[general]
;------------- TLS SETTINGS----------------

tlsenable=yes
tlsbindaddr=0.0.0.0:6051
srvlookup=yes

;
;------------------------ TLS settings ------------------------------------------------------------
;tlscertfile=</path/to/certificate.pem> ; Certificate file (*.pem format only) to use for TLS connections
                                        ; default is to look for "asterisk.pem" in current directory

;tlsprivatekey=</path/to/private.pem> ; Private key file (*.pem format only) for TLS connections.
                                      ; If no tlsprivatekey is specified, tlscertfile is searched for
                                      ; for both public and private key.

;tlscafile=</path/to/certificate>
;        If the server your connecting to uses a self signed certificate
;        you should have their certificate installed here so the code can
;        verify the authenticity of their certificate.

tlscapath=/etc/ssl/certs
;        A directory full of CA certificates.  The files must be named with
;        the CA subject name hash value.
;        (see man SSL_CTX_load_verify_locations for more info)

;tlsdontverifyserver=yes
;        If set to yes, don't verify the servers certificate when acting as
;        a client.  If you don't have the server's CA certificate you can
;        set this and it will connect without requiring tlscafile to be set.
;        Default is no.

tlscipher=ALL
;        A string specifying which SSL ciphers to use or not use
;        A list of valid SSL cipher strings can be found at:
;                http://www.openssl.org/docs/apps/ciphers.html#CIPHER_STRINGS
;
tlsclientmethod=tlsv1     ; values include tlsv1, sslv3, sslv2.
                           ; Specify protocol for outbound client connections.
                           ; If left unspecified, the default is sslv2.

;tcpenable=yes
udpbindaddr=0.0.0.0:5060
;tcpbindaddr=0.0.0.0:6050

transport=udp


dtmfmode=auto

;----------------------------------- MEDIA HANDLING --------------------------------
; By default, Asterisk tries to re-invite media streams to an optimal path. If there's
; no reason for Asterisk to stay in the media path, the media will be redirected.
; This does not really work well in the case where Asterisk is outside and the
; clients are on the inside of a NAT. In that case, you want to set directmedia=nonat.
;
directmedia=yes                ; Asterisk by default tries to redirect the
                                ; RTP media stream to go directly from
                                ; the caller to the callee.  Some devices do not
                                ; support this (especially if one of them is behind a NAT).
                                ; The default setting is YES. If you have all clients
                                ; behind a NAT, or for some other reason want Asterisk to
                                ; stay in the audio path, you may want to turn this off.

                                ; This setting also affect direct RTP
                                ; at call setup (a new feature in 1.4 - setting up the
                                ; call directly between the endpoints instead of sending
                                ; a re-INVITE).

                                ; Additionally this option does not disable all reINVITE operations.
                                ; It only controls Asterisk generating reINVITEs for the specific
                                ; purpose of setting up a direct media path. If a reINVITE is
                                ; needed to switch a media stream to inactive (when placed on
                                ; hold) or to T.38, it will still be done, regardless of this 
                                ; setting. Note that direct T.38 is not supported.

;directmedia=nonat              ; An additional option is to allow media path redirection
                                ; (reinvite) but only when the peer where the media is being
                                ; sent is known to not be behind a NAT (as the RTP core can
                                ; determine it based on the apparent IP address the media
                                ; arrives from).

;directmedia=update             ; Yet a third option... use UPDATE for media path redirection,
                                ; instead of INVITE. This can be combined with 'nonat', as
                                ; 'directmedia=update,nonat'. It implies 'yes'.

;directmedia=outgoing           ; When sending directmedia reinvites, do not send an immediate
                                ; reinvite on an incoming call leg. This option is useful when
                                ; peered with another SIP user agent that is known to send
                                ; immediate direct media reinvites upon call establishment. Setting
                                ; the option in this situation helps to prevent potential glares.
                                ; Setting this option implies 'yes'.

directrtpsetup=yes             ; Enable the new experimental direct RTP setup. This sets up
                                ; the call directly with media peer-2-peer without re-invites.
                                ; Will not work for video and cases where the callee sends
                                ; RTP payloads and fmtp headers in the 200 OK that does not match the
                                ; callers INVITE. This will also fail if directmedia is enabled when
                                ; the device is actually behind NAT.

g726nonstandard=no

progressinband=never

alwaysauthreject = yes         ; When an incoming INVITE or REGISTER is to be rejected,
                                ; for any reason, always reject with an identical response
                                ; equivalent to valid username and invalid password/hash
                                ; instead of letting the requester know whether there was
                                ; a matching user or peer for their request.  This reduces
                                ; the ability of an attacker to scan for valid SIP usernames.
                                ; This option is set to "yes" by default.

session-timers=refuse
session-expires=1800
session-minse=90
session-refresher=uas


; t38pt_udptl = yes            ; Enables T.38 with FEC error correction.
; t38pt_udptl = yes,fec        ; Enables T.38 with FEC error correction.
; t38pt_udptl = yes,redundancy ; Enables T.38 with redundancy error correction.
; t38pt_udptl = yes,none       ; Enables T.38 with no error correction.
; t38pt_udptl = yes,fec,maxdatagram=400 ; Enables T.38 with FEC error correction and overrides
;                                       ; the other endpoint's provided value to assume we can
;                                       ; send 400 byte T.38 FAX packets to it.

t38pt_udptl = yes,redundancy       ; error correction: fec, redundancy
;faxdetect = yes               ; no(default), yes, t38, cng

useragent=PaPao!
sdpsession=BaBam!

use_q850_reason = yes

autoframing=yes

subscribemwi=yes


register => tls://username:password@secure.dus.net/extension~3600



[sipp]
defaultuser=sipp
type=friend
secret=12345
host=dynamic
context=from-user
transport=udp
disallow=all
allow=alaw


[paolo]
defaultuser=paolo
type=friend
secret=12345
host=dynamic
context=from-user
disallow=all
allow=all
transport=udp
mailbox=1000@default

[testfax]
defaultuser=testfax
type=friend
secret=12345
host=dynamic
context=from-fax
disallow=all
allow=alaw
allow=ulaw
transport=udp

[provider]
type=friend
host=secure.dus.net
transport=tls
transport=udp
defaultuser=username
secret=password
insecure=invite
context=from-provider
nat=no
disallow=all
allow=alaw

