# Complete Issabel PBX Installation and Configuration Guide for Enterprise VoIP

Install Issabel 5 on VMware, configure extensions, SIP trunks and IVR, and plan security, QoS, backups and diagnostics with verified Asterisk lifecycle guidance.

## 1. Introduction and release decision

A PBX project is successful when reception can answer a caller, transfer them to the right team, and continue working after a server failure. Issabel supplies a web administration layer around Asterisk, which executes the dialplan and bridges calls. Phones register over SIP; IVR, queues, voicemail and trunks turn those registrations into a business telephone service.

Organizations use an IP PBX for shared numbers, branch dialing, reception, support queues, call reports and controlled remote access. Issabel Community offers an open-source core and flexible integration, but capacity planning, patching, carrier interoperability and recovery remain the operator’s responsibility. Advanced commercial contact-center and hosted products have separate terms.

Release review: 14 October 2026. The official SourceForge project lists issabel5-USB-DVD-x86_64-20261001.iso; the Issabel forum release announcement identifies Asterisk 20 and updated Rocky Linux/Issabel packages. Issabel 5 originally used Rocky Linux 8.8 with Asterisk 16 or 18. Those Asterisk branches are EOL (2023-10-09 and 2025-10-20). Use the current ISO as the documented baseline, then verify its actual OS and RPM inventory. This is documentation verification, not an executed installation.

Asterisk 20 enters security-only maintenance on 2026-10-19 and reaches EOL on 2027-10-19. Asterisk 22 LTS remains supported through 2029-10-16, but no supported Issabel 5 + Asterisk 22 package combination was verified here. Do not replace the engine with a source build and assume the GUI, modules and backups stay compatible. Obtain a vendor-supported migration plan before the Asterisk 20 deadline; an old ISO is unsuitable for a new secure long-term deployment.

Security acceptance covers the whole stack: OS, PHP/web framework, database, Asterisk and modules. A current ISO announcement is not a support contract for every component. Record php -v and RPM provenance, verify any downstream security maintenance with the supplier, and do not approve internet exposure merely because Asterisk is supported. Repository indexes and the network-installer body could not be independently inspected in this research session; exact current RPM revisions and installer behavior remain on-site verification tasks.

[Official ISO and network installer listing](https://sourceforge.net/projects/issabelpbx/files/Issabel%205/)

[October 2026 Issabel release announcement](https://forum.issabel.org/d/19773/6)

[Asterisk lifecycle dates](https://docs.asterisk.org/About-the-Project/Asterisk-Versions/)

## 2. Issabel architecture

Example: PBX 192.168.50.10/24, voice VLAN 50, phones in 192.168.50.0/24, gateway 192.168.50.1 and a separate administrative VLAN (example 192.168.60.0/24). The core switch carries VLANs; routed ACLs allow only required flows. A single PBX NIC in the voice network can receive restricted routed administration; a second NIC is not inherently necessary. Avoid two default gateways.

SIP negotiates a session: caller → Asterisk → callee or carrier. Asterisk is a back-to-back user agent, so each call leg has its own transaction state. SDP describes media addresses and codecs. RTP carries audio on separate UDP ports; it does not run inside SIP. This guide anchors media at the PBX (direct media disabled), simplifying recording and NAT. An SBC/provider gateway converts the external SIP service into PSTN connectivity.

![Provider, firewall, PBX and VLAN 50 with restricted administration](/assets/img/articles/content/issabel-pbx-installation-configuration/issabel-enterprise-architecture.png)

## 3. System requirements and sizing

The following are engineering starting estimates, not vendor-certified extension limits or benchmark results. They assume modern x86-64 CPUs, mostly G.711 pass-through calls and modest reporting. Validate at busy-hour load with the actual codecs, TLS/SRTP, recordings, conferences and queue workload. A thousand registered extensions can be lighter than fifty transcoded concurrent calls.

| Deployment | CPU | RAM | Storage | Extensions (estimate) | Calls (estimate) |
| --- | --- | --- | --- | --- | --- |
| Small office | 2 vCPU | 4 GB | 80 GB SSD + recording budget | 10–30 | 5–10 |
| Medium business | 4 vCPU | 8 GB | 160 GB SSD + recording volume | 30–150 | 10–40 |
| Enterprise pilot | 8 vCPU, load test required | 16 GB | 250 GB SSD + dedicated media storage | 150–500 | 40–100 |

Use good per-core performance; oversizing vCPU can increase scheduling delay. Keep RAM sufficient to avoid swapping. Recording requires sustained writes and predictable disk latency; use redundant storage and UPS, not just a large disk. Reserve space for OS updates, logs, databases and restore staging. Gigabit Ethernet is a useful baseline, with PoE and redundant uplinks where justified; WAN bandwidth matters more than NIC headline speed.

Allocate a static address outside the DHCP pool, working internal DNS, trusted NTP and a PBX FQDN such as pbx.example.test (documentation name; use your real internal domain). Verify CPU virtualization and the ESXi guest compatibility matrix. Hyper-V/KVM can host Linux, but this article does not claim an Issabel certification for every hypervisor. Physical telephony cards need supported drivers and passthrough planning.

## 4. Downloading Issabel safely

Follow the official project link, open Issabel 5 and select the 20261001 x86-64 ISO, not the ALPHA image or the 20240430 artifact. Record filename, download URL, date and published checksum from the file information panel if available. Download over HTTPS. A locally computed hash alone only identifies your copy; it does not prove authenticity. Compare it with a trusted publisher digest. If only SHA-1/MD5 is supplied, use it for transfer integrity and document that it is not a modern authenticity guarantee.

```text
sha256sum issabel5-USB-DVD-x86_64-20261001.iso
# Windows PowerShell alternative:
Get-FileHash -Algorithm SHA256 .\issabel5-USB-DVD-x86_64-20261001.iso
```

Expected output is a 64-character SHA-256 value and the filename; no digest is invented here. A mismatch means stop, delete the untrusted copy and download again. The ISO is the preferred reproducible path: write it to USB for bare metal (erases the selected USB) or upload it to an ESXi datastore for a VM. Confirm boot mode and target disk before installation, which overwrites its selected partitions.

