Network Diagram

Visual representation of the complete VoIP lab topology, including VLAN segmentation and SIP trunk connection.

Diagramming Decisions

SIP Fundamentals

Understanding the Session Initiation Protocol and its role in modern VoIP communications.

SIP Protocol Deep Dive

SIP is signaling-only — it sets up, modifies, and tears down calls. It does not carry audio. SIP is a text-based protocol (similar to HTTP) that operates on UDP/TCP port 5060.

SDP: Session Description Protocol

SDP travels inside SIP and negotiates codecs and RTP ports. When a phone sends an INVITE, it includes an SDP body describing:

• Codecs supported: G.711 μ-law, G.729, etc.
• RTP port: Where to send audio (e.g., port 10004)
• IP address: Where the media should be sent

RTCP: Real-time Transport Control Protocol

RTCP is RTP’s companion protocol that monitors stream quality. It reports on:

• Jitter: Variation in packet arrival timing
• Packet loss: Percentage of lost packets
• MOS score: Mean Opinion Score (voice quality rating)
• Round-trip time: Latency measurement

The B2BUA Model

FreePBX/Asterisk acts as a Back-to-Back User Agent — this is critical to understanding SIP call flows.

Typical Call Flow

Phone A (1001)                FreePBX                Phone B (1002)
     |                             |                         |
     |---- INVITE (to PBX) -------->|                         |
     |<--- 100 Trying --------------|                         |
     |<--- 180 Ringing -------------|                         |
     |                             |---- INVITE (to 1002) --->|
     |                             |<--- 100 Trying ----------|
     |                             |<--- 180 Ringing ---------|
     |<--- 180 Ringing (relayed) ---|                         |
     |                             |<--- 200 OK --------------|
     |<--- 200 OK (relayed) --------|                         |
     |---- ACK -------------------->|---- ACK ---------------->|
     |<=== RTP Media =============>|<=== RTP Media ==========>|
     |                             |                         |

NAT Traversal

Why Network Address Translation breaks SIP, and comprehensive solutions.

The Core Problem

When a phone behind NAT puts a private IP in the SDP body, the remote side can’t send RTP back — causing one-way audio. SIP embeds IP addresses inside message bodies (SDP), not just headers. When NAT rewrites packet headers, the body remains unchanged — causing a mismatch.

NAT Traversal Solutions

STUN: Session Traversal Utilities for NAT

STUN allows endpoints to discover their public IP and port mappings. The phone queries a STUN server, receives its public address, and uses that in SDP.

From Domain Fix

For VoIP.ms trunk, the From Domain setting in FreePBX forces the correct public identity in SIP headers. This ensures the provider recognizes the registration and routes inbound calls correctly.

SIP ALG: The Silent Killer

SIP Application Layer Gateway attempts to fix NAT issues by rewriting SIP bodies. In practice, it often:

• Mangles SDP with incorrect IP addresses
• Breaks SIP message integrity
• Causes intermittent registration failures
• Corrupts packet payloads

UDP Session Timeouts

Routers maintain UDP “connections” in state tables. When idle, these entries expire. VoIP phones send periodic OPTIONS or re-REGISTER to keep sessions alive. When phones were moved to VLAN 10 (same subnet as FreePBX), session timeout issues disappeared because traffic no longer traversed the router.

QoS Theory

Voice traffic needs guaranteed low-latency forwarding to maintain call quality.

Why QoS is Essential

Voice traffic is uniquely sensitive to network conditions. Without QoS, data traffic (file transfers, streaming) can starve voice packets, causing choppy audio and dropped calls.

Layer 2: CoS (Class of Service)

CoS uses the 802.1p field in the Ethernet frame to mark priority at Layer 2.

Layer 3: DSCP (Differentiated Services Code Point)

DSCP uses the 6-bit field in the IP header for priority marking. It’s more granular than CoS and survives across Layer 3 boundaries.

