You will receive a full set of authentication credentials, and CIDR blocks with the sign-up pack, keep this safe because we can't re-send it if you loose it. 

Registration & Authentication

• Auth type: userpass
• Registration: use a registration object if required, otherwise IP-based via identify object
• Expiry: expiration=3600 (retry with forbidden_retry_interval=60)

Transport

• UDP transport on 0.0.0.0:5060, TLS on 0.0.0.0:5061
• TLS requires ca_list_file, cert_file, and priv_key_file pointing to our current certs. 

NAT & Connectivity

• Set external_media_address and external_signaling_address in the transport to your public IP/FQDN
• Set local_net=192.168.x.x/24 (your LAN) in the transport
• On the endpoint: rtp_symmetric=yes, force_rport=yes, rewrite_contact=yes

Codecs

• On the endpoint: disallow=all, then allow=opus,alaw (in preference order)
• Opus requires the codec_opus module in your switch

SRTP / Encryption

• On the endpoint: media_encryption=sdes (this is in-SDP SRTP)
• For RTCP-MUX: rtcp_mux=yes on the endpoint
• media_encryption_optimistic=yes 

DTMF

• dtmf_mode=rfc4733 

From / Contact / Identity

• from_user= on the switch
• from_domain= on the switch
• contact_user= on the switch
• For CLI/PAI: send_pai=yes and trust_id_inbound=yes on the switch

Inbound DID Handling

• Strip/add prefixes using the dialplan to normalise the DID format for your routing rules

Keepalives & Timers

• qualify_frequency=60 on the switch (sends OPTIONS every 60s)
• timers=no or timers=refused to disable session timers
• qualify_timeout=3.0 is a sensible default

Transfers

• allow_transfer=yes on the switch
• send_rpid=yes and trust_id_inbound=yes for RPID-based transfer identity