Caller ID Name Substitution with Asterisk

There’s only a pretty short list of numbers that I care about having Caller ID name substitution enabled for on my Asterisk setup, so I elected to use Asterisk’s native database and some adjustments to my extensions to substitute in a name into the CALLERID(name) field.

First up, to insert number-to-name mappings, do this;

database put cidname 5551234 "John Smith"

For each number you want to be able to resolve numbers for.  If you then do

database show cidname

You’ll then see the entries you’ve made.  Now, you need to adjust your dialplan.  Let’s say that your incoming calls go to the Asterisk context “incoming-sip”.  Change that context to “incoming-sip-cidlookup”, and then create a new context like this;

 exten => _X!,1,GotoIf(${DB_EXISTS(cidname/${CALLERID(num)})}?:nocidname)
 exten => _X!,n,Set(CALLERID(name)=${DB(cidname/${CALLERID(num)})})
 exten => _X!,n(nocidname),Goto(incoming-sip,${EXTEN},1)

What this does is pretty easy.  If an entry exists in the cidname database for the incoming call’s callerid, then substitute the name field in that callerid for the name in the database.  Once this is done (or if no entry exists in the first place), then direct the call to the regular incoming-sip context.

For small numbers of mappings, this seems to work pretty well.  I’m looking at having an automated system that looks up incoming unknown caller IDs against a reverse phone lookup system.  More on that when I figure it out…

Simple NAT Traversal with Asterisk

As an experiment, I configured Asterisk for full NAT traversal so that my SIP server could be accessed from the Internet.  This isn’t usually what you want, but here’s how you do it…

DANGER – Doing this will expose your Asterisk SIP server directly to the Internet, and you’ll get all manner of violated by SIP spammers.  Be aware of what you’re doing and what the implications are.

I’m assuming that you have a typical home NAT setup, where you have a dynamic IP, you’re in control of the border firewall (so you can do port forwarding), and your Asterisk install is on an internal network.

Step 1- Port Forwarding

First up, on your firewall, port forward the following ports to your Asterisk box;

5060/udp         # SIP control channel
10000:11000/udp  # the ports we will use for RTP

Step 2 – RTP Port Ranges

Right.  Now, create an rtp.conf in your Asterisk config, containing the following;


This constrains the list of allowed RTP ports for SIP to use for communications.

Step 3 – Lockdown

Now, a word on security.  Put the following into the [general] section of your sip.conf;


Now in your extensions.conf, define that context and put nothing in it.  Anyone who dials in anonymously to your SIP server will be directed to that context and go nowhere.  This is what you want (presumably).  For the love of God, do not put anything outbound in that context!

Step 4 – Configure NAT Traversal

In your sip.conf, in the [general] section (it must be there), add the following;


This causes the Contact headers of outbound SIP packets to be substituted with the IP address of the DNS name you specified there, if the destination is not in the localnet field.  This is important to make NAT traversal work.

Step 5 – Configure SIP peers

For each of your peers, configure them to use NAT traversal as follows (some of these options may not be strictly required, but this is what I did and it worked);


Step 6 – Wait for the bots

Now, if this has all worked, you should now be able to connect to your SIP server from the Internet.

May God have mercy on your server.

Music-On-Hold for Asterisk

Got Music On Hold (MOH) working for Asterisk 1.8.  Turns out that it’s not that hard, but there’s some specific requirements to get it going if you don’t want to use mpg123 or something.

First, you’ll need some source music to use.  If you go to Wikipedia, you can find a whole bunch of OGG music that’s free to use.  I grabbed something by Brahms.  I’d suggest you use stuff from there, that way you aren’t license encumbered and at risk of getting sued by the RIAA hit squads.

Once you have that, you’ll need to convert it to an 8000Hz, single-channel, OGG Vorbis sound file, by using SoX (available for Cygwin, which is what I did).  The command you’ll need is;

sox input.ogg output.ogg channels 1 rate 8000

Asterisk is very fussy about the format, so it must be exactly like that.  Next up, fire up the Asterisk console (asterisk -r) and run the following;

core show file formats

Look through that and verify that ogg_vorbis is listed.  Next, we’ll verify that Asterisk can actually transcode ogg to whatever codec your VOIP is using.  Run the following;

core show translation recalc 10

And verify that for the ‘slin’ row there is a number printed in the columns that correspond to the codecs that you’re using (in my case, that’s alaw, ulaw and g729).

Drop your ogg files into /usr/share/asterisk/sounds/moh/ (in my case).  You will now need to put the following into musiconhold.conf to make it work;


Your music-on-hold channel should be set to default anyway, so that should ‘just work’.  If you want, you can create a fake extension in extensions.conf like this to test it;

exten = 444,1,Answer()
same = n,MusicOnHold()

Ringing that extension should result in hearing music.  Consult your Asterisk logs, common issues will be the OGG files not being in the exact format required.

