Asterisk architecture and PJSIP, for the people who will run it.

What Asterisk is, and what it is not

The project describes itself as "an Open Source PBX and telephony toolkit" and, more usefully, as "middleware between Internet and telephony channels on the bottom, and Internet and telephony applications at the top".2 Its documentation puts the purpose as "being an engine for building Real Time Communication systems and applications".5

In SIP terms Asterisk is a back-to-back user agent (B2BUA). The Asterisk documentation does not use that phrase, but its own description of a call is the definition. When one phone calls another, "The inbound channel is created from Alice's phone calling Asterisk", then "Asterisk then calls the extension dialed by Alice by creating an outbound channel to talk to Bob", and the two channels are put into a bridge.7 RFC 3261 defines a B2BUA as an entity that "receives a request and processes it as a user agent server" and then "acts as a user agent client (UAC) and generates requests"; "Unlike a proxy server, it maintains dialog state and must participate in all requests sent on the dialogs it has established."1

That one fact explains most of what Asterisk is good and bad at. Because it terminates both legs, it can answer a call, play a prompt, collect digits, record, transcode, conference and put people on hold: it is a media server as much as a signalling element. Because it holds state and usually media for every call, it is not the tool for routing very large numbers of registrations or calls that it never needs to touch. That job belongs to SIP proxies such as Kamailio and OpenSIPS, and a common production pattern is a proxy at the edge with Asterisk behind it doing the media work.

Licence and stewardship

Asterisk "is distributed under the GNU General Public License version 2 and is also available under alternative licenses negotiated directly with Sangoma US Inc."3 Two consequences in the licence file matter in practice:

• Loadable modules are covered. "If you obtained Asterisk under the GPL, then the GPL applies to all loadable Asterisk modules used on your system as well", with the exceptions the file lists. Sangoma, which "holds copyright and/or sufficient licenses to all components", can grant permission for proprietary modules.3
• External applications are not. For AMI, AGI and ARI, the file says "It is our belief that applications using these protocols to manage or control an Asterisk instance do not have to be licensed under the GPL", and adds a fallback grant if a court ever disagreed.3 This is why most commercial products built on Asterisk keep their logic in an external process talking ARI or AMI rather than in a C module.

The "Asterisk" name and logos are Sangoma trademarks.3 Sangoma describes itself on asterisk.org as "the primary sponsor and developer of Asterisk", and sells support; its top support level "requires the utilization of Certified Asterisk", a separate long-lived release line.4

The core concepts: channels, bridges, dialplan

Asterisk is a small core plus many modules. "The heart of any Asterisk system is the core", which "reads the configuration files, including dialplan and loads all the other modules"; "Other than functionality provided by the core of Asterisk, modules provide all other functionality."5 Five ideas carry everything else.

Channels. "A channel is an entity inside Asterisk that acts as a channel of communication between Asterisk and another device."7 A two-party call is two channels. Each has its own variables, caller ID and state, and each can be hung up, redirected or recorded on its own.

Channel drivers. "Channel Drivers provide channels in Asterisk"7; they translate a device's signalling to the core.6 In the current source tree the drivers are chan_pjsip (SIP), chan_iax2 (IAX2), chan_dahdi (analogue and digital telephony cards), chan_websocket, chan_audiosocket, chan_rtp, chan_bridge_media, chan_motif (XMPP/Jingle), chan_unistim and chan_console.13 chan_sip, chan_skinny and chan_mgcp are gone; the section on chan_sip below has the versions.

