Documentation

Connect Asterisk to Open Voice Shield

Create an IP-authenticated chan_pjsip trunk to sip.ovs.telecomsxchange.com port 5060, whitelist your server's public IP on the Network page, and Dial() the calls you want analyzed through it: no registration, no credentials, G.711 in the INVITE. The verdict appears after hang-up.

Before you start#

• An Open Voice Shield account. Signup is self-serve and starts you with US$5 of credit.
• The public IP address your Asterisk sends SIP from: the address after NAT, not the one on its interface.
• A destination, the carrier or SBC the calls were already going to. We relay each accepted call on to it.
• Firewall: UDP or TCP 5060 to the ingress, and UDP 30000–40000 open in both directions for RTP. See the firewall rules.

Step 1: whitelist your server's IP#

Open the Network page in the portal and add the public address your Asterisk sends from as a CIDR entry (a single host is a /32). The whitelist is the authentication: there is no SIP account and no password, and an INVITE from any other address is answered 403.

Step 2: create the trunk#

The trunk is a standard chan_pjsip endpoint, AOR and identify, the same three objects you would configure for any IP-authenticated carrier. Do not add an outbound_auth or a registration section: a REGISTER sent to the ingress is answered 403.

[ovs]
type = endpoint
transport = transport-udp
aors = ovs
allow = !all,ulaw,alaw
direct_media = no

[ovs]
type = aor
contact = sip:sip.ovs.telecomsxchange.com:5060

[ovs]
type = identify
endpoint = ovs
match = sip.ovs.telecomsxchange.com

Verified against the Asterisk 20 chan_pjsip documentation. Adapt the transport name and file layout to the version your switch runs.

• allow = !all,ulaw,alaw puts G.711 first. Anything else is relayed but produces no transcript and no verdict.
• direct_media = no keeps the audio on the trunk, which is what makes the recording possible.
• Your Asterisk offers SDP in the initial INVITE by default. Keep it that way. An INVITE without SDP is answered 488.

Step 3: route every call through the trunk#

Point your outbound pattern at the new trunk. The dialled number and caller ID pass through unchanged, and the call leaves us to your configured destination.

[outbound]
exten => _X.,1,Dial(PJSIP/${EXTEN}@ovs)
 same => n,Hangup()

Or route one call in ten#

You do not have to move all your traffic. Sampling is a supported pattern. RAND(1,10) picks the tenth of your calls that take the extra hop. The rest keep your existing route.

[outbound]
exten => _X.,1,GotoIf($[${RAND(1,10)} = 1]?sample)
 same => n,Dial(PJSIP/${EXTEN}@carrier)      ; your existing route
 same => n,Hangup()
 same => n(sample),Dial(PJSIP/${EXTEN}@ovs)
 same => n,Hangup()

Verified against the Asterisk 20 dialplan documentation (GotoIf and the RAND function). Adapt the pattern and trunk names to your dialplan.

Step 4: place a test call#

Dial a real number over the new route and talk on both legs for at least 30 seconds. A leg that never speaks produces a one-sided transcript. After hang-up the call appears in Calls in the console with its recording, per-channel transcript and verdict, usually within a minute.

• Rejected 403? The source address is not whitelisted. Compare your own SIP trace with the CIDR entries on the Network page.
• One-way audio? A firewall rule on UDP 30000–40000, not a signalling problem.
• A recording but no verdict? The call negotiated a codec we do not decode (G.711, G.722, G.729 and G.723.1 are supported): check allow on the endpoint.

Anything else: Troubleshooting lists every rejection code and the check that clears it.

Frequently asked questions#

Ready to try it? Create an account. Signup is self-serve and comes with US$5 of credit, enough to analyze your first test calls.