Voice over IP (VoIP) systems form the backbone of modern telecommunications, powering everything from small business PBXs to enterprise-grade contact centers. Legacy SIP stacks like Asterisk’s chan_sip have served reliably for decades, but their monolithic architecture struggles with contemporary demands such as WebRTC integration, high-concurrency scaling, and robust security protocols. As Asterisk deprecated chan_sip in version 17 and fully removed it in version 21, migrating to PJSIP—the modular, high-performance SIP channel driver—becomes essential for maintaining compatibility, performance, and future-proofing VoIP deployments.
PJSIP introduces a flexible object-based configuration model with distinct sections for transports, endpoints, AORs, authentication, and identification, enabling precise control over NAT traversal, media encryption (SRTP/TLS), and resource allocation. This migration not only reduces CPU overhead by up to 30% under load but also unlocks advanced features like template-based scaling and realtime database integration, critical for B2B VoIP providers handling thousands of simultaneous calls. For telecom professionals in India and beyond, this checklist provides a step-by-step roadmap to seamless transition, minimizing downtime while maximizing system reliability and compliance with evolving TRAI regulations.
Why Migrate to PJSIP?
The chan_sip module’s single-file configuration limits extensibility, making it hard to handle complex scenarios like multi-tenant setups or IPv6 transitions. PJSIP’s modular design separates concerns—transports for UDP/TLS binding, AORs for contact management, and endpoints for call handling—simplifying troubleshooting and upgrades. This architecture supports Asterisk’s evolution toward containerized deployments and AI-enhanced call routing.
Beyond deprecation, PJSIP excels in real-world performance: it processes SIP messages faster due to efficient threading and offers native WebRTC support via res_pjsip_webrtc, vital for browser-based softphones in contact centers. Enterprises report fewer dropped calls during peaks and easier integration with Kamailio or FreeSWITCH for load balancing. Migration aligns VoIP stacks with 2025 security mandates, reducing breach risks from outdated parsing vulnerabilities.
Pre-Migration Assessment
Start by parsing sip.conf to catalog all sections: note [general] bind settings, [user]/[peer]/[friend] types, register lines, and dialplan integrations in extensions.conf. Use CLI commands like “sip show peers”, “sip show users”, and “sip show registry” to capture live states, including qualified endpoints and codec preferences.
Profile your traffic with “core show channels” during business hours to map call volumes per trunk/extension. Simulate loads using SIPp to establish baselines for latency (<150ms), jitter (<30ms), and packet loss (<1%). Backup everything—configs, CDR databases, and Realtime schemas—while verifying hardware meets PJSIP’s multi-threaded demands (4+ cores recommended).
Plan dual-stack operation: allocate separate ports (5060 for chan_sip, 5061 for PJSIP) and update firewalls accordingly. Document custom dialplan logic, like macro-call or predial handlers, that may need PJSIP equivalents.
Preparation Steps
Upgrade to Asterisk 18 LTS or later, confirming PJSIP modules load via “asterisk -rx ‘module show like pjsip'”. Activate the conversion script: download sip_to_pjsip.py from Asterisk contrib, place in /etc/asterisk/, and execute “python3 sip_to_pjsip.py sip.conf > pjsip.conf.base”. Review output for manual tweaks, as it handles basics but misses nuanced NAT or qualify settings.
| chan_sip Setting | PJSIP Counterpart |
|---|---|
| bindaddr=0.0.0.0:5060 | [transport-udp] bind=0.0.0.0:5060 |
| type=friend nat=force_rport,comedia | type=endpoint; force_rport=yes; rtp_symmetric=yes; rewrite_contact=yes |
| secret=pass realm=example.com | [auth-xyz] type=auth; auth_type=userpass; username=xyz; password=pass; realm=example.com |
| register => user:pass@host | [reg-trunk] type=registration; server_uri=sip:user@host; outbound_auth=auth-trunk |
In modules.conf, comment out chan_sip loads initially (“noload => chan_sip.so”) for clean testing. Provision 5-10 test devices with dual registrations and validate firewall ACLs for new ports.
Detailed Configuration Mapping
PJSIP’s object model requires defining interrelated sections. Transports first: create [transport-udp], [transport-tcp], [transport-tls] with cert paths for secure variants. Auth sections hold credentials: [auth-internal] type=auth auth_type=userpass username=6001 password=pass.
AORs track locations: [6001] type=aor max_contacts=1. Endpoints tie it together: [6001-endpoint] type=endpoint transport=transport-udp context=from-internal disallow=all allow=!alaw,ulaw auth=auth-internal aors=6001. Identification matches inbound: [6001-identify] type=identify endpoint=6001-endpoint match=192.168.1.100.