The official directory also lists an October 2026 network installer. Download that script as a file, review its Rocky Linux prerequisites, repository URLs, GPG settings and package selection, then stage it on a disposable clean VM. A script can change after this review. No curl-to-shell command or unverified Asterisk upgrade recipe is supplied. Confirm a trusted transport for all dependencies; if the script relies on unauthenticated HTTP, prefer the ISO or obtain a verified vendor procedure.

## 5. Installing Issabel on VMware ESXi

1. Create a new VM on a maintained ESXi host and select the Linux guest type matching the ISO’s Rocky Linux 8 family. Use Rocky Linux 8 if offered, otherwise the corresponding RHEL 8 64-bit compatibility profile supported by that ESXi version. 2. Start with 2 vCPU and 4 GB RAM for the lab. 3. Attach an 80 GB virtual disk on low-latency storage; choose a supported SCSI controller. Thin provisioning is acceptable only with datastore capacity alerts and headroom.

4. Use VMXNET3 if the installer kernel detects it; otherwise test a supported emulated adapter and migrate deliberately. Attach the NIC to the voice VLAN 50 port group, with link connected at power-on. For a VLAN-tagged port group, do not also tag VLAN 50 inside the guest. Restrict upstream access before boot. 5. Attach the verified ISO to virtual CD/DVD and enable connect at power-on. 6. Boot the installer using a firmware mode supported by the image; do not change firmware after partitioning.

7. Choose installation language, keyboard and timezone. Select only the intended virtual disk. Automatic partitioning is adequate for an isolated lab; for production plan a root volume plus separate capacity for /var/spool/asterisk, logs and backup staging. Keep boot partitions appropriate to BIOS/UEFI and allow root sufficient update space. 8. Enable the NIC, set hostname and manual IPv4 addressing (192.168.50.10/24, gateway .1, internal DNS). 9. Set a unique root password and complete OS installation. Follow the image’s first-boot prompts for database and web administrator credentials; store each separately.

10. Reboot, detach the ISO and confirm boot from disk. 11. Log in through the VM console, inspect the release and services, then use the restricted management path. Installer labels and first-boot order may vary across images; no screenshots or completion results are claimed here. Acceptance requires a clean boot and successful internal and carrier calls, not merely reaching the dashboard.

```text
cat /etc/os-release
asterisk -rx "core show version"
rpm -qa | sort | grep -Ei "^(issabel|asterisk|rocky|php)"
sudo dnf info open-vm-tools
# If the official OS repositories provide it:
sudo dnf install open-vm-tools
sudo systemctl enable --now vmtoolsd
vmware-toolbox-cmd -v
```

These commands inventory the system and install distro-provided tools if available. Expect Rocky Linux 8-family identity, Asterisk 20.x and an RPM version list; a different engine requires revisiting the lifecycle decision. Missing package/service means check enabled official repositories, not a random RPM site. In production watch CPU Ready and guest swap during busy hours, avoid CPU/memory overcommit, and investigate sustained datastore latency or ballooning. Use chrony as the steady time authority; configure VMware periodic and event-based clock behavior deliberately so it does not compete. Snapshots can briefly support rollback but grow, affect I/O and are not backups. Provide redundant uplinks and switch power.

![ISO verification through VM installation and PBX acceptance](/assets/img/articles/content/issabel-pbx-installation-configuration/issabel-installation-workflow.png)

## 6. Initial server configuration

Use the VM console for network changes because bringing a connection up can disconnect SSH. Read the active connection name; ens192 and PBX-LAN below are examples. Replace DNS and domain with real internal values. Do not copy a public resolver when the PBX needs internal DNS or split-horizon records.

```text
sudo hostnamectl set-hostname pbx.example.test
nmcli -f NAME,DEVICE,TYPE connection show --active
# Replace PBX-LAN with the discovered connection name:
sudo nmcli connection modify "PBX-LAN" ipv4.method manual ipv4.addresses 192.168.50.10/24 ipv4.gateway 192.168.50.1 ipv4.dns "192.168.60.53"
sudo nmcli connection up "PBX-LAN"
sudo timedatectl set-timezone Asia/Tehran
sudo systemctl enable --now chronyd
chronyc tracking
chronyc sources -v
ip -br address
ip route
getent hosts pbx.example.test
ping -c 4 192.168.50.1
```

Expected: the active NIC has 192.168.50.10/24, one default route via 192.168.50.1, DNS returns the intended PBX address and chrony reports Normal leap status with a selected source marked *. These are illustrative expectations, not captured output. If DNS fails, inspect resolver and routed DNS access; if chrony is unsynchronized, check UDP 123 and /etc/chrony.conf. An ICMP-blocking gateway can still route traffic: confirm application connectivity before declaring a failure.

```text
sudo dnf repolist
sudo dnf check-update
# After a verified backup and maintenance approval:
sudo dnf upgrade
systemctl --failed
systemctl status asterisk httpd mariadb chronyd --no-pager
ss -lntup
asterisk -rx "core show uptime"
asterisk -rx "module show like pjsip"
```

dnf check-update exit 100 means updates are available, not a package-manager failure. Keep GPG checking enabled and official repositories recorded. Upgrade in a maintenance window, reboot if the kernel or relevant libraries require it, and repeat calls. Expect active services, an advancing Asterisk uptime and PJSIP modules. Unit names can vary: inspect systemctl list-unit-files if one is missing. Never assume an OS update changes an EOL Asterisk branch into a supported one.