Bridges. "In Asterisk, a bridge is the construct that shares media among Channels." There are two categories, two-party and multiparty. A core bridge is "the basic two-party bridge", where Asterisk handles the media and can transcode, record and run DTMF features. A native bridge happens "when both participants in a two-party bridge have similar channel technologies"; the remote variant sends media directly between the devices, is only possible with SIP channels, and is limited to cases where neither device is behind NAT. Mixing bridges serve conferences; holding bridges are a waiting area where participants cannot exchange media. Asterisk "will automatically choose the best mixing technology available based on the channels in the bridge" and can change it mid-call, for example when an attended transfer turns a two-party call into a three-way one.8 The implementations live in the source as bridge_simple, bridge_native_rtp, bridge_softmix and bridge_holding.16

The dialplan. "The core loads and builds the dialplan, which is the logic of any Asterisk system."5 It lives in extensions.conf and is "essentially a scripting language specific to Asterisk".10 It is organised into contexts ("the basic organizational unit"), each containing extensions ("a named set of actions"), each made of numbered priorities executed in order. You must declare priority 1 explicitly; after that n means "the previous priority number plus one", and same => saves repeating the extension.11 Patterns start with an underscore: X is any digit, Z is 1 to 9, N is 2 to 9, and the period and exclamation mark match the rest of the string. The documentation warns that those last two "match more than just digits. They match on characters", which matters for security.12

Applications and functions. Applications do things to a channel: answer it, play a prompt, dial. Functions read or set things about it, such as the outbound caller ID.6 In dialplan, Dial() is an application and ${CALLERID(num)} is a function.

Underneath sits the Stasis message bus, added in Asterisk 12: "an internal publish/subscribe message bus". Before it, core components were "responsible for updating AMI, the CDR Engine, and other modules"; afterwards, "the logic for AMI, CDRs, and other consumers of state is no longer tightly coupled with the real-time components".9 The same name appears on the Stasis dialplan application used by ARI, covered below.

Modules and the module loader

The documentation lists nine module types: channel drivers, dialplan applications, dialplan functions, resources (shared services such as music on hold and call parking), codecs, file format drivers, CDR drivers, CEL drivers (which log "what happened inside of Asterisk during a particular call") and bridge drivers.6 In the source tree the file name carries the type: chan_ files in channels/, bridge_ in bridges/, res_ in res/.131653

modules.conf controls loading. The sample ships with autoload=yes, meaning every module installed in the modules directory loads unless you say noload. It also documents require ("Asterisk will exit with a status code of 2 if a required module does not load") and says of the old preload trick: "There is no good reason left to use 'preload' anymore."17

Not every module is equally maintained. The documentation's support states are core ("supported by both Sangoma and the community"), extended ("supported by the Asterisk community, and may or may not have an active developer"; no bug-fix support from Sangoma) and deprecated ("The module will remain in the tree, but there is a better way to do it"). Deprecated modules are not built unless explicitly selected in menuselect.18

PJSIP: chan_pjsip, res_pjsip and the objects

SIP in modern Asterisk is two layers. The channel driver is "chan_pjsip which depends on res_pjsip and its many associated modules"; "The res_pjsip module handles configuration", which is read from pjsip.conf.22 Features such as outbound registration, IP-based identification and ACLs are separate res_pjsip_* modules, each with its own configuration reference.22 Under both sits the PJPROJECT SIP stack; since the build uses the bundled copy by default ("Use bundled pjproject libraries (default)" in configure.ac), you normally never install it separately.60

Where chan_sip had one [peer] or [friend] section per device, PJSIP splits a device into several linked objects.35 This is the part people find confusing, and it is worth learning properly because every PJSIP problem is a problem with one of these links.

Scroll the table sideways to see every column.

That last row is the classic trap. The outbound registration documentation says the registration and the endpoint "are considered completely separate from each other, as far as Asterisk is concerned", and that to receive calls "you will need to set up an endpoint that represents this provider".25 A trunk that registers successfully but rejects every inbound call is almost always a registration with no matching endpoint and identify.

