SIP trunking for PBX systems, direct from the carrier.
Your PBX already handles routing, extensions, and voicemail. What it needs from us is carriage. SIPNEX delivers PBX SIP trunking direct from an FCC-licensed carrier: no channel caps, A-level attestation signed with our own STIR/SHAKEN certificate, and tested configuration guides for FreePBX, Asterisk, and VICIdial.
- Who it’s for: any business or operator running its own PBX — on-premises, in a data center, or in the cloud via BYOC.
- What you get: trunk credentials, local and toll-free numbers, E911 in the 50 US states, and A-level signing on every outbound call.
- How it connects: your PBX registers to our SIP proxy, or we allow-list your static IP. Calls then travel over the internet to the public telephone network.
What SIP trunking for PBX systems actually means.
A PBX — private branch exchange — is the phone system inside a business. It connects desk phones, softphones, and queues to each other. It also decides how calls move: ring groups, auto attendants, voicemail, and time-of-day rules. What a PBX cannot do alone is reach the outside world. For that it needs a trunk.
SIP trunking is that trunk, delivered over IP. SIP stands for Session Initiation Protocol, the standard (RFC 3261) that sets up, changes, and ends calls between two endpoints. A SIP trunk carries your calls over the internet to a carrier, which hands them to the public switched telephone network. Inbound calls to your numbers travel the same path in reverse. The result is IP-based communications from the handset to the carrier’s edge.
In practice, SIP trunking replaces the analog phone lines and PRI circuits that older PBX systems depended on. There is no copper to order and no channel card to buy. The trunk is a set of credentials, a codec list, and a firewall rule. SIP trunking offers a way to keep the PBX you like and change only the carrier. Our guide to what SIP trunking is goes deeper.
Every PBX has two layers. We are the second one.
The software layer is the PBX you chose — 3CX, FreePBX, Yeastar, Avaya, or a dialer built on Asterisk. The carriage layer is the trunk underneath it. That connection originates and terminates your calls on the public network, owns the numbers, and cryptographically signs every outbound call. SIP trunking for an IP PBX replaces the copper and PRI circuits that layer used to need. Your PBX registers to it in minutes.
Splitting the layers is the point. Pick the PBX on features; pick the carrier on rates, attestation, and support. When either stops earning its keep, you swap it without touching the other. Your numbers port, your trunk config moves, and your extensions never know. Running a dialer instead of an office PBX? That workload has its own page: dialer-grade SIP trunking.
Configuration guides for the platform you run.
SIP is a standard, and SIPNEX trunks speak it plainly: registration or IP authentication, G.711u primary, RFC 2833 DTMF. These guides map those settings onto each platform’s own interface.
How a SIP trunk connects to a PBX, step by step.
Every platform dresses it up differently, but the sequence underneath is the same five moves. Knowing them makes the configuration screens make sense — and makes the first failed call easy to diagnose.
- Authentication. Your PBX either registers to our SIP proxy with a username and password, or we allow-list its static IP address. Registration suits dynamic IPs; IP authentication suits fixed servers.
- Signaling. SIP messages travel on UDP port 5060, or on TCP port 5061 when TLS encryption is used. An INVITE starts the call, a 200 OK answers it, and a BYE ends it.
- Media. Once the call is set up, the audio moves in real time over RTP, the Real-time Transport Protocol, on a UDP port range your PBX chooses. Asterisk’s sample rtp.conf ships with 10000–20000.
- Codec. Both ends agree on a codec during setup. G.711u is our default; G.729 is available when bandwidth is tight. DTMF key presses travel as RFC 2833 events.
- Termination. We sign the call under STIR/SHAKEN, route it to the destination carrier, and the far end rings. For inbound, we send an INVITE to your PBX, which matches the dialed number to an inbound route.
Platform-by-platform settings live in the SIP trunk configuration guide.
What your network needs before the trunk goes live.
Start with a stable internet connection. Voice punishes jitter and packet loss in a way that email and web browsing do not. The targets that matter: one-way latency under 150 ms, jitter under 30 ms, and packet loss under 1 percent. A business fiber or cable circuit with a wired path to the PBX meets them comfortably. A congested Wi-Fi hop often does not.
