VoIP.infoThe independent guide to business communications.
VoIP.info Guide

FreeSWITCH SIP profiles and gateways: listeners, trust and trunk state

Keep Sofia profile listeners, directory identities, gateway definitions, registration, dialplan authority and observed call behavior as separate evidence.

Reviewed 2026-10-24Current SignalWire-maintained SIP-profile, gateway, registration, call-setup, diagnostic, trace and CLI documentation was reviewed October 24, 2026. Shipped profile names and defaults are configuration examples, not security guarantees or proof of an installed listener. No profile, socket, certificate, gateway, credential, provider account, registration, dialplan, packet, call, media stream, price, availability, compatibility or support response was inspected or tested.IntermediateDocumentation based · not lab tested

Model each profile as an independent SIP user agent

mod_sofia treats each SIP profile as an independent SIP user agent bound to an address and port, with its own transports, codec preferences, authentication policy, ACLs and target dialplan context. The familiar internal and external names come from the supplied configuration; their names do not enforce trust.

Record bind and advertised addresses, ports, transports, context, authentication and ACL behavior for the exact running profile.

Keep directory identity and dialplan authority separate

Directory users can supply authentication and channel variables, while the receiving profile selects a dialplan and context. A successfully authenticated device is not thereby entitled to every destination. Trace the identity lookup, applied variables, selected context and matched extension independently.

Broadening a context to fix one failed call can expand toll or service access, so retain a negative authorization test.

Put every gateway inside the intended profile

A gateway is a named outbound SIP trunk definition inside one profile and becomes the handle used in sofia/gateway/<name>/<number> bridge strings. It may register, or it may be deliberately configured not to register for IP-authenticated peering.

Confirm the gateway name, owning profile, proxy, realm, authentication identity, From identity and called-number format without treating any one field as proof of provider acceptance.

Read registration and ping as different state

A registering gateway can move through queued, attempting, registered, failed, backoff, expired and timeout states. A non-registering gateway can validly show NOREG; its OPTIONS ping health is a different observation. NOREG / UP can be normal for an IP-authenticated trunk, while NOREG / DOWN can identify failed reachability when ping is configured.

Do not enable registration solely to make a status label look healthier.

Choose rescan, restart and reload deliberately

reloadxml refreshes XML, a Sofia profile rescan can discover gateway changes, and a profile restart rebinds transports. Those operations have different runtime effects and can affect registrations or calls. Read the installed command help, state the expected disruption and preserve rollback before executing a broad operation.

After any change, inspect the same profile and gateway again instead of assuming a successful command changed effective state.

Accept inbound and outbound paths independently

For outbound acceptance, retain route selection, bridge string, gateway state, INVITE, final response, answer and two-way media. For inbound acceptance, retain source trust, receiving profile, context, extension match, destination, answer and media. Registration alone proves neither path.

Repeat one permitted and one restricted case after the change. No profile, gateway or call was tested for this guide.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Examples require adaptation to your topology. No live PBX or hardware testing is claimed.

Continue your research

Hub · FreeSWITCH 1.11.3 release reference; verify installed modules and package support

FreeSWITCH: architecture and operations

Learn FreeSWITCH through its directory, SIP profiles, dialplan, media engine and event interfaces.

Explore topic →
Guide · Current SignalWire-maintained installation, module, CLI, SIP-profile and diagnostic documentation was reviewed October 24, 2026. The documented package and source paths, vanilla configuration and command examples do not prove a supported operating-system combination, installed build, enabled module, secured listener, capacity, recoverability or accepted call. No host, repository account, token, package, compiler, module, configuration, endpoint, packet, media stream, backup, restore, price, support entitlement or call was inspected or tested.

FreeSWITCH installation: packages, source, modules and first-call proof

Choose one reproducible installation path, record the effective module and configuration baseline, and prove a restricted first call before exposing service.

Read guide →
Guide · FreeSWITCH 1.11.3 release reference; verify installed modules and package support

FreeSWITCH XML dialplan: evaluation and execution

Understand contexts, conditions and queued applications before building a routing rule.

Read guide →
Guide · Current SignalWire-maintained codec, media-handling, channel-variable, SIP-profile, trace and audio-troubleshooting documentation was reviewed October 24, 2026. Codec and media-mode capabilities do not prove module load, negotiation, transcoding, NAT reachability, SRTP protection, audio quality or capacity. No host, module, endpoint, SDP, packet, capture, recording, conference, benchmark, media stream, price, compatibility or call was inspected or tested.

FreeSWITCH media and codecs: prove each negotiated RTP path

Compare full media, proxy media and bypass media while retaining per-leg codec, SDP, address, security and packet evidence.

Read guide →
Guide · Current SignalWire-maintained SIP-profile, TLS, Event Socket, CLI, diagnostic, registration and trace documentation was reviewed October 24, 2026. Shipped bindings, credentials and verification defaults are documentation values, not a secure deployment baseline. No host, firewall, ACL, listener, certificate, private key, credential, module, Event Socket, endpoint, provider account, packet, backup, restore, penetration test, price, compatibility or call was inspected or tested.

FreeSWITCH security: bound listeners, trust, control and recovery

Secure Sofia, dialplan, TLS, Event Socket, modules and restore paths as separate control boundaries with runtime evidence.

Read guide →
Troubleshooting · Current SignalWire-maintained gateway, Sofia-profile, diagnostic, call-setup, trace and events documentation was reviewed October 24, 2026. Gateway state names and command examples require verification on the installed build and profile. No switch, profile, gateway, credential, provider account, DNS answer, firewall, registration, OPTIONS exchange, packet, call, media stream, failover event, price, availability, compatibility or support response was inspected or tested.

FreeSWITCH gateway down: registration, ping, route or upstream failure

Separate Sofia gateway lifecycle, OPTIONS reachability, dialplan selection, SIP response, hangup cause and media evidence before changing a trunk.

Read guide →
Protocol reference

SIP authentication: challenges and modern digest support

Understand the difference between a normal challenge, failed credentials and an unsupported algorithm.

Read guide →
Guide · Wireshark 4.x / current upstream tool documentation; inspect installed versions

NAT diagnosis with signaling and media evidence

Identify whether a failing address belongs to SIP routing, media negotiation or a changed network mapping.

Read guide →