## 7. Accessing the web interface

From the administrative VLAN or VPN, open https://pbx.example.test using the real PBX name. Install an organizationally trusted certificate whose SAN matches that name; verify certificate chain, expiry and browser trust. A self-signed bootstrap certificate needs a separately verified fingerprint. Do not train administrators to dismiss arbitrary warnings. Do not publish the console using unrestricted port forwarding.

Log in with the web administrator created during setup, change any bootstrap credentials and record a recovery owner. Dashboard summarizes system and service health; PBX → PBX Configuration manages extensions, trunks, routes, IVR and queues; System settings manage network/time, users and available backup tools; Reports expose CDR and recording access. Exact menu labels vary with installed modules. Save each object and use Apply Configuration/Apply Changes when shown; validate the resulting running state.

## 8. Creating extensions 101 and 102

SIP is the protocol; chan_sip and chan_pjsip are different Asterisk channel drivers implementing it. Prefer the PJSIP option where the installed Issabel GUI exposes it and the driver is loaded. They may listen on different ports. Discover the PJSIP transport instead of assuming 5060, and do not aim a phone at the other driver. Do not compile a new engine to make a missing GUI option appear.

In PBX Configuration → Extensions, add a PJSIP extension: User Extension 101, Display Name Reception, separate strong random secret, one device/contact for this lab, ulaw/alaw codecs and Direct Media disabled. Save and apply. Repeat as 102, IT Department, with a different secret. Never use the extension number as its password. Enable voicemail only if needed, assign a separate PIN, email destination and a sensible message limit.

For phones on VLAN 50 without NAT, keep the local network definition correct rather than enabling every NAT switch. For a tested VPN/NAT client, PJSIP rtp_symmetric, force_rport and rewrite_contact may be needed. They respectively return media to its observed source, send responses to the source port and rewrite contact reachability. They do not replace correct external media/signaling addresses or firewall rules.

### Softphone and internal-call acceptance

Install a current SIP-capable Linphone client from its official publisher. Add a SIP account manually: username/authentication ID 101, domain/proxy 192.168.50.10, the discovered transport port, matching UDP/TCP/TLS transport and the generated secret. Set display name Reception; leave outbound proxy empty unless your architecture requires one. Select G.711 A-law/µ-law for this lab, grant microphone access and choose the right audio devices. On a second device configure 102. TLS requires a trusted name/certificate; an IP-only URI may not match its certificate.

```text
asterisk -rx "pjsip show transports"
asterisk -rx "pjsip show endpoints"
asterisk -rx "pjsip show contacts"
asterisk -rx "pjsip show endpoint 101"
```

Expect a reachable/Available contact after registration (with qualification enabled); a registered contact and OPTIONS reachability are distinct observations. Dial 102 from 101, answer and talk for at least a minute in both directions. Reverse the call, test hold/transfer and leave/retrieve voicemail using the configured feature code. An initial 401 challenge followed by authenticated REGISTER and 200 OK is normal. Repeated 401/403 is not. Record caller display, codec and hangup behavior.

[Official Linphone client downloads](https://www.linphone.org/en/download/)

![Independent SIP transactions and PBX-anchored RTP between extensions 101 and 102](/assets/img/articles/content/issabel-pbx-installation-configuration/issabel-sip-call-flow.png)

## 9. Configuring a SIP trunk

Ask the provider for registrar, proxy/SBC, auth ID, password delivery method, DID format, outbound number format, allowed caller IDs, codecs, DTMF, transport and separate signaling/media IP ranges. Determine registration-based versus IP-authenticated service. An IP-authenticated trunk often has no REGISTER at all; “not registered” is then not a fault. Match the carrier contract and interoperability guide, not another provider’s screenshots.

In Trunks add the installed GUI’s PJSIP trunk, name it CARRIER-LAB, enter provider-supplied values and set inbound context to the GUI’s external-trunk context (commonly from-pstn), never the extension context from-internal. Configure outbound authentication if required; registration credentials and INVITE authentication are separate objects. Restrict identification to provider signaling sources. Choose RFC4733 DTMF (often labeled RFC2833) if the provider agrees, and confirm digits reach its IVR.

The following is a standalone Asterisk PJSIP reference, not an Issabel file to paste over GUI-generated configuration. It shows object relationships. All names, secrets and 203.0.113.0/24 addresses are documentation examples. Map fields through the GUI; use a custom include only after verifying the installed include hierarchy and preserving backups.

```text
; REFERENCE ONLY — NOT A DROP-IN ISSABEL CONFIGURATION
[carrier-auth]
type=auth
auth_type=userpass
username=EXAMPLE_AUTH_ID
password=REPLACE_WITH_PROVIDER_SECRET

[carrier-aor]
type=aor
contact=sip:203.0.113.20:5060
qualify_frequency=60

[carrier-endpoint]
type=endpoint
context=from-pstn
disallow=all
allow=alaw,ulaw
aors=carrier-aor
outbound_auth=carrier-auth
direct_media=no
dtmf_mode=rfc4733

[carrier-identify]
type=identify
endpoint=carrier-endpoint
match=203.0.113.20/32

; Only for a provider requiring registration:
[carrier-registration]
type=registration
outbound_auth=carrier-auth
server_uri=sip:203.0.113.20:5060
client_uri=sip:EXAMPLE_AUTH_ID@203.0.113.20
contact_user=EXAMPLE_DID
retry_interval=60
```

The AoR is the outbound destination, identify maps incoming source IP to the endpoint, and registration publishes a contact. For IP authentication omit registration/auth only when instructed by the provider. Add all verified carrier signaling SBCs, not just the example address. For NAT configure local_net and external_signaling_address/external_media_address on the active transport through supported settings; transport changes may need a controlled restart. Static NAT and return routes must agree with SDP. Media ACLs must include actual carrier RTP sources.

```text
asterisk -rx "pjsip show registrations"
asterisk -rx "pjsip show endpoint carrier-endpoint"
# Use the actual GUI-generated endpoint name, not this reference name.
```

Expected: Registered for a registration-based service, reachable carrier contact where OPTIONS is supported, then successful inbound and outbound calls. Neither a green trunk icon nor REGISTER proves RTP or DID routing works. Test both directions, hold, DTMF and caller ID with the provider.