Bandwidth math is simple. A G.711 call uses about 85 kbps in each direction once packet headers are counted. Plan on 100 kbps per concurrent call as a rule of thumb. That figure applies to upload and download separately, so 25 simultaneous calls need roughly 2.5 Mbps up and 2.5 Mbps down, reserved for voice. G.729 cuts that to about 32 kbps per call at a small cost in clarity.
| CONCURRENT CALLS | G.711 AT 100 KBPS/CALL | G.729 AT 32 KBPS/CALL |
|---|---|---|
| 10 calls | 1 Mbps each way | 320 kbps each way |
| 25 calls | 2.5 Mbps each way | 800 kbps each way |
| 50 calls | 5 Mbps each way | 1.6 Mbps each way |
| 100 calls | 10 Mbps each way | 3.2 Mbps each way |
Rule-of-thumb figures per direction. Reserve this on top of your normal data traffic, and prioritize it with QoS.
Then fix the firewall. Turn off SIP ALG on the router — it rewrites SIP headers and is a leading cause of one-way audio and dropped registrations. Open UDP 5060 (or 5061 for TLS) and your RTP range to the carrier’s proxy IPs only. Give voice priority with QoS so a large file upload cannot starve a live call. What SIP ALG is explains the ALG setting, and how to fix packet loss on VoIP calls covers QoS.
Do you need an SBC on your side of the trunk?
A session border controller sits at the edge of a voice network and owns every SIP session that crosses it. It handles NAT traversal, normalizes SIP dialects, hides your internal topology, and anchors the media. Carriers run session border controllers (SBCs) at their network edge as a matter of basic architecture. The question for a PBX operator is whether to run one on your side too.
For a single PBX at small or mid scale, you usually do not. A correctly configured firewall with SIP ALG disabled connects cleanly to a carrier trunk. An enterprise SBC earns its cost in specific cases: Microsoft Teams Direct Routing, which requires a Microsoft-certified SBC; interconnects with several carriers; reselling voice; or mission-critical sites that need media anchoring for recording or compliance under your own control.
The Teams Direct Routing page covers the certified-SBC path and how carrier trunks feed it.
On-premises, hosted, or cloud: where the trunk plugs in.
SIP trunking solutions fit three kinds of PBX systems. The trunk settings barely change between them. What changes is where the PBX lives and who maintains it.
On-premises PBX
A physical server or appliance in your building — FreePBX, 3CX, Yeastar, Avaya IP Office. The trunk terminates at your firewall. You own uptime, backups, and patching, and you keep full control of the dial plan.
PBX in a data center
The same software on a VPS or a hosted server. Data centers give you redundant power and a static public IP, which makes IP authentication easy. See FreePBX hosting with carrier trunks for the version where we run the server too.
Cloud PBX via BYOC
A cloud platform that lets you bring your own carrier. Your trunk feeds the platform’s cloud, so you keep control of rates, numbers, and attestation while the vendor runs the software. The BYOC guide explains the model; hosted PBX vs SIP trunking weighs it against letting one company do both.
How many channels does your PBX need?
A trunk is the connection; a channel is one live call on it. On PRI, the two were welded together — each T1 carried exactly 23 voice channels, so you bought circuits in blocks of 23. SIP breaks that link. One SIP trunk carries as many simultaneous calls as your bandwidth and server allow.
Size to peak concurrency, not headcount. Watch your busiest hour for a couple of weeks, count the calls up at once, and add 20 to 30 percent headroom. On a SIPNEX trunk there is no artificial channel cap, so the number you plan for is a bandwidth figure, not a line item on an invoice. How many SIP trunks do I need walks the math for inbound, outbound, and dialer traffic.
Locking down a PBX trunk.
An internet-facing PBX is a target. Toll fraud is the classic attack: someone guesses an extension password and pumps international calls through your trunk, and the bill lands on you. The defenses are not exotic. Use long random passwords on every extension and on the trunk itself. Restrict inbound SIP to the carrier’s IP addresses and block anonymous or guest calls. Disable international dialing unless a route genuinely needs it, then cap it.
Encrypt the transport where your PBX supports it. SIPNEX supports TLS on SIP port 5061 for signaling and SRTP for the media, so call setup and audio are protected in transit. Keep the PBX patched, and watch the registration logs for repeated 401 and 403 responses — they are the sound of someone guessing. The SIP 403 Forbidden explainer goes deeper.
E911 and the two rules every PBX operator owns.