For trunks without registration (IP-based inbound): skip AOR/registration, use identify with match=provider IP/mask. Outbound trunks add [trunk-reg] type=registration client_uri=sip:reg@yourpbx:5060 server_uri=sip:reg@provider:5060 retry_interval=60. Codecs, DTMF (rfc2833), and timers (session-expires) mirror chan_sip directly.
[6001]
type=endpoint
context=internal
disallow=all
allow=ulaw
auth=auth6001
aors=6001
rtp_symmetric=yes
force_rport=yesReload safely: “pjsip reload” parses without restart. Verify: “pjsip show endpoints”, “pjsip show aors”, “pjsip show contacts”.
Dual-Stack Testing
Bind PJSIP transports to 5061 initially. Migrate a pilot group (e.g., manager extensions and one trunk) by updating device configs to register to :5061 and dialing PJSIP/endpoint in dialplan tests: exten => 6001,1,Dial(PJSIP/6001).
Enable logging: “pjsip set logger on”, “rtp set debug on”, “pjsip set logger endpoint 6001”. Test scenarios: registration, inbound/outbound PSTN, internal transfers (attended/blind), hold/resume, conferencing. Use tools like MicroSip or Zoiper for endpoint simulation, sipp for load (100 CPS).
Metrics: monitor CPU via “core show processlist”, compare chan_sip vs PJSIP under identical stress. Address issues like 408 timeouts (NAT) by adding ice_support=yes for preliminary WebRTC prep. Rollback via dialplan priority fallbacks.
Full Cutover Execution
Schedule off-peak: batch-migrate extensions (e.g., 100 at a time), reload PJSIP, update devices. Converge ports: set chan_sip bindport=5061 temporarily, shift PJSIP to 5060, test overlap, then disable chan_sip entirely (“module unload chan_sip.so”).
Global dialplan sweep: replace all Dial(SIP/foo) with Dial(PJSIP/foo), Gosub(SIP) with Gosub(PJSIP). Restart Asterisk post-validation. Confirm: “core show channels” shows only PJSIP/, “sip show peers” errors out.
Security Hardening
Mandate TLS: generate Let’s Encrypt certs, configure [transport-tls] cert_file=/etc/asterisk/keys/asterisk.crt priv_key_file=asterisk.key method=tlsv1_3 require_client_cert=no. Endpoints: transport=transport-tls media_encryption=dtls direct_media=no.
[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
cert_file=/path/to/cert.pem
priv_key_file=/path/to/key.pem
method=tlsv1_2ACL via identify match=IP/CIDR, endpoint deny=0.0.0.0/0 allow=trusted_subnet/24. Enable SRTP: media_encryption=sdes or dtls. Auth inbound with [global] type=global endpoint_name=reject-unknown match_header=Contact <sip:unauth@> deny all.
Performance Optimization
In pjsip.conf [global]: realtime_aors=yes realtime_endpoints=yes for DB scaling. Endpoint: qualify_frequency=60s max_contacts=5. System tweaks: pjsip.conf taskprocessor overhead=high, /etc/sysctl.conf net.core.somaxconn=4096.
For 1000+ users, template endpoints: [base-phone](+) type=endpoint … then [6001](base-phone) unique settings. Frontend with Kamailio for SIP routing.
Troubleshooting Guide
Registration 401/403: verify realm match, auth section linkage. No audio: confirm rtp_symmetric=yes, external_media_address=publicIP in [global]. 403 Forbidden inbound: identify mismatch—use match=IP,port or ^sip:host$ regex.
Dial fails: “No endpoint” means missing identify; “transport error” flags port binds. Logs: increase logger verbosity, grep for PJSIP_CHANNEL. Common: strict SDP parsing rejects non-RFC media lines—set webrtc_ice_stun=yourstun.
Post-Migration Best Practices
Adopt templates for fleets: [template-base](+) type=endpoint … [ext-%{exten}](template-base). Integrate ARI for AI apps, Prometheus for monitoring “pjsip show channel”. Quarterly audits: pjsip show endpoints online.
Future-proof: enable IPv6 transports, PJSIP-over-QUIC experiments. For Sheerbit clients, leverage our migration toolkit for zero-downtime enterprise shifts.
Conclusion
This migration elevates legacy VoIP to a scalable, secure powerhouse, ready for AI contact centers and global expansion. Methodical execution ensures continuity while harnessing PJSIP’s modularity for tomorrow’s telecom innovations. Partner with Sheerbit for tailored Asterisk expertise from assessment to optimization and driving your VoIP success in 2025 and beyond.