[PJSIP registration objects](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Configuring-Outbound-Registrations/)

[PJSIP transport and endpoint NAT settings](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Configuring-res_pjsip-to-work-through-NAT/)

![Phones to carrier and PSTN with distinct signaling and media paths](/assets/img/articles/content/issabel-pbx-installation-configuration/issabel-sip-trunk-topology.png)

## 10. Inbound and outbound routes

Create an inbound route with a fictitious DID 982155550100, exactly as the provider sends it in the called-number field, and destination Extension 101. Call that DID from an external phone. A + prefix or a different Request-URI can prevent matching: inspect the incoming INVITE and resulting dialplan. Use a catch-all inbound route only as a deliberate fallback to reception; it must never give unauthenticated callers access to outbound dialing.

| Route | Example pattern / match | Result |
| --- | --- | --- |
| Inbound DID | 982155550100 (fictitious) | Extension 101; later business-hours IVR |
| National lab route | Prefix 9, match 0XXXXXXXXXX | Dial 9 + 11 digits starting 0; strip 9 |
| Emergency | Exact locally verified emergency numbers | No access prefix; approved carrier and location |
| International | No generic X. route | Default blocked; explicit authorized exceptions |

In Outbound Routes use dial-pattern columns correctly: prepend adds digits, prefix is removed, match pattern validates the remaining number, and CallerID restricts the originating extension where supported. X means one digit 0–9; N means 2–9; dot matches one or more characters and can over-permit. The sample is not a universal Iranian/carrier numbering plan: confirm normalization with your provider. Put narrow emergency and authorized routes before broad routes; specify trunk order and failover explicitly.

Set outbound caller ID to a number the provider authorizes; spoofed values may be rejected or replaced. Restrict expensive destinations by extension/context or supported class-of-service controls, enforce provider spending/channel limits and alert on unusual destinations and after-hours traffic. Do not assume hiding a route from the UI prevents access. Verify a blocked number fails, a permitted call succeeds and an emergency test reaches the correct service/location using the carrier’s coordinated test procedure; do not place casual live emergency test calls.

## 11. Company IVR configuration

Record: “Welcome to MEET AJ. Press 1 for Sales, 2 for Technical Support, or 0 for Reception.” Prepare a clear mono prompt at the sampling rate accepted by the installed System Recordings module; 8 kHz, 16-bit PCM WAV is a conventional narrowband source. Avoid stereo music and clipping; listen through a real phone. Upload through System Recordings, name it MEETAJ-Welcome, and preview before selecting it as the IVR announcement.

In IVR create Company-Main: announcement MEETAJ-Welcome, entry 1 → sales ring group 201, 2 → support queue 600, 0 → Extension 101. Disable direct extension dialing unless required. Start with a five-second digit timeout and at most two retries for timeout/invalid digits; then go to reception or a staffed voicemail destination. Prevent endless loops. Define Time Groups for business hours and holidays, then a Time Condition: open → IVR, closed → after-hours announcement and voicemail/on-call. Point the inbound route to this condition.

Test each digit, invalid input, no input, closed hours and holidays from an external caller. Confirm DTMF is recognized with the negotiated method. Do not fix missing digits by enabling multiple incompatible DTMF methods at random; inspect carrier signaling/media and codec agreement.

![Business-hours IVR branches to sales, support, reception and fallback](/assets/img/articles/content/issabel-pbx-installation-configuration/issabel-ivr-call-flow.png)

## 12. Ring groups and call queues

| Object | Purpose | Example |
| --- | --- | --- |
| Direct extension | Call one destination | 101 reception |
| Ring group | Ring a fixed list without queue waiting logic | 201: sales phones |
| Queue | Hold callers, distribute to agents, record waiting metrics | 600: technical support |
| IVR | Collect caller choice and route | 1 sales / 2 support / 0 reception |

Create ring group 201 with actual sales extensions (e.g. 103 and 104, after provisioning them), ringall, 20-second ring time and a staffed failover to 101. Do not assign the same device to conflicting destinations without testing. For queue 600, add 102 as the initial static agent; add trained agents later. Choose rrmemory for rotating distribution or ringall for a small response team. Define 15-second agent timeout, 3-second retry, 10-second wrap-up and a 120-second maximum caller wait as starting policies.

Decide join-empty/leave-empty behavior, agent login/pause and busy-agent handling according to staffing. Set a failover for no agents or exhausted waiting time, such as reception or the support mailbox. Announce realistic expectations and limit queue depth if offered. Check queue show 600, agent status and a second waiting call. Statistics and advanced workforce features depend on installed modules/licensing.

```text
asterisk -rx "queue show 600"
```

## 13. Call recording and voicemail

Configure recording policy in the installed extension/route recording controls: on-demand, always or never according to an approved business policy. Forced recording at one level can override another; test internal, inbound and outbound calls rather than trusting a single selector. Verify the recording format and actual path; conventional Asterisk locations are /var/spool/asterisk/monitor and /var/spool/asterisk/voicemail. CDR entries are metadata, not the audio files.

Capacity example derived from the format: mono PCM WAV at 8,000 samples/s × 16 bits = 128 kbit/s = 0.96 MB/minute (decimal). At 100 recorded call-hours/day this is 5.76 GB/day and 172.8 GB for 30 days. Add 30% operational headroom: about 225 GB, plus voicemail, logs, backup copies and restore space. Stereo or separate legs can double this; compressed formats differ. Measure actual daily growth before purchasing storage.

