Configuring Asterisk on Your CloudSOE Instance

This guide covers the layout and day-two configuration of the CloudSOE Asterisk image on both AWS and Azure. It assumes you’ve finished one of the getting-started guides (AWS, Azure).

File locations

Services

sudo systemctl status asterisk fail2ban
sudo systemctl restart asterisk     # full restart (drops calls)

For most config changes you don’t need a restart — reload from the console instead:

sudo asterisk -rvvv
pjsip reload
dialplan reload

The one-time asterisk-firstboot service only fills the public IP into the login banner; it exits immediately on later boots thanks to its marker file (/var/lib/asterisk-firstboot.done).

NAT settings — the most important cloud step

Your instance sits behind 1:1 NAT: Asterisk only knows its private IP, while peers see the public one. Without NAT configuration you get registrations that work but calls with no audio. In pjsip.conf, tell the transport its real addresses:

[transport-udp]
type = transport
protocol = udp
bind = 0.0.0.0:5060
external_media_address = <public-ip>
external_signaling_address = <public-ip>
local_net = 10.0.0.0/8

Set local_net to your actual VPC/VNet range, then pjsip reload. The login banner shows your public IP. On endpoints serving remote phones, also consider rtp_symmetric=yes, force_rport=yes and rewrite_contact=yes.

The security log and fail2ban

Asterisk 21+ reports authentication failures as security events, which only hit disk when a security logger channel exists — the image adds one to logger.conf so fail2ban has something to watch. Don’t remove that line, or the jail goes blind.

The jail in /etc/fail2ban/jail.d/asterisk.local uses the stock Asterisk filter with CloudSOE tuning: 5 failures in 10 minutes → 1 hour ban, escalating for repeat offenders up to 1 week (bantime.increment = true). Adjust the numbers there and sudo systemctl restart fail2ban if your risk profile differs.

RTP port range

/etc/asterisk/rtp.conf holds the media range, defaulting to Asterisk’s standard 10000–20000 UDP. If you narrow it (each call needs a handful of ports), update your security group / NSG to match exactly, then restart Asterisk.

A minimal test endpoint

To verify the box end-to-end, a throwaway PJSIP endpoint in pjsip.conf plus a dialplan entry in extensions.conf is enough to register a softphone and dial an echo test:

; extensions.conf
[from-internal]
exten => 600,1,Answer()
 same => n,Echo()

Use a long random password on every endpoint — wardialers guess short ones, and your fail2ban logs will show them trying.

Next steps

• Tips & tricks — fail2ban management, one-way audio, backups and troubleshooting