How does IP-based authentication work with an Asterisk PBX?
IP-based authentication is a common and reliable method used with Asterisk PBX when the system is hosted on a server with a static public IP address. Instead of authenticating using a username and password, calls are authorized based on the source IP address.
This authentication method is often preferred in server-to-server or carrier-grade setups because it reduces configuration complexity and avoids issues related to credential mismatches.
By default, this authentication scheme is used when your PBX has a fixed IP address that does not change over time.
When to use IP authentication
IP authentication is recommended if your Asterisk PBX is hosted on a server with a static IP address, such as a dedicated server or a cloud instance with a fixed public IP.
In this setup, you only need to provide your static IP address to the telephony provider. Calls originating from this IP will be automatically trusted and authorized.
This method is not suitable for dynamic IP environments or endpoints located behind frequently changing networks.
Basic SIP peer configuration
Once your static IP address has been authorized, you can configure the SIP peer in Asterisk. This configuration is typically defined in the sip.conf file.
Below is a basic example of a SIP peer configured for IP-based authentication:
[sip_proxy]
type=peer
host=87.238.224.117
disallow=all
allow=g729
nat=no
context=ringring
usereqphone=yes
outboundproxy=87.238.224.117
In this configuration, the host parameter defines the remote SIP server IP address. Since authentication is based on IP, no username or password is required.
The context parameter determines where incoming calls from this peer will be routed in the dial plan.
The allow directive specifies which codec is used. In this example, only G.729 is enabled, but additional codecs can be added if required.
Dial plan configuration
Once the SIP peer is defined, you can route outgoing calls through it using the Asterisk dial plan. This is done in the extensions.conf file.
The example below sends all dialed numbers to the SIP peer defined earlier:
[ringring]
exten => _X.,1,Ringing()
exten => _X.,2,Wait(1)
exten => _X.,3,Dial(SIP/${EXTEN}@sip_proxy)
This dial plan matches any dialed number and forwards the call to the SIP proxy using the configured peer.
The separation between SIP configuration and dial plan logic allows greater flexibility when managing call routing.
Security and best practices
When using IP authentication, security relies entirely on IP trust. For this reason, it is essential to ensure that your server IP is properly protected.
It is strongly recommended to:
- Use firewall rules to restrict SIP traffic to authorized IP addresses only
- Avoid exposing SIP ports to the public internet unnecessarily
- Monitor SIP logs for unexpected traffic or connection attempts
Because no credentials are used, protecting the IP layer is critical to preventing unauthorized access.
Advantages of IP-based authentication
IP authentication offers several advantages in professional environments.
- Simplified configuration without usernames or passwords
- Reduced risk of authentication failures
- Stable and predictable behavior for server-to-server connections
- Well-suited for SIP trunks and carrier interconnections
This approach is widely used in production environments where reliability and simplicity are required.
Context of use on Hivoox
On Hivoox, SIP trunk services offered by sellers can be configured using IP-based authentication when the customer provides a static IP address.
This article is intended to help users understand how to configure their Asterisk PBX correctly when this authentication method is used.
Conclusion
IP-based authentication with Asterisk is a straightforward and robust solution when working with static IP addresses.
By defining a trusted SIP peer and routing calls through the appropriate dial plan context, you can establish a secure and efficient SIP trunk connection without relying on traditional credentials.