Restrict playback/export to authorized roles, encrypt backup storage and audit access. Determine notice/consent and lawful retention with the organization’s policy owner and applicable jurisdiction; this is not a legal ruling. Separate expiry from legal hold. Never apply a recursive delete command to the spool directory as a “cleanup.” Voicemail needs a unique PIN, tested greeting and message limits; if email delivery is enabled, verify SMTP and exposure of attached recordings.

```text
df -h /var/spool/asterisk
df -i /var/spool/asterisk
sudo du -sh /var/spool/asterisk/monitor /var/spool/asterisk/voicemail
asterisk -rx "voicemail show users"
```

Expect free blocks and inodes, measured directory sizes and the intended mailboxes. Missing directories may mean another configured spool path; inspect asterisk.conf and the GUI. Permissions must allow the Asterisk service to write while preventing unrelated users from reading. Verify a real recording is playable and a test voicemail can be retrieved, then perform the same checks after restore.

## 14. Firewall and network security

First inventory listening sockets, active transports, RTP settings and the host firewall manager. Issabel may manage netfilter rules itself; do not install or enable firewalld on top of an existing rule manager without a migration design. Read-only commands below do not change policy. Verify included RTP configuration as well as the main file; GUI-generated paths vary.

```text
sudo ss -lntup
asterisk -rx "pjsip show transports"
asterisk -rx "rtp show settings"
sudo grep -R -E "^[[:space:]]*(rtpstart|rtpend|#include)" /etc/asterisk/rtp*.conf
sudo systemctl is-active firewalld
sudo nft list ruleset
# If legacy iptables is the active manager:
sudo iptables-save
```

| Port | Protocol | Purpose | Source | Security recommendation |
| --- | --- | --- | --- | --- |
| 22 (verify sshd) | TCP | SSH | Admin VLAN / VPN | Keys; source ACL; no public access |
| 443 (verify httpd) | TCP | Web management | Admin VLAN / VPN | Trusted HTTPS; restricted roles |
| 5060 (example only) | UDP/TCP per transport | SIP | Voice VLAN + carrier SIP IPs | Use discovered port; allowlist |
| 5061 (if configured) | TCP | SIP TLS | Approved peers | Certificate verification; no plaintext fallback |
| 10000–20000 (example) | UDP | RTP / SRTP | Voice/VPN + carrier media IPs | Replace with active rtpstart/rtpend |
| 123 outbound | UDP | NTP | PBX to approved NTP | Do not publish an NTP server |
| 53 outbound | UDP/TCP | DNS | PBX to internal resolvers | Restrict resolvers |
| 161 only if enabled | UDP | SNMP polling | Monitoring server only | SNMPv3; disable if unused |
| 5038 / 3306 | TCP | AMI / database if listening | Localhost / explicitly trusted app | Never expose publicly |

Implement default deny at the enterprise boundary, then explicit source/destination/transport rules from this inventory. Phone-to-PBX and PBX-to-provider media flows need return traffic and the actual media networks, which may differ from registration servers. Do not open an example RTP range blindly. Avoid public phone registration; prefer VPN or a maintained SBC. Validate blocked public sources, allowed private calls and both audio directions after every change.

For SSH, establish a working named sudo account and key login before disabling root/password login. Validate sshd -t, retain the console, and apply in a maintenance window. HTTPS and SIP TLS need certificate expiry alerts; SRTP must be negotiated on each supported call leg and does not automatically encrypt the provider’s PSTN segment. Reject incompatible clients rather than silently falling back. Use long unique extension secrets, least-privilege web accounts and protected AMI/API credentials; remove unused services only after checking dependencies.

```text
sudo sshd -t
sudo systemctl status fail2ban --no-pager
sudo fail2ban-client status
# Then inspect an actual jail name returned above:
sudo fail2ban-client status ACTUAL_JAIL_NAME
```

An installed Fail2ban service is useful only if the appropriate jails parse actual failed logins and enforce bans in the active firewall. Verify with a controlled non-admin test source while preserving access; do not assume a jail called asterisk exists. Keep log rotation and unban procedures. Fail2ban is secondary to ACLs and updates; it does not patch vulnerabilities. Toll-fraud controls also require outbound destination restrictions, spend limits, concurrency ceilings and rapid carrier suspension procedures.

### MikroTik SIP helper and NAT

```text
/ip firewall service-port print
# RouterOS: only if the SIP helper is enabled and conflicts with validated NAT/SDP behavior:
/ip firewall service-port set sip disabled=yes
```

Run these in RouterOS, not the Linux shell. A SIP helper can rewrite signaling and expectation tracking; encrypted SIP cannot be treated the same way. Disable it when packet comparison shows harmful rewriting or the provider/SBC design requires it, then retest new sessions and NAT state. This is not a cure for every one-way-audio problem. Preserve firewall source limits and a stable external address; CGNAT may require provider support, VPN/SBC or a different access service.

[RouterOS services and service ports](https://help.mikrotik.com/docs/spaces/ROS/pages/103841820/Services)

![VPN administration, carrier allowlists, voice segmentation and PBX defenses](/assets/img/articles/content/issabel-pbx-installation-configuration/issabel-voip-security.png)

## 15. Network design and QoS

Keep phones on VLAN 50 with controlled inter-VLAN routing, DHCP reservations/options as needed and documented PoE/uplink capacity. The architecture illustration in section 2 is the network topology: phones → core switch → PBX, and PBX → firewall → carrier; administrators arrive from the restricted VLAN. Segmentation limits reachability; it is not encryption. Avoid an unprotected PBX bridging two security zones.

Use a defined trust boundary: classify verified RTP as EF (DSCP 46), and signaling according to your enterprise policy (often CS3). Do not trust arbitrary markings from every desktop. Apply prioritization at the actual WAN bottleneck, shape below usable link capacity and cap the priority class so other services survive. A DSCP mark alone creates no queue and may be erased by an ISP. Measure under competing traffic, including upload saturation and VPN overhead.