Good luck.

Asterisk in Docker

I’ve decided to bite the bullet, and I’m working on converting my existing Microserver Centos 6 setup across to Centos 7 with Docker containers for all my applications.

Why Docker?  Why not OpenVZ or KVM?  KVM was out straight away because my Microserver simply doesn’t have the spare CPU and RAM to be running full virtual machines.  OpenVZ is an attractive option, but there’s no non-beta release of OpenVZ for Centos 7.  So that leaves Docker amongst the options I wanted to look at.

Asterisk poses some challenges for Docker, namely that the RTP ports are pseudo-dynamic, and there’s a lot of them.  Docker does proxying for each port that’s mapped into a container, and spawns a docker-proxy process for each one.  That’s fine if you have 1-2 ports, but if you may have over 10,000 of them that’s a big problem.  The solution here is to configure the container to use the host’s networking stack, then do some config on the container so that it uses a different IP from the host (to keep the host’s IP space “clean”).  We’ll also be configuring the container as non-persistent so it pulls config (read-only) from elsewhere on the filesystem and stores no state between restarts.  And lastly, we’ll be using CentOS 6 as the Asterisk container OS (since Asterisk is available in the EPEL repository for that version).  It’s not a very new version of Asterisk, but it’s stable.

Let’s get started.  For the impatient, here’s the gist.

Create the Asterisk Container

First, we’ll assemble a Dockerfile.  We’ll base it off CentOS 6, and just install Asterisk.  We use the ENTRYPOINT command so that we can pass additional arguments straight to Asterisk on running the container.

FROM centos:6
MAINTAINER James Young <>

# Set up EPEL
RUN curl -L -o /tmp/epel-release-6-8.noarch.rpm && \
 rpm -ivh /tmp/epel-release-6-8.noarch.rpm && \
 rm -f /tmp/epel-release-6-8.noarch.rpm

# Update and install asterisk
RUN yum update -y && yum install -y asterisk

# Set config as a volume
VOLUME /etc/asterisk

# And when the container is started, run asterisk
ENTRYPOINT [ "/usr/sbin/asterisk", "-f" ]

Pretty simple stuff.  Note that processes should always run non-daemonized in Docker so that it can track the pid properly.

Prepare the Docker Host

Use whatever tool is appropriate (I’m forcing systemd, firewalld and network-manager on myself) in order to configure a second IP for your Docker host’s primary network interface.  Bleh.  Network Manager.

Be aware that when you use the host’s network stack in Docker and don’t explicitly expose the ports you’ll be using, Docker does not configure the firewall.  You’ll need to do that on the host.  We’ll cover that in the Makefile.

Create the Makefile

We’ll use a Makefile to handle all the tasks we’re dealing with in this container.  Here it is;

SHELLCMD=asterisk -rvvvvv

all: build install start

 docker build -t zencoffee/$(CONTAINER):latest .

 cp -f $(CONTAINER)_container.service /etc/systemd/system/$(CONTAINER)_container.service
 systemctl enable /etc/systemd/system/$(CONTAINER)_container.service
 firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 --proto udp -d --dport 5060 -j ACCEPT
 firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 --proto udp -d --dport 10000:20000 -j ACCEPT
 firewall-cmd --direct --add-rule ipv4 filter INPUT 0 --proto udp -d --dport 5060 -j ACCEPT
 firewall-cmd --direct --add-rule ipv4 filter INPUT 0 --proto udp -d --dport 10000:20000 -j ACCEPT

 systemctl start $(CONTAINER)_container.service
 sleep 2
 systemctl status $(CONTAINER)_container.service

 docker exec -it $(CONTAINER) $(SHELLCMD)

 systemctl stop $(CONTAINER)_container.service || true
 docker stop -t 2 $(CONTAINER) || true
 docker rm $(CONTAINER) || true
 docker rmi zencoffee/$(CONTAINER) || true
 systemctl disable /etc/systemd/system/$(CONTAINER)_container.service || true
 rm -f /etc/systemd/system/$(CONTAINER)_container.service || true
 firewall-cmd --permanent --direct --remove-rule ipv4 filter INPUT 0 --proto udp -d --dport 5060 -j ACCEPT || true
 firewall-cmd --permanent --direct --remove-rule ipv4 filter INPUT 0 --proto udp -d --dport 10000:20000 -j ACCEPT || true
 firewall-cmd --direct --remove-rule ipv4 filter INPUT 0 --proto udp -d --dport 5060 -j ACCEPT || true
 firewall-cmd --direct --remove-rule ipv4 filter INPUT 0 --proto udp -d --dport 10000:20000 -j ACCEPT || true

Of course, I’m using firewalld here (bleh again) and systemd (double bleh).  You can see that this simply does a build of the container, then puts the systemd service into place and punches all the appropriate RTP and SIP ports on the IP address that Asterisk will be using.