Smaller objects complete the set: domain_alias, acl (which "operates on all inbound SIP communication", independent of endpoints), and the system and global sections.23

How Asterisk decides who is calling

Every inbound SIP request has to be matched to an endpoint before anything else happens. The order is set by endpoint_identifier_order in the global section, and the compiled-in default is ip,username,anonymous.3031

• ip uses identify objects. match takes "a comma-delimited list of IP addresses or hostnames", with CIDR or dotted-decimal masks; for a hostname, "Asterisk will resolve the hostname and add all A and AAAA records". match_header matches on a SIP header value instead.28
• username matches "the username and domain in the From header", retrying on the username alone if the exact match fails. The per-endpoint identify_by option (default username,ip) decides which methods an endpoint accepts, and also governs AOR matching for registrations: "You must list at least one method that also matches for AORs or the registration will fail."2927
• auth_username exists but carries a documented security cost: the Authorization header is absent on the first request, so the security event for an unmatched request has to be deferred, which "may result in a delay before an attack is recognized".29
• anonymous: "By default anonymous inbound calls via PJSIP are not allowed." To accept them you must define an endpoint named anonymous, and the sample says plainly, "It is not recommended to accept anonymous calls."31

Two defaults deserve attention. An endpoint without a context lands in the context named default.27 And an AOR's max_contacts defaults to 0, so a phone cannot register at all until you raise it; the reference notes that to "stick with the older chan_sip behaviour" you set it to 1 with remove_existing=yes.29

chan_sip is gone: deprecated in 17, removed in 21

The old SIP driver was deprecated in Asterisk 17 (released October 2019) and "officially removed in Asterisk 21", which shipped in 2023.2120 The module deprecations table records the same, along with the other removals in 21: app_macro (deprecated in 16), chan_skinny and chan_mgcp (deprecated in 19).19 You can see it in the tree: chan_sip.c is present in the channels directory on branch 20 and absent from branch 21.1415

Practically: Asterisk 20 is the last series that contains chan_sip, and it moved to security fixes only on 19 October 2026.55 A system still on chan_sip has, at most, a year of security fixes left before it is running unsupported software. The project ships a converter, sip_to_pjsip.py in contrib/scripts/sip_to_pjsip, but says it "is not intended to work for every scenario or configuration".35 Also search the dialplan for Dial(SIP/...): those become PJSIP/ dial strings, whose syntax differs (next section).

A working pjsip.conf: one trunk, one phone

The example below follows the structure of the official examples24 with the NAT settings from the NAT guide26 and a template for phones. Section names may repeat across types ([itsp] appears four times), which is how the official examples are written too.24

; /etc/asterisk/pjsip.conf -- one SIP trunk and one desk phone
; Addresses are documentation ranges (RFC 5737); numbers are fictional 555-01xx.

;================ TRANSPORT
[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0
local_net=192.168.10.0/24              ; the office LAN: no NAT rewriting here
external_media_address=203.0.113.10    ; public IP written into SDP for outside peers
external_signaling_address=203.0.113.10

;================ TRUNK: an ITSP that wants a REGISTER and digest auth
[itsp]
type=registration
transport=transport-udp
outbound_auth=itsp-auth
server_uri=sip:sip.example.net
client_uri=sip:[email protected]
contact_user=5145550100                ; becomes the extension calls arrive on
retry_interval=60

[itsp-auth]
type=auth
auth_type=digest                       ; current name; older samples say userpass
username=5145550100
password=use-a-long-random-secret

[itsp]
type=aor
contact=sip:sip.example.net:5060       ; where outbound calls are sent
qualify_frequency=60                   ; check reachability; 0 (the default) never qualifies

[itsp]
type=endpoint
transport=transport-udp
context=from-itsp                      ; inbound calls start in this context
disallow=all
allow=ulaw
outbound_auth=itsp-auth                ; answer the provider's 401 challenges
aors=itsp
direct_media=no                        ; keep Asterisk in the media path

[itsp]
type=identify                          ; requests from these addresses ARE the trunk
endpoint=itsp
match=sip.example.net                  ; resolved to every A/AAAA record; IPs/CIDR also accepted