Planning target, not a guarantee: one-way latency below about 150 ms, jitter below 20–30 ms and loss well below 1%; bursts matter even when averages look good. A jitter buffer trades delay for smoother playback. For G.711 at 20 ms packetization, 160 bytes payload + 40 bytes IPv4/UDP/RTP at 50 packets/s gives 80 kbit/s per direction before layer-2/VPN overhead. Budget roughly 100–120 kbit/s per call per direction, then headroom: 40 calls × 120 kbit/s = 4.8 Mbit/s each way; 25% headroom gives 6 Mbit/s each way. Recalculate for IPv6, SRTP, tunnels and actual packetization.

[Asterisk QoS markings](https://docs.asterisk.org/Configuration/Channel-Drivers/IP-Quality-of-Service/)

[MEET AJ firewall hardening guide](/articles/mikrotik-firewall-hardening-input-forward-chain)

## 16. Backup and disaster recovery

Inventory the native Backup/Restore module actually installed. Select extensions, trunks, routes, IVR/time conditions, users and the offered databases/configuration. Read the archive manifest and verify whether custom audio, voicemail and recordings are included: large media is often optional/excluded. Schedule a configuration backup after changes and nightly, then copy it encrypted to a separate repository. A green job status is not evidence of a complete restore.

OS-level backup is complementary: preserve /etc/asterisk, the installed Issabel configuration, custom sounds, /var/spool/asterisk, TLS material, relevant database dumps, package inventory and host/network settings with ownership/permissions. Inventory actual database names rather than assuming only asterisk exists. Do not tar a live database data directory and call it consistent. Use supported logical dumps or application-aware quiescing; non-transactional tables need coordinated locking/downtime. Secrets in archives require strict access and encryption.

```text
rpm -qa | sort > installed-packages.txt
# Read-only inventory, using your secured administrative DB login:
mysql -u root -p -e "SHOW DATABASES;"
# Example dump ONLY after verifying tables are transactional and selecting actual DB names:
mysqldump -u root -p --single-transaction --routines --events --triggers --databases ACTUAL_DB_NAME > pbx-db.sql
# For non-transactional tables, use a planned consistent locked/application-aware backup instead.
```

The password prompt avoids a password in shell arguments; use a protected credentials file/service account for scheduling. The dump must finish without errors, contain expected tables and restore into an isolated matching database. A logical dump does not include media files, OS users or every database account. Prefer the native tool for its supported restoration contract, and document the additional OS-level process rather than claiming a universal one-command restore.

Example policy: configuration RPO 24 hours (and after every change), media RPO 4 hours, service RTO 4 hours. These are objectives until measured. Retain 7 daily, 4 weekly and 12 monthly copies only if privacy/storage policy allows; use independent offsite credentials and an immutable/offline copy. Monitor job failures, archive size and repository capacity. VMware snapshots are temporary state pointers sharing failure risks with the datastore; they are not external or application-consistent backup by themselves.

### Restore runbook

1. Isolate a replacement VM so it cannot register the same trunk as production. 2. Install a matching supported Issabel/OS/Asterisk package set and restore native archives by the supported module. 3. Restore separately backed-up media, certificates and custom configuration with original permissions; restore databases only by the documented matching procedure. 4. Verify users, extensions, trunks, IVR, time conditions, recordings and voicemail. 5. Check security policy and internal calls before carrier cutover. 6. Coordinate public IP/DNS and trunk registration with the provider, test both external directions and emergency routing as arranged, measure recovery time and document rollback. Test quarterly and after major upgrades.

![Consistent configuration, database and media backups with offsite restore testing](/assets/img/articles/content/issabel-pbx-installation-configuration/issabel-backup-recovery.png)

[MEET AJ: backup-chain and restore dependencies](/articles/veeam-forward-vs-reverse-incremental)

## 17. Monitoring Issabel

```text
# Linux shell:
sudo asterisk -rvvv
# Now INSIDE the Asterisk CLI (do not prefix with asterisk -rx):
core show version
core show channels
core show channels count
pjsip show endpoints
pjsip show contacts
pjsip show registrations
queue show 600
exit
# Back in Linux shell:
systemctl is-active asterisk httpd mariadb chronyd
systemctl --failed
df -h
df -i
free -h
uptime
journalctl -u asterisk -n 80 --no-pager
```

The console attaches to a running Asterisk instance; failure to connect can mean a stopped service, socket permissions or a different runtime path. core show channels displays active channels, not one channel per end-to-end call: a call commonly has two legs and Local channels can add more. PJSIP commands require the driver; only for an actual chan_sip deployment use sip show peers/sip show registry. Expected results are intended endpoints/contacts, trunk registrations where required, and no unexpected failed units; idle channels can legitimately be zero.

Use a maintained Zabbix agent and least-privilege checks for CPU, memory, disk/inodes, I/O latency, service state and certificate expiry. Monitor registration/reachability, call failures, queue waiting and unusual outbound volume; include a controlled synthetic call to validate more than port availability. AMI monitoring needs restricted read permissions and network ACLs. SNMP is optional: use SNMPv3 and limit polling to the monitoring server, or keep it disabled. Alert thresholds should be derived from the baseline and recovery lead time, especially recording-space exhaustion.