Emergency calls ride the trunk like any other call, but they route on the Registered Location your carrier holds for each site — not on where the device happens to sit. Every physical site on your PBX needs its own address on record before turn-up, and you update the record whenever a site moves. SIPNEX provides E911 in the 50 US states.
Two federal rules sit on the PBX side. Kari’s Law applies to multi-line telephone systems manufactured, sold, or installed after February 16, 2020: a user must reach 911 with no prefix, and the system must notify a central location — a front desk, security desk, or an off-site monitor — whenever someone dials 911. RAY BAUM’S Act Section 506 requires a dispatchable location with every 911 call — the street address plus the floor, suite, or room a responder needs. Configure both on the PBX; the trunk carries what the PBX sends.
Our E911 service page walks through both laws and covers how addresses are registered and updated.
Moving a PBX from PRI or analog phone lines to SIP.
The cutover is a configuration change, not a forklift. Done in this order, the old service stays live until the new trunk has proven itself.
- Inventory every line. List the numbers on the PRI and on each analog line, and note what uses them: fax, alarm panels, elevators, gate boxes. Some of those devices need an ATA or a different path — see POTS replacement.
- Order the trunk and a test number. Get credentials and one new DID first. You can prove the trunk end to end without touching a production number.
- Configure in parallel. Add the SIP trunk beside the existing PRI card. Send outbound test calls over it and receive inbound on the test DID. Check caller ID, DTMF, and voicemail hand-off, and confirm the E911 address on record for the site.
- Port the numbers. Submit the port while the old service stays live. Simple ports of up to 10 local numbers typically run 7 to 14 business days; larger blocks can take 14 to 21, and toll-free numbers move by RespOrg transfer. Number porting explained shows where the days go.
- Move the routes. On the port date, point outbound routes at the SIP trunk and map the ported numbers to inbound routes. Leave the old circuit connected for a short overlap.
- Decommission. Cancel the PRI and the analog lines, pull the channel card, and update your documentation.
When the trunk does not come up clean.
Most first-day faults fall into five buckets, and four of them are on the customer side of the firewall. Check these before you open a ticket — or send us the SIP trace and let our engineers read it.
- Registration fails with 401 or 403. Wrong credentials, or the PBX is leaving from an IP that is not on the allow-list. Re-enter the password and confirm the public IP the PBX actually uses.
- One-way or no audio. NAT or SIP ALG is rewriting addresses. Disable SIP ALG, confirm the RTP range is open both ways, and set the external IP in the PBX.
- Calls drop at about 30 seconds. The classic ALG signature: the ACK never arrives, so the far side tears the call down as unconfirmed. Same fix as above.
- Outbound works, inbound does not. The DID is not mapped to an inbound route, or the dialed-number format does not match. Check whether the PBX expects 10 or 11 digits.
- Menus ignore key presses. A DTMF mismatch. Set the trunk to RFC 2833 so it matches what the carrier sends.
The SIP response codes guide decodes anything else the trunk sends back. If the trunk registers but a call fails with a 503, the SIP 503 explainer covers what it means and what to check.
What changes when the trunk comes from the carrier.
| AT THE TRUNK LAYER | SIPNEX (CARRIER) | PLATFORM-BUNDLED MINUTES |
|---|---|---|
| Who signs your calls | Us — own SP certificate, A-level | Whoever sits upstream, often B-level |
| Concurrent channels | Unlimited | Per-seat or per-trunk caps |
| Per-minute rate control | Published carrier rates | Bundled into platform pricing |
| Number ownership & porting | Yours, portable anytime | Tied to the platform relationship |
| PBX platform choice | Any SIP-capable system | The platform’s own |
| Support depth | Engineers who read SIP traces | Platform tier-1 |
About PBX SIP trunking with SIPNEX.
What is PBX SIP trunking?
What is a PBX trunk?
Which PBX platforms work with SIPNEX trunks?
Do you support registration and IP-based authentication?
Can I keep my phone numbers when I switch trunks?
Does a hosted or cloud PBX still need a SIP trunk?
Why does the carrier matter for caller ID reputation?
Can a legacy analog or digital PBX use SIP trunking?
Which firewall ports does a PBX need open for a SIP trunk?
Does Kari’s Law apply to a PBX connected by SIP trunk?
Can one SIP trunk serve PBX systems at several offices?
Point your PBX at a real carrier.
Tell us the platform and the call volume. You get trunk credentials within one business day and an engineer on the line if the registration doesn’t come up clean.