;================ PHONES: a template, then one section set per phone
[phone-defaults](!)
type=endpoint
transport=transport-udp
context=internal
disallow=all
allow=ulaw
direct_media=no
rtp_symmetric=yes                      ; send RTP back where it came from
force_rport=yes
rewrite_contact=yes                    ; trust the observed source address (NAT)

[6001](phone-defaults)
auth=6001-auth
aors=6001
callerid="Front desk" <6001>

[6001-auth]
type=auth
auth_type=digest
username=6001
password=another-long-random-secret

[6001]
type=aor
max_contacts=1                         ; default is 0: registrations refused
remove_existing=yes                    ; a re-registration replaces the old contact

Notes on the choices, each checked against the reference:

• NAT. local_net is "the IP network that we want to consider our local network"; external_media_address and external_signaling_address are the public address used for RTP and for SIP towards anything outside it.26 rtp_symmetric means "Send RTP back to the same address/port we received it from"; rewrite_contact sends requests to the observed source address rather than the advertised one.26 Their defaults are no, and force_rport defaults to yes.27
• direct_media defaults to yes.27 The bridges documentation notes that media can only flow directly between devices when neither is behind NAT.8 In our experience, leaving the default on with NATed phones is the most common cause of one-way audio. Setting it to no keeps Asterisk in the media path, as the NAT guide's example does.26
• auth_type=digest. The current reference makes digest the default and lists the older userpass and md5 values as "Deprecated. Use digest"; the same text is on the 20 and 22 branches.29 Most examples online, including the official ones, still say userpass.24 It still works because it is converted, but write the current form.
• Templates. [phone-defaults](!) defines a template; [6001](phone-defaults) inherits from it, and a section may list several templates.3637 If you prefer, res_pjsip_config_wizard builds the same objects from a single type=wizard section in pjsip_wizard.conf, generating the endpoint, AOR, auth, registration and identify objects for you.33
• Codecs. Our view: one codec, G.711 μ-law, is the safe starting point for a North American trunk; add others only when both sides need them, because every extra codec is another way for negotiation to end in transcoding.

Once loaded, the troubleshooting guide's commands check each link in the table above: pjsip show endpoints confirms the endpoint loaded, pjsip show endpoint itsp shows its AOR, auth, transport and identify, pjsip show aor 6001 shows whether a phone's contact is bound, and pjsip set logger on prints the SIP traffic itself.32

A minimal extensions.conf

The dialplan that goes with it. Dial(PJSIP/6001) rings the contacts of the AOR named like the endpoint; Dial(PJSIP/number@itsp) sends the number to the contact on the itsp AOR, with the user part taken from the dial string.34 If a phone may register from several devices, ${PJSIP_DIAL_CONTACTS(6001)} rings all of them at once.34

; /etc/asterisk/extensions.conf -- the smallest useful dialplan for the config above

[from-itsp]
; Calls from the provider arrive on the contact_user set in pjsip.conf.
exten => 5145550100,1,NoOp(Inbound from ${CALLERID(num)})
 same => n,Answer()
 same => n,Dial(PJSIP/6001,25)          ; ring the front desk for 25 seconds
 same => n,Hangup()

[internal]
; Phones (context=internal) can reach each other...
exten => _6XXX,1,Dial(PJSIP/${EXTEN},20)
 same => n,Hangup()

; ...can reach 911 with no prefix (47 CFR 9.16(b)(1) applies to US MLTS)...
exten => 911,1,Dial(PJSIP/911@itsp)
 same => n,Hangup()
exten => 9911,1,Goto(911,1)             ; habit-dialled 9 + 911 still works

; ...and can call out: NANP numbers as 10 digits or 1 + 10 digits.
; Send the number in whatever format your provider documents.
exten => _NXXNXXXXXX,1,Dial(PJSIP/1${EXTEN}@itsp)
 same => n,Hangup()
exten => _1NXXNXXXXXX,1,Dial(PJSIP/${EXTEN}@itsp)
 same => n,Hangup()