[MEET AJ Zabbix monitoring and backup guide](/articles/zabbix-server-linux-windows-agents-backup)

## 18. Troubleshooting matrix

Capture one failing call with time, direction, endpoint and Call-ID. Start with read-only state, then briefly enable targeted logging in a restricted maintenance session. SIP logs may contain numbers, addresses and authentication metadata; packet capture and RTP debugging can expose audio and add load. Store them securely and disable debugging after the test. Do not restart the PBX as the first diagnostic step.

| Issue / symptom | Likely cause | Diagnostic and expected evidence | Resolution | Verification |
| --- | --- | --- | --- | --- |
| Extension not registering | Wrong secret, driver port, ACL or DNS | pjsip show contacts; brief pjsip logger: challenge then 200 OK | Match auth ID/transport; allow only client source | Reachable contact; 101↔102 call |
| One-way audio | Incorrect SDP address or return NAT | rtp set debug on briefly: packets in both directions | Fix external/local network definitions and media ACL | Talk both ways and after hold |
| No audio | Codec mismatch, muted device, RTP blocked | core show channel ACTUAL_CHANNEL; SDP common codec and RTP flow | Negotiate shared codec; fix device and verified media path | Internal then external 60-second call |
| Trunk unavailable | Auth, provider ACL, DNS, carrier outage | pjsip show registrations; Registered only if registration service | Verify account/source IP; contact carrier with Call-ID | Inbound/outbound calls, not icon alone |
| Incoming calls fail | DID format, identify match, wrong destination | pjsip logger + dialplan show from-pstn; correct endpoint/context | Use observed DID and allowed provider sources | External caller reaches intended destination |
| Outgoing calls fail | Pattern, route priority, credit, INVITE auth | Dialplan trace and SIP response; intended trunk selected | Fix prefix/normalization and carrier authorization | Permitted call works; forbidden one blocked |
| Incorrect caller ID | Unapproved number or header policy | SIP INVITE From/PAI compared with carrier policy | Set authorized CID and supported header settings | External recipient sees approved number |
| NAT instability | CGNAT, Contact/SDP rewrite, timeout | pjsip show endpoint; compare SDP/contact at boundary | Correct NAT settings; validate ALG/VPN/SBC design | Re-register and test idle/re-INVITE calls |
| Firewall blocking RTP | Wrong range or carrier media source | rtp show settings + firewall counters/capture; bidirectional UDP | Allow actual range from actual trusted media networks | Audio flows; unrelated sources still blocked |
| Asterisk service failure | Bad config, disk/inodes, ownership or module failure | systemctl status and journalctl -u asterisk; find first error | Restore known-good change, free space safely, fix ownership | Stable uptime, modules loaded, repeat test calls |

```text
# Inside Asterisk CLI, for one short controlled test:
pjsip set logger on
rtp set debug on
# Place one failing call and save only the required evidence.
rtp set debug off
pjsip set logger off
# Linux shell: bounded SIP capture, using actual interface and SIP port:
sudo tcpdump -ni ACTUAL_INTERFACE -c 100 'host ACTUAL_PEER_IP and port ACTUAL_SIP_PORT'
sudo journalctl -u asterisk -n 100 --no-pager
# Read /var/log/asterisk/full only if this log is configured.
sudo tail -n 100 /var/log/asterisk/full
```

A 401/407 authentication challenge can be normal; repeated challenges indicate a failed negotiation. A 403 can be authorization policy, 404 can be number/context mismatch, 488 often indicates unacceptable SDP, and 503 can be capacity or upstream failure. Interpret with the full transaction and provider explanation; response codes alone are not a complete diagnosis. If a CLI command is unavailable, use core show help and verify the loaded module/version.

[Asterisk PJSIP diagnostics](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Asterisk-PJSIP-Troubleshooting-Guide/)

## 19. Platform and deployment comparisons

Compare specific editions and support contracts. Issabel Community is distinct from commercial Issabel Contact Center/Multitenant offerings. FreePBX 17 has a Debian 12/Asterisk 22 path documented by Sangoma; commercial modules are separate. 3CX is proprietary and its commercial pricing is annual by simultaneous calls, with feature tiers and constrained entry offers. No license price or blanket “free enterprise” claim is made here.

| Criterion | Issabel Community | FreePBX | 3CX |
| --- | --- | --- | --- |
| Licensing | Open-source core; paid products separate | Open-source core + commercial modules | Proprietary; edition/subscription terms |
| Installation | Issabel 5 ISO / reviewed netinstall | FreePBX 17 Debian 12 ISO/script | Vendor-supported OS/hosted paths |
| Management | Web UI + Linux/Asterisk expertise | Web UI + module lifecycle | Integrated vendor console |
| SIP | Asterisk; GUI/driver compatibility matters | Asterisk; documented PJSIP path | Vendor carrier/device compatibility lists |
| Contact center | Queues/IVR; commercial products separate | Queues/IVR; paid advanced modules | Queues/reporting depend on edition |
| Security | Operator hardening; Asterisk 20 EOL planning | Operator hardening and maintained packages/modules | Vendor update model; admin hardening still needed |
| Customization | High; avoid overwriting generated files | High; respect GUI include hierarchy | Within supported APIs/features |
| Support | Community or defined commercial agreement | Community / Sangoma partners and plans | Vendor / partners per agreement |
| Enterprise fit | Depends on skills, support horizon and DR | Depends on modules, operations and SLA | Depends on feature tier and integrations |

| Criterion | Physical server | VMware VM | Cloud VM |
| --- | --- | --- | --- |
| Cost | Hardware + spare capacity | Shared host + hypervisor licensing | Recurring compute/storage/egress |
| Maintenance | Firmware and hardware replacement | Guest + host + hypervisor lifecycle | Guest + cloud/provider coordination |
| Scalability | Hardware-bound; expansion planned | Resize with resource validation | Resize subject to instance/network limits |
| Reliability | Redundancy/UPS must be built | HA restart is not seamless call survival | Zone/provider failures still need DR |
| Networking | Local latency and physical cards | VLAN/vSwitch/uplink planning | Public IP/NAT/security groups and WAN |
| Backup | Native + OS + offsite | Native + application-aware VM backup | Native + consistent cloud backup + offsite |
| Complexity | Spare parts and recovery hardware | Contention and datastore management | Carrier/cloud interoperability and egress |

[Sangoma: FreePBX 17 support baseline](https://sangomakb.atlassian.net/wiki/spaces/FP/pages/222101505/FreePBX%2B17)

[3CX licensing and edition comparison](https://www.3cx.com/ordering/pricing/)