Configure the Systemd Unit

Now we need a unit for systemd, so we can make this run on startup.  Here it is;

Description=Asterisk Container

ExecStart=/usr/bin/docker run --rm=true --name asterisk -v /docker/asterisk/config:/etc/asterisk:ro -v /docker/asterisk/logs:/var/log/asterisk -v /docker/asterisk/codecs/ -v /docker/asterisk/codecs/ --net=host zencoffee/asterisk:latest
ExecStop=/usr/bin/docker stop -t 2 asterisk


The run command there does a number of things;

  • Pulls Asterisk config from /data/asterisk/config (read-only)
  • Writes Asterisk logs to /docker/asterisk/logs
  • Pulls in a g723 codec and a g729 codec for Asterisk to use (read-only)
  • Enables host networking

If you are missing those codecs, remove the two -v’s that talk about them.  Also, you will likely have differently optimized versions anyway (Microserver has a pretty weak CPU, so Pentium4 is the right one to use for that).

Edit the Asterisk Config

You’ll need the default Asterisk config, which you can extract by building the container and running it up with;

docker run -d --name extract -v /docker/asterisk/config:/mnt zencoffee/asterisk:latest
docker exec -it extract /bin/bash
cp /etc/asterisk/* /mnt/
docker stop extract
docker rm extract

From there, you can put in your own customized Asterisk config.  There’s a few bits you need to tweak.  In sip.conf, set udpbindaddr and tcpbindaddr to the secondary IP that you want Asterisk listening on.  in rtp.conf, ensure that rtpstart and rtpend match the ports you set up the firewall for.

Finally, putting it together!

Put your asterisk_container.service, Dockerfile and Makefile into the same directory.  Put your config into /docker/asterisk/config (in this example), your codecs into /docker/asterisk/codecs, and create a blank /docker/asterisk/logs .

You will also need a cdr-csv and cdr-custom directory in the logs dir if you want that functionality (Asterisk doesn’t create it).

Quickstart:  Just make all to do the whole lot and start it 🙂

  1. Run make build to construct the image.
  2. Run make install to configure firewalld rules and put the systemd unit in place
  3. Run make start to start the container
  4. Run make shell to get an Asterisk prompt inside the container

You can also do a docker logs asterisk to see what’s going on, and you can start/stop the container like a normal systemd service.

Good luck!

Cisco 7965 Phone Directory Setup

The Cisco 7965 has a Directory button, which can retrieve an XML document from a website and format that as a phone directory.  Setting it up is pretty simple.

In the SEPxxxx.cnf.xml for your phone, find the directoryURL tag and set that;


Then, create that file on your web server.  An example appears below;

<Title>Home Directory</Title>
<Prompt>Select a number</Prompt>
 <Name>Pizza Shop</Name>

The items appear in the order they are listed.  I’m sure there’s more cleverness you can do with the directory, but that should get you started.

Cisco 7965 VOIP Phones Standalone (with Asterisk)

My work has a number of older Cisco 7965 VOIP Unified Communications phones, which are being disposed of.  I thought I’d grab one and see if I could make it work.  These phones are intended to be used with a Cisco Unified Call Manager & using Cisco’s proprietary SCCP protocol.  But it’s possible to re-flash them with a SIP-based firmware and configure them without UCM.

Firstly, you will need the following components;

  • A SIP server on your local network (eg, Asterisk).  That SIP server needs to support any of g729, u-law and/or a-law codecs.
  • A DHCP server on your local network, which you can customize DHCP options for.
  • A TFTP server that you can point your phone at.
  • The Cisco 7965 SIP Firmware Bundle.  I won’t link it here, but you can find it by looking through the references at the end of this article.  The exact version I used was (md5 4088c17c622a1e181b1c2b1265349df6).
  • A Cisco 7965 phone (duh) and some way to power it.

And some references.

Let’s get started.

Reflashing the Phone

Extract the entire firmware package (it should contain a number of .sbn and .loads files) into the root of your TFTP server.  Then, in that root, create a new XMLDefault.cnf.xml containing the following;

<loadInformation8 model="Cisco 7965">SIP45.9-3-1SR4</loadInformation8>

In your DHCP configuration, add option 66 and option 150 pointing to the IP address of your TFTP server.

Power up the phone, and hold down the hash (#) button until the line buttons alongside the display start blinking.  Now, enter 123456789*0# on the keypad.  The screen should flash a few times and it should then enter the updater which will reflash the firmware from your TFTP server and do a factory reset at the same time.