Reload it with dialplan reload from the CLI.10 Three things in this small file are deliberate:

• Separate contexts for trunk and phones. from-itsp can reach exactly one extension. Nothing a caller from outside sends can reach an outbound route.
• 911 without a prefix. In the United States, anyone "installing, managing, or operating multi-line telephone systems" must configure the system so a user can "directly initiate a call to 911 from any station equipped with dialing facilities, without dialing any additional digit, code, prefix, or post-fix, including any trunk-access code such as the digit 9", and must provide notification to a central location where the system can do so without new hardware or software.66 An Asterisk PBX with desk phones is such a system. The dialplan line is the easy half; the provider's 911 service and the registered location for each phone are the hard half. Our emergency calling guide sets out the US rules; Canadian 9-1-1 obligations are set by the CRTC and differ, and are not covered here.
• No _X. catch-all. A pattern ending in a period will match far more than you meant.12 Outbound patterns should be as narrow as the numbers you actually want people to dial. Routing to international destinations deserves its own, deliberately added, pattern.

A real auto attendant (greeting, digit menu, business hours, voicemail fallback) is built from the same pieces: Background(), WaitExten(), a GotoIfTime() and some extensions. That is the subject of the auto attendant dialplan guide in this section.

CLI, AMI, AGI, ARI: which interface for which job

Asterisk exposes four ways to drive it from outside the configuration files. They overlap, and choosing the wrong one is a common source of fragile systems.

The CLI. asterisk -r attaches a console to a running Asterisk, and asterisk -x "command" runs a single command, prints the output and exits.41 The control socket it uses is asterisk.ctl in the run directory.39 core show help lists everything.2 It is for people and for shell scripts; nothing else should parse its output.

AMI (Asterisk Manager Interface). "the standard management interface into your Asterisk server", a "client/server model over TCP" on port 5038 "if you enable it in manager.conf". Clients send actions, get responses, and receive events about everything that changes.42 The sample file ships with enabled = no and a blunt warning: "you should not enable the AMI on a public IP address".43 Note also that the command permission lets a client run arbitrary CLI commands.42 Use AMI for monitoring, wallboards, click-to-call (originate) and CRM pop-ups.

AGI (Asterisk Gateway Interface). "AGI is analogous to CGI in Apache": the dialplan hands a channel to an external program.44 The AGI() application launches a script as a new process and talks to it on stdin and stdout, or connects to a FastAGI server over TCP using an agi:// URI.45 FastAGI's default port is 4573.46 It is synchronous: actions "do not return until the action is completed".44 The result lands in AGISTATUS as SUCCESS, FAILURE, NOTFOUND or HANGUP.45 Use it to add a database lookup or a decision to a dialplan that otherwise stays in charge.

ARI (Asterisk REST Interface). Three parts: a REST interface "to control resources in Asterisk", a WebSocket "that conveys events in JSON", and "The Stasis dialplan application that hands over control of a channel from Asterisk to the client". "Channels not in a Stasis dialplan application generally cannot be manipulated by ARI."47 The project's own framing is the best guide to when to use it: AMI and AGI were not "designed to let a developer build their own custom communications application"; ARI "is not about telling a channel to execute the VoiceMail dialplan application. It is about letting you build your own VoiceMail application."47 It runs on Asterisk's HTTP server (port 8088 in the getting-started guide; the demo password there is for demos only)48, which is disabled by default and bound to 127.0.0.1 in the sample http.conf.49 Asterisk can also open outbound WebSocket connections to your ARI application, persistent or per call, configured in ari.conf and websocket_client.conf; the documentation page does not say which release introduced this, so check your version's sample files.50

Scroll the table sideways to see every column.

Configuration files and directories

All Asterisk configuration files share one format: sections in square brackets, name = value lines, and comments starting with ;, because # is a DTMF digit.2 The default directories:39

Scroll the table sideways to see every column.

