Asterisk PJSIP: Setting Up Peers (Latest Versions)

In modern Asterisk, “peers” are configured using PJSIP endpoints. If you come from old tutorials (chan_sip), the terms “peer/user/friend” are legacy.

Today, the correct mental model is: Endpoint + AOR + Auth + Identify.

This guide shows how to set up PJSIP peers cleanly for the latest Asterisk versions, including the exact configs people search for: softphones, IP phones, and internal extensions.

What “Peer” Means in PJSIP (Modern Asterisk)

In PJSIP, a device/extension is usually built from these blocks:

• endpoint → call rules (codecs, context, callerid, media settings)
• aor → where to reach the device (registration contact or static IP)
• auth → username/password authentication
• identify → IP matching (mainly for trunks, gateways, or static devices)

If any of these pieces are wrong or missing, you will see common errors like: 401 Unauthorized, No matching endpoint, or calls not routing.

Where to Configure Peers

Most installations use:

/etc/asterisk/pjsip.conf

And you must reload PJSIP safely after changes:

asterisk -rvvv
pjsip reload

For deeper reload (if needed):

core reload

Step 1 — Create a Basic PJSIP Extension (Endpoint + AOR + Auth)

This is the most common setup: a phone/softphone registers using username/password.

; ---------------------------
; EXTENSION 1001 (REGISTERING DEVICE)
; ---------------------------

[1001]
type=endpoint
context=from-internal
disallow=all
allow=ulaw,alaw
auth=1001
aors=1001
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
callerid="Agent 1001" <1001>

[1001]
type=auth
auth_type=userpass
username=1001
password=STRONG_PASSWORD_HERE

[1001]
type=aor
max_contacts=1
remove_existing=yes

This works for most softphones and IP phones behind NAT. The NAT-safe trio here is: rtp_symmetric, force_rport, rewrite_contact.

Step 2 — Confirm Registration

After configuring the extension, confirm it registers.

asterisk -rvvv
pjsip show endpoints
pjsip show aors
pjsip show contacts

What you should see:

• Endpoint exists (1001)
• AOR has contact
• Contact shows the device IP/port

Step 3 — Set the Dialplan to Call the Peer

Your endpoint uses context=from-internal. Ensure your dialplan has a matching rule in:

/etc/asterisk/extensions.conf

[from-internal]
exten => 1001,1,Dial(PJSIP/1001,20)
 same => n,Hangup()

Reload dialplan:

dialplan reload

Most Searched Peer Problems and Fixes

1) “No matching endpoint found”

This usually means the REGISTER request did not map to any auth/endpoint. Fix by confirming:

• Username exactly matches auth username
• Endpoint name matches auth/aor references
• You didn’t forget auth=1001 or aors=1001

2) 401 Unauthorized Loop

Common reasons:

• Wrong password on phone
• Wrong username in phone
• Duplicate endpoint name conflicts

Debug quickly:

pjsip set logger on

Then retry registration from phone and read the auth headers.

Peers Behind NAT: Settings You Should Use (Modern Defaults)

For most phones behind NAT, use these on the endpoint:

direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes

Why:

• direct_media=no keeps media through Asterisk (prevents NAT bypass issues)
• rewrite_contact fixes Contact header NAT mismatch
• force_rport ensures responses go back to the correct port
• rtp_symmetric sends RTP to the address it receives from

Static IP “Peers” (No Registration)

Some devices do not register (gateways, intercoms, SBCs). In that case, you define AOR with a static contact and identify by IP:

; ---------------------------
; STATIC DEVICE AT 192.168.10.50
; ---------------------------

[intercom01]
type=endpoint
context=from-internal
disallow=all
allow=ulaw,alaw
aors=intercom01
direct_media=no

[intercom01]
type=aor
contact=sip:intercom01@192.168.10.50:5060

[intercom01]
type=identify
endpoint=intercom01
match=192.168.10.50/32

This is also how most SIP trunks are matched (identify/match).

Recommended “Peer Template” Approach (Cleaner Config)

For large deployments, create templates to avoid repeating settings:

[endpoint-template](!)
type=endpoint
context=from-internal
disallow=all
allow=ulaw,alaw
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes

[aor-template](!)
type=aor
max_contacts=1
remove_existing=yes

[auth-template](!)
type=auth
auth_type=userpass

Then define peers like:

[1002](endpoint-template)
auth=1002
aors=1002
callerid="Agent 1002" <1002>

[1002](auth-template)
username=1002
password=STRONG_PASSWORD_HERE

[1002](aor-template)

This structure is easier to maintain and reduces production mistakes.

Verification Checklist (Before You Move Forward)

• Peer shows under pjsip show endpoints
• Contact exists under pjsip show contacts
• Dialplan context exists and dials PJSIP/peer
• Firewall allows SIP + RTP ports
• NAT flags enabled for remote phones

If these are correct, your peers are ready for: IVR, queues, inbound routing, outbound dialing, and full call center flows.

Key Takeaway

In PJSIP, peers are not a single block. They are a clean set of building blocks: Endpoint + AOR + Auth (+ Identify when needed).

Once you understand this model, modern Asterisk becomes easier, more scalable, and far more reliable than legacy SIP tutorials.