Once that’s done, you can verify under Settings->Model Information that the Call Control Protocol is listed as SIP.

Configuring Asterisk

I’m assuming here you are using users.conf to generate extensions into extensions.conf, and have an otherwise normal Asterisk setup.  It’s critical that the extension which the phone is using has specified ‘nat=no’, otherwise it will simply refuse to register.  Obviously change your names, secrets and extensions to suit your setup!

Put this into users.conf;

fullname = My-VOIP-Phone
secret = PASSWORD
context = my-context
qualify = yes
alternateexts = 502

If your Asterisk setup doesn’t support g729, remove it from the codec list.  Reload Asterisk, and you’re nearly there.

Configure Phone XML

Now the hard bit.  You need to create a SEPxxxx.cnf.xml file in the root of your TFTP server where xxxx is the UPPERCASED version of your device’s MAC address.

You must get all parts of this file exactly right.  Even one tiny typo will stop the phone from reading the config.  I’ll put my file here with some adjustments to protect the innocent.  Interesting parts are bolded.

In order to reboot the phone, press Settings and then (quickly) enter **#** .

<device xsi:type="axl:XIPPhone" ctiid="1234567890">
 <!-- FIXME: Set your preferred date format and timezone here -->
 <timeZone>Cen. Australia Standard/Daylight Time</timeZone>
 <!-- NTP might not actually work, but the phone can set the
 date/time from the SIP response headers -->

 <!-- This section probably does not do anything useful. -->
 <member priority="0">
 <!-- Force short registration timeout to keep NAT connection alive -->
 <!-- FIXME: This will appear in the upper right corner of the display -->
 <line button="1">
 <line button="2">

<!-- FIXME: Change this to upgrade the firmware -->

 <!-- For Sunday (1) and Saturday (7):
 Current default is to enable the display 24/7.

Fill in the details as suiting your environment, and reboot the phone.  Cross your fingers.  Changing the timezones is a particular bugbear, you’ll need to dig around to find the correct values for your timezone.  Preferred codecs can be set to g711ulaw, g711alaw, g729a, or none.

The SSH username/password just gets you past the SSH challenge, you still need a login for the phone itself (log/log will show the logs remotely though).

You can configure the six line buttons to be any combination of SIP clients or speed-dials.  An example of each is above.  Now for the one piece remaining, the dial plan.

Configuring the Dial Plan

Create a new dialplan.xml in the root of your TFTP server, containing this;

 <TEMPLATE MATCH="5.." Timeout="0"/>
 <TEMPLATE MATCH="000" Timeout="0"/>
 <TEMPLATE MATCH="106" Timeout="0"/>

 <TEMPLATE MATCH="1831-" Timeout="2"/>
 <TEMPLATE MATCH="1832-" Timeout="2"/>

 <TEMPLATE MATCH="13........" Timeout="0"/>
 <TEMPLATE MATCH="18........" Timeout="0"/>
 <TEMPLATE MATCH="19........" Timeout="0"/>

 <TEMPLATE MATCH="13...." Timeout="0"/>

 <TEMPLATE MATCH="61........." Timeout="0" Rewrite="0........"/>
 <TEMPLATE MATCH="001....-" Timeout="5"/>
 <TEMPLATE MATCH="02........" Timeout="0"/>
 <TEMPLATE MATCH="03........" Timeout="0"/>
 <TEMPLATE MATCH="04........" Timeout="0"/>
 <TEMPLATE MATCH="07........" Timeout="0"/>
 <TEMPLATE MATCH="08........" Timeout="0"/>
 <TEMPLATE MATCH="111" Timeout="0"/>

 <TEMPLATE MATCH="2......." Timeout="0"/>
 <TEMPLATE MATCH="3......." Timeout="0"/>
 <TEMPLATE MATCH="4......." Timeout="0"/>
 <TEMPLATE MATCH="5......." Timeout="0"/>
 <TEMPLATE MATCH="6......." Timeout="0"/>
 <TEMPLATE MATCH="7......." Timeout="0"/>
 <TEMPLATE MATCH="8......." Timeout="0"/>
 <TEMPLATE MATCH="9......." Timeout="0"/>

 <TEMPLATE MATCH="*.." Timeout="0"/>
 <TEMPLATE MATCH="*" Timeout="15"/>

There’s a bit of redundancy and probably errors in this, but this is what I use.  Obviously this is engineered for Australia, so it’s formatted for Australian numbers.

At the very least, that dial plan should get you started.

Hope it worked!

If all has gone well, the C7965 has registered to Asterisk, and you can test a call.  Try and receive a call first, then try and deliver one.  Use the ‘sip show users’ command to check that the phone is registering, and the ‘sip show channels’ command to view the codec that’s being used when in a call.

Good luck!