The files you will touch first: asterisk.conf (directories and global options), modules.conf, pjsip.conf, extensions.conf, manager.conf, http.conf and ari.conf, plus one file per feature module (voicemail, queues, music on hold and so on). make samples installs a sample for every module.59

Three constructs keep large configurations manageable. #include filename pulls in another file; #tryinclude does the same without failing if the file is missing; #exec program inserts a program's output, but only with execincludes=yes in asterisk.conf, because it is off by default.38 Templates, shown in the pjsip.conf above, remove repetition.3637

One setting in asterisk.conf deserves to be known by name: live_dangerously. Some dialplan functions escalate privilege, for example "reading the SHELL() function can execute arbitrary commands". Since Asterisk 12 the default is no, which stops external protocols such as AMI from invoking them.40 Leave it that way.

Our view: keep /etc/asterisk in git, deploy it with whatever configuration management you already use, and make every change a commit. Asterisk's files are plain text, diff cleanly and reload per module; a PBX whose configuration exists only on the box is one disk failure from being rebuilt from memory.

Realtime: configuration from a database

Asterisk can read configuration from a database instead of files, in two modes. Static realtime loads a configuration file's contents from a table, read the same way as a file. Realtime proper "is used to dynamically load and update objects" as they are needed.51 Mappings go in extconfig.conf as <family> => <realtime driver>,<res_<driver>.conf class name>[,<table>].51

The drivers in the current tree are res_config_odbc, res_config_pgsql, res_config_curl, res_config_ldap and res_config_sqlite353; the native MySQL driver, res_config_mysql, lives in addons/.54 The realtime page itself names ODBC, MySQL and PostgreSQL, so it lags the source.51

PJSIP does not use extconfig.conf families directly. It uses sorcery, Asterisk's object-storage abstraction (res_sorcery_config, res_sorcery_realtime, res_sorcery_astdb, res_sorcery_memory_cache in the tree53), mapped in sorcery.conf. The documented setup:52

; /etc/asterisk/sorcery.conf -- PJSIP objects from the database
[res_pjsip]
endpoint=realtime,ps_endpoints
auth=realtime,ps_auths
aor=realtime,ps_aors
domain_alias=realtime,ps_domain_aliases
contact=realtime,ps_contacts

[res_pjsip_endpoint_identifier_ip]
identify=realtime,ps_endpoint_id_ips

; /etc/asterisk/extconfig.conf
[settings]
ps_endpoints => odbc,asterisk
ps_auths => odbc,asterisk
ps_aors => odbc,asterisk
ps_contacts => odbc,asterisk

The database schema is not hand-written: the source ships Alembic migrations in contrib/ast-db-manage/, and the documented path uses ODBC (res_odbc and res_config_odbc).52 Realtime has documented gaps, for example "realtime extensions do not support realtime hints".51

Versions: what to run in October 2026

The release policy, from the project's versions page: a new major release "roughly once a year, alternating between standard and LTS releases". An LTS release "will be fully supported for 4 years, with one additional year of maintenance for security fixes"; a standard release gets "at least one year of full support" plus a year of security fixes. Bug-fix releases for fully supported series arrive roughly every four to six weeks, and the October releases of every supported series are cut on the third Thursday of October, after a release-candidate cycle that starts in September.55

The supported series, with the project's own dates and the state of each on the day this page was checked:

Scroll the table sideways to see every column.

Asterisk 18 reached end of life on 20 October 2025.55 Separately, Sangoma maintains Certified Asterisk branches for its top support tier4; the current ones are 22.8 and 20.7, with certified-22.8-cert5 and certified-20.7-cert12 both tagged on 19 October 2026.56

The project's own advice: "It is highly recommended that you install one of the currently supported versions", and "If you want a rock solid communications framework, choose the latest Long Term Support (LTS) release."58

Installing: source, distribution packages, or neither

The documentation lists three routes: FreePBX ("the easiest way to get started if you're new to Linux and/or Asterisk"), your operating system's packages, or compiling from source for "the utmost in control of your installation".57