QoS Implementation Best Practices

• Trust, don’t remark: IP phones already mark correctly; just trust their markings
• Apply at the edge: Set QoS policies at access ports where phones connect
• End-to-end: QoS markings must be honored throughout the network path
• WAN links: Most critical point — prioritize before traffic leaves the building

VLAN Theory

Voice must be isolated on its own VLAN for security, QoS, and performance.

Why Voice Needs Its Own VLAN

• QoS Policies: Apply different quality-of-service rules to voice vs. data
• Reduced Broadcast Domain: Smaller broadcast domains improve performance
• Security: Isolate voice traffic from data network sniffing
• Prevent Competition: Stop data traffic from competing with voice bandwidth

switchport voice vlan

The switchport voice vlan command signals the phone via CDP/LLDP to tag its voice frames. The phone separates voice and PC traffic onto different VLANs using the same physical cable.

DHCP Option 66: Zero-Touch Provisioning

DHCP Option 66 enables zero-touch provisioning by pointing phones to a provisioning server (TFTP/HTTP) on boot. The phone automatically downloads its configuration.

LLDP-MED (Link Layer Discovery Protocol – Media Endpoint Discovery)

LLDP-MED is an extension of LLDP that allows network devices to advertise:

• Voice VLAN ID
• QoS configuration
• Power over Ethernet (PoE) requirements

RTP Quality Thresholds

Accepted benchmarks for acceptable voice quality.

Voice Quality Benchmarks

MOS Score (Mean Opinion Score)

MOS is a subjective quality rating from 1 to 5, where listeners rate voice quality. It’s calculated based on network metrics:

• 5.0: Excellent — Face-to-face conversation quality
• 4.0-4.5: Good — Toll quality (PSTN standard)
• 3.5-4.0: Acceptable — Minor impairment
• 3.0-3.5: Fair — Noticeable degradation
• < 3.0: Poor — Unacceptable for business use

Factors Affecting Voice Quality

FreePBX / Asterisk Architecture

Understanding how the PBX routes and processes calls.

Core Components

Call Routing Logic

Call Flow Example

Incoming Call (DID 814-667-5639)
       ↓
  Inbound Route (matches DID)
       ↓
  Time Condition (business hours?)
       ↓
  IVR ("Thank you for calling...")
       ↓
  Ring Group (ext 1001, 1002)
       ↓
  Extension rings → Answer
       ↓
  RTP stream established

Analog / POTS

Understanding legacy telephony infrastructure and migration to VoIP.

FXS vs FXO Ports

Wiring Infrastructure

Migrating from POTS to VoIP

When migrating legacy systems:

• Identify all analog lines (fax, alarms, elevator phones)
• Plan for ATA (Analog Telephone Adapter) or gateway devices
• Test fax machines — they often have issues with VoIP
• Ensure emergency lines (elevator, alarm) remain functional

SIP Response Codes

Understanding what SIP responses mean and how to troubleshoot them.

Response Code Categories

Common Response Codes

Troubleshooting by Code

Network Configuration

VLAN setup, trunking, and inter-VLAN routing configuration.

802.1Q Trunking on Cisco 3750

Port Fa1/0/48 connects to the TP-Link ER605 and carries all VLANs as a trunk.

Why Trunking is Necessary

A single physical link carries multiple logical networks. Without trunking, each VLAN would need its own cable to the router. The TP-Link ER605 subinterfaces handle routing between VLANs.

VLAN Port Assignments

Inter-VLAN Routing

The TP-Link ER605 handles Layer 3 routing between VLANs:

• Router: Maintains routing table, forwards between subnets
• Switch: Pure Layer 2 switching within each VLAN

WireGuard VPN & DDNS

Secure remote access configuration for managing the lab from anywhere.

NO-IP DDNS Configuration

Dynamic DNS keeps a consistent hostname despite changing public IP addresses.

WireGuard VPN Setup

WireGuard provides encrypted tunnel access to the lab network from remote locations.

Configuration Purpose

• Secure Management: Access FreePBX GUI, SSH, and switch CLI remotely
• SIP Softphone: Run softphone apps that register as internal extensions
• Packet Capture: Remote SPAN session analysis via WireGuard

WireGuard VPN & DDNS

Secure remote access configuration for managing the lab from anywhere.

