logger on) shows the SDP Asterisk actually sent; a private address in it is the fault.

For symptoms beyond audio, the VICIdial troubleshooting hub maps each one to its layer.

No audio in either direction. RTP is blocked. Open your rtp.conf port range to and from the SIPNEX media addresses.

DTMF not working (IVR menus unresponsive). Verify dtmfmode=rfc2833 (dtmf_mode=rfc4733 on PJSIP). If the remote end uses a different DTMF mode, the tones are not being decoded. RFC 2833 is the SIPNEX standard.

AMD not detecting accurately. Verify allow=ulaw is the primary codec. G.729 compression can cause AMD false positives (live answers classified as machines) because the compressed audio changes the waveform characteristics that AMD algorithms analyze. Use G.711u for best AMD performance.

Registration failures (digest auth). Check username, password, and proxy address, and that the register => line sits in the Registration String field or [general], not inside the peer block. Verify your firewall allows outbound UDP 5060 to the SIPNEX signaling addresses. sip show registry shows whether the registration is up.

403 Forbidden on outbound calls. The carrier refused the call. Common causes are a source IP or credentials the account does not recognize, a caller ID the account is not authorized to present, or a balance or destination restriction; the response and your carrier’s support desk tell you which. Confirm the outbound CID is a number your account is authorized to present and that it is in E.164 format if required.

Calls drop about 32 seconds after answer. The ACK for the 200 OK is not getting through. RFC 3261 has the answering side retransmit its 200 OK for 64×T1 (32 seconds with the default 500 ms T1) and then end the call. Look for NAT problems or a SIP ALG rewriting headers on the router, not at session timers.

Calls drop near the 15- or 30-minute mark. That is a session-timer refresh failing. Check session-timers in sip.conf (timers on PJSIP) and whether the carrier and your system agree on the timer values; setting session-timers=refuse on the peer takes timers out of the picture while you test.

Frequently asked questions

What codec should I use with VICIdial on SIPNEX?

G.711u (ulaw) as the primary codec. It keeps audio uncompressed, which is what AMD (Answering Machine Detection) works best on. G.729 compression changes the waveform characteristics AMD analyzes and can increase false positives. Add G.711a (alaw) as a fallback for compatibility. Only use G.729 if your bandwidth is severely constrained (satellite links, very low-bandwidth connections). With standard 20 ms packets, each G.711 call uses about 80 kbps per direction at the IP layer, or about 87 kbps on Ethernet.

Do I need a static IP for SIPNEX SIP trunking?

A static IP is recommended because it enables IP-based authentication, the simplest method: we allowlist your IP and all traffic from it is authenticated, with no username or password to configure. If your server has a dynamic IP, use digest authentication instead. Digest never sends the password itself; it sends a hash computed from the password and a challenge (nonce) from our proxy. Someone who captures that exchange on an unencrypted path can still try to crack the password offline, so use a long random password, and TLS where both sides support it. Digest also requires your Asterisk to keep an active registration with our proxy.

How do I set up trunk failover for a VICIdial server?

Outbound failover lives in your VICIdial dialplan. Either keep a second carrier on its own dial prefix and switch the campaign’s Dial Prefix when the primary fails, or add a fall-through in the primary’s Dialplan Entry that moves to the backup only when the primary returns CHANUNAVAIL or CONGESTION — the backup carrier guide linked above shows both. Inbound failover happens upstream: ask your carrier whether it can send your DIDs to a secondary destination when your primary server stops answering.

---

Need trunk credentials to follow this guide? Start with SIPNEX’s VICIdial carrier service or call (833) 665-2220.