From source. Releases are at downloads.asterisk.org/pub/telephony/asterisk/, with a -current link per supported series.58 The sequence is the one in the README and the build guide:259

# Build from a release tarball (Asterisk 22 LTS shown)
cd /usr/src
curl -LO https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-22-current.tar.gz
tar xzf asterisk-22-current.tar.gz && cd asterisk-22.*/
./contrib/scripts/install_prereq install   # every dependency for every module
./configure                                # bundled pjproject is the default
make menuselect                            # choose modules; deprecated ones are off by default
make -j"$(nproc)"
make install
make config                                # init scripts
# make samples would install sample configs AND overwrite any existing ones
asterisk -vvvc                             # foreground, verbose, with a console

Points the README and build guide make that are easy to miss: make samples "Overwrites existing config files"; on virtual machines the default native-CPU optimisation can produce a binary that will not run elsewhere, which menuselect/menuselect --disable BUILD_NATIVE menuselect.makeopts turns off; and --prefix is the supported way to sandbox an installation.59 The README adds two operational warnings: Asterisk "is sensitive to large jumps in time", so run exactly one time-sync daemon; and with the common file-descriptor limit of 1024, "Asterisk can handle approximately 150 SIP calls simultaneously", so raise nofile for the asterisk user.2

Distribution packages. Check what you would actually get before choosing this route:

• Debian: the package search shows no asterisk package in bookworm (12) or trixie (13). Bullseye (11) carries 16.28.0, a series whose upstream end of life was 9 October 2023; testing (forky) and unstable carry 22.10.1.6155
• Ubuntu: 24.04 (Noble) ships 20.6.0 and 26.04 (Resolute) ships 22.5.2, both in the universe component.62 Upstream is at 20.21.0 and 22.11.0.56 A distribution may backport security fixes without changing the upstream version number, so read the package changelog rather than judging by the version alone.

Our view: for production, build a supported LTS from source (or use a vendor repository that tracks upstream point releases), and package the result yourself if you run more than one server. Distribution packages are fine for a lab. Either way, pin the version: an unattended upgrade to a new Asterisk major is not something you want to discover from a support call.

Where FreePBX and other distributions fit

FreePBX is a web interface and module system that configures Asterisk for you. Its framework module is GPL-3.065, and it is the route the Asterisk documentation itself recommends to newcomers.57 The current release line, FreePBX 17, is "Officially Supported Only on Debian 12 “Bookworm”" and is installed by an open-source script.63 That script defaults to ASTVERSION=22, refuses to run on anything other than Debian 12, actively pins Debian 13 packages away, and installs Asterisk as asterisk22 packages from Sangoma's own deb.freepbx.org repository rather than from Debian.64 The FreePBX documentation also notes that "Asterisk 21 and later versions do not support chan_sip at all" and that FreePBX 17 uses PHP 8.2, "with security support guaranteed through until December 2026".63

When FreePBX is the right choice: an office PBX with extensions, ring groups, IVRs, voicemail and time conditions, administered by someone who would rather click than edit text, and where the GUI's model of a phone system matches yours. When raw Asterisk is: your call flow is unusual, you want configuration in version control, you are building an application on ARI, or you are deploying many identical servers from automation.

Other Asterisk-based distributions and commercial PBX products exist. We have not reviewed them for this page, so we make no claim about them here.

When not to run Asterisk yourself

Asterisk is excellent, free and mature, and the people who run it well treat it as a server they own for its whole life: patched within the support window, monitored, backed up, firewalled, with a plan for the day the trunk provider changes something. That is the real cost, and it is mostly time rather than money.

If what you need is one phone number that answers with a short menu and forwards each option to a mobile or to voicemail, a hosted service is the smaller commitment. That is what this site's own service does. If you want the control, the guides in the Asterisk section are written for you, and the open-source VoIP section covers the SIP proxies that sit in front of Asterisk when one server is no longer enough.