NO-IP DDNS Configuration

Dynamic DNS keeps a consistent hostname despite changing public IP addresses.

WireGuard VPN Setup

WireGuard provides encrypted tunnel access to the lab network from remote locations.

Configuration Purpose

• Secure Management: Access FreePBX GUI, SSH, and switch CLI remotely
• SIP Softphone: Run softphone apps that register as internal extensions
• Packet Capture: Remote SPAN session analysis via WireGuard

FreePBX Configuration

Core Asterisk setup, extensions, and system configuration.

Extension Setup

Two extensions configured for the Yealink phones:

Phone Registration Process

1. Phone boots and requests IP via DHCP (VLAN 10)
2. Phone sends REGISTER to FreePBX (192.168.10.100:5060)
3. FreePBX challenges with 401 Unauthorized (digest auth)
4. Phone responds with credentials
5. FreePBX accepts and updates AOR (Address of Record)

The delete=yes Voicemail Bug

How it was caught: sngrep showed successful SIP INVITE/200 OK flow to voicemail, but no message was playable. Log analysis revealed the file was deleted before the email handler processed it.

The fix: Changed to delete=no in voicemail.conf, allowing the message to persist after email delivery.

VoIP.ms SIP Trunk

Connecting to the public telephone network via VoIP.ms.

VoIP.ms Account Structure

PJSIP Trunk Configuration

Key Settings Explained

• From Domain: Ensures provider recognizes the registration origin
• Match Permit: Restricts inbound calls to VoIP.ms IP range
• chan_pjsip: Modern SIP channel driver replacing legacy chan_sip

Firewall & fail2ban

Securing the VoIP server against attacks and unauthorized access.

FreePBX Firewall Module Disabled

The integrated firewall module was disabled due to a compatibility issue with Debian 12.

Solution: Manage iptables directly without the FreePBX module.

Direct iptables Management

fail2ban Configuration

fail2ban monitors logs and bans IPs showing malicious patterns (brute force, scanning).

Essential jail.local Whitelist Entries

Packet Capture & SIP Analysis

Tools and techniques for analyzing VoIP traffic.

Cisco SPAN Session

Switched Port Analyzer (SPAN) mirrors traffic from source ports to a destination for capture.

sngrep: Terminal SIP Analysis

sngrep is a terminal-based SIP flow viewer — essential for quick diagnostics without GUI tools.

Reading a SIP Ladder

• Horizontal flow: Time progression left-to-right
• Vertical lines: Each SIP endpoint (phones, PBX, provider)
• Arrows: SIP messages between endpoints
• Colors: Request vs. response, success vs. error

tcpdump on FreePBX

Capture directly on the FreePBX server when SPAN isn’t available:

Wireshark Telephony Features

Wireshark provides specialized VoIP analysis tools:

• Telephony → VoIP Calls → Flow Sequence: Shows the full call ladder diagram
• Telephony → RTP → RTP Streams: Shows jitter, loss, and MOS per call
• Statistics → Flow Graph: Visual representation of packet flow
• Telephony → SIP: Filter and analyze SIP traffic specifically

Wireshark Filters

Homer SIP Capture

Homer provides web-based SIP capture and analysis with HEP protocol.

LibreNMS Monitoring

Network monitoring and alerting with SNMP.

LibreNMS Deployment

Running on Raspberry Pi 5, LibreNMS polls network devices every 5 minutes and tracks:

• Interface statistics: Bandwidth, errors, drops per port
• CPU and memory: Switch and router utilization
• Environmental: Temperature sensors (where available)
• Uptime: Device availability tracking

SNMP Configuration

SNMPv2c vs. SNMPv3

SNMPv3 Configuration (Configured on 3750)

Troubleshooting Scenarios

Real problems encountered and their resolutions, plus systematic troubleshooting patterns.

Troubleshooting Patterns

Common symptom-to-solution mappings for VoIP issues:

Systematic Diagnostics

Scenario Library

Command Reference

Quick lookup for commonly used commands across all platforms.