## 20. Production validation checklist

- [ ] OS/engine inventory, supported horizon and migration owner recorded
- [ ] Static IP, VLAN, gateway, DNS and NTP verified after reboot
- [ ] Official signed updates and rollback/maintenance procedure verified
- [ ] HTTPS/SSH restricted to admin VLAN/VPN; certificate checked
- [ ] Unique secrets; least privileges; unused services reviewed
- [ ] 101/102 registration, audio, hold, transfer and voicemail tested
- [ ] Inbound/outbound DID, CID and DTMF verified with carrier
- [ ] Emergency routing/location and permitted/blocked destinations verified
- [ ] IVR, invalid/timeout, queue overflow and after-hours tested
- [ ] Recording playback, permissions, retention and capacity verified
- [ ] Actual SIP/RTP rules; denied sources and two-way media tested
- [ ] QoS and virtual resources measured at expected busy-hour load
- [ ] Monitoring alerts, backup failure alerts and ownership tested
- [ ] Offsite restore completed; RPO/RTO measured; runbook approved
Record the evidence and owner for every item; an unchecked restore or unsupported engine is a release blocker. The checklist is a template, not a claim these installation tests were executed for this article.

## 21. Frequently Asked Questions

### Which ISO is the current baseline?

The official listing checked on 14 October 2026 identifies Issabel 5 ISO 20261001; its announcement specifies Asterisk 20. Recheck before deployment and inventory installed RPMs.

### Are Asterisk 16 and 18 safe long-term choices?

Both are EOL. Network restrictions reduce exposure but do not restore upstream maintenance. Plan a supported migration instead of treating an old ISO as current.

### Can I install Asterisk 22 over Issabel 5?

Do not assume compatibility. A supported Issabel package/GUI/module/restore combination was not verified here. Obtain explicit support and test before upgrading.

### Why is a registered phone unable to carry audio?

REGISTER proves signaling reachability at that moment. Media uses SDP addresses, codecs and separate RTP ports; inspect both media directions and device audio permissions.

### Must SIP and RTP be public?

No blanket public access is required. Use a voice VLAN/VPN and provider source allowlists, or a maintained SBC where appropriate; permit only actual required flows.

### Is a VMware snapshot a backup?

It is a temporary rollback mechanism, with datastore and consistency limitations. Use external application-consistent backups and prove restoration independently.

### How much recording storage is needed?

Measure the actual format. Mono 8 kHz 16-bit PCM is about 0.96 MB/minute; retention, call-hours, dual-leg recording and backup copies determine total capacity.

### Does a non-registered IP trunk mean failure?

Not necessarily: IP authentication may not use REGISTER. Verify allowed source addresses, endpoint identification and successful calls rather than a registration indicator.

### Should every MikroTik SIP helper be disabled?

Decide from the provider design and packet evidence. Harmful ALG rewriting justifies disabling it, followed by new-session and two-way-audio testing.

### Were these procedures executed in a PBX lab?

No PBX/ESXi/carrier lab was available. Release and syntax guidance were checked against primary sources; local article generation and renderer checks are reported separately.

## 22. Operational conclusion

Deploy from the verified current image, preserve the observed configuration inventory, and accept the system only after real call and restore tests. Assign owners for patches, carrier fraud alerts and recording retention. For the current Asterisk 20 baseline, schedule migration before October 2027. Capacity, encryption and availability claims belong in the acceptance record with measured evidence.

## 23. Official References

- [Official Issabel artifacts](https://sourceforge.net/projects/issabelpbx/files/Issabel%205/)
- [Current Issabel release announcement](https://forum.issabel.org/d/19773/6)
- [Original Issabel 5 OS baseline](https://www.issabel.com/en/release-of-issabel-5-innovation-and-advancement-in-unified-communications/)
- [Asterisk support lifecycle](https://docs.asterisk.org/About-the-Project/Asterisk-Versions/)
- [Rocky Linux networking](https://docs.rockylinux.org/guides/network/basic_network_configuration/)
- [PJSIP registration reference](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Configuring-Outbound-Registrations/)
- [PJSIP NAT reference](https://docs.asterisk.org/Configuration/Channel-Drivers/SIP/Configuring-res_pjsip/Configuring-res_pjsip-to-work-through-NAT/)
- [Asterisk CLI context](https://docs.asterisk.org/Operation/Asterisk-Command-Line-Interface/)
- [Voicemail reference](https://docs.asterisk.org/Configuration/Applications/Voicemail/)
- [QoS reference](https://docs.asterisk.org/Configuration/Channel-Drivers/IP-Quality-of-Service/)
- [RouterOS service ports](https://help.mikrotik.com/docs/spaces/ROS/pages/103841820/Services)
- [VMware Tools compatibility](https://knowledge.broadcom.com/external/article/313371/vmware-tools-compatibility-with-guest-op.html)
- [FreePBX support baseline](https://sangomakb.atlassian.net/wiki/spaces/FP/pages/222101505/FreePBX%2B17)
- [3CX licensing](https://www.3cx.com/ordering/pricing/)
- [Issabel commercial cloud direction; not a Community ISO support promise](https://www.issabel.com/en/cloud-transition/)
- [Commercial Multitenant terms](https://www.issabel.com/en/multitenant-changelog-en/)
- [Asterisk 20 RTP CLI implementation](https://raw.githubusercontent.com/asterisk/asterisk/20/res/res_rtp_asterisk.c)
- [Issabel PBX backup module source](https://github.com/IssabelFoundation/issabelPBX/tree/master/backup)
- [MariaDB dump consistency and limitations](https://mariadb.com/docs/server/clients-and-utilities/backup-restore-and-import-clients/mariadb-dump)
- [chronyc command and tracking reference](https://chrony-project.org/doc/4.8/chronyc.html)
- [Fail2ban project documentation](https://github.com/fail2ban/fail2ban/wiki)
[FA Markdown download](/downloads/issabel-pbx-installation-configuration/article.fa.md)

[EN Markdown download](/downloads/issabel-pbx-installation-configuration/article.en.md)