> This page is for Voice AI Platform.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.hams.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.hams.ai/_mcp/server.

# SIP connection

> Connect your PBX to Cloud Call Center with a SIP trunk, and learn which ports and limits apply.

Use a SIP trunk to connect your own PBX, SBC, or voice gateway to Cloud Call Center. Calls from your PBX enter a call flow. Calls that agents dial leave through your PBX.

> **Note**
>
> Hams support gives you the address of the Hams SIP server and the media port range. These values are not in this documentation.

## Choose the connection type

#### Over an IPsec VPN

A site-to-site IPsec tunnel runs between your firewall and Hams. SIP messages and media travel inside the tunnel. Choose this type if your PBX is on a private network or has no public IP address. For the tunnel, see [IPsec VPN](/platform/integration/ipsec-vpn).

```
Your PBX ── Your firewall ══ IPsec tunnel ══ Hams ── Hams SIP server
```

#### Over the internet

The 2 SIP servers connect directly. Your PBX must have a public IP address or a host name that resolves to it. Use SIP over TLS if your PBX supports it.

```
Your PBX ── Your firewall ── internet ── Hams SIP server
```

## Ports

Open these ports between your PBX and Hams in both directions. Inside a VPN, open them in the tunnel.

| Traffic      | Protocol and port                                  |
| ------------ | -------------------------------------------------- |
| SIP          | UDP or TCP `5060`                                  |
| SIP over TLS | TCP `5061`                                         |
| Media (RTP)  | UDP, in the port range that Hams support gives you |

The media does not use the SIP port. Open the whole media port range.

## Set up the trunk

#### Ask for a SIP domain

Hams support creates and changes the SIP domains. Ask Hams support to add a domain for your account. See [SIP domains](/cloud-call-center/settings/sip-domains).

#### Add the trunk

Go to **Settings** › **Trunks**. Click **Create Trunk**. Enter the **Host**, the **Port**, and the **Transport** of your PBX. Select the **Direction**. See [Trunks](/cloud-call-center/settings/trunks).

#### Add the IP address of your PBX

For inbound calls, enter the IP address from which your PBX sends SIP in **Allowed source CIDRs**. Over a VPN, use the address inside the tunnel. The system accepts calls on the trunk only from these addresses. If the IP address of your PBX changes and **Host** is a host name, turn on **Track carrier IP via DNS**.

#### Set the credentials

If your PBX needs the call center to register, turn on **Register**. Enter the **Auth username**, the **Auth secret**, and the **Auth realm**.

#### Check the connection

Your PBX must answer SIP `OPTIONS` requests. Turn on **Monitor connection (SIP OPTIONS keepalive)**. Wait for the **Connection** column to show **Online**. The setting has no effect on an **Inbound** trunk.

#### Map your numbers

Add each number that must reach Cloud Call Center as a DID. To send a whole block of numbers to one flow, add a number block. Attach a published call flow to it. See [DIDs](/cloud-call-center/settings/dids).

#### Decide if you trust the headers

If your PBX sends the correct caller in `P-Asserted-Identity`, turn on **Trust identity headers**. Turn it on only for a PBX that you trust. See [Trunks](/cloud-call-center/settings/trunks#trust-identity-headers).

#### Add an outbound route

For outbound calls, add an outbound route that uses the trunk. See [Outbound routes](/cloud-call-center/settings/outbound-routes).

## How the system checks a trunk

The system sends a SIP `OPTIONS` request to your PBX every 30 seconds. It marks the trunk **Unreachable** after 3 failed requests. It marks the trunk **Online** again after 3 good answers. A `2xx` answer or a `401` answer counts as good.

If **Register** is on, the system asks for a registration time of 3600 seconds and renews the registration before it expires.

If your PBX answers an outbound call with a digest challenge, the system answers it one time with the credentials of the trunk. If your PBX challenges again, the call fails with SIP `503`.

## Call limits and codecs

Use **Max inbound channels** and **Max outbound channels** to limit the calls at the same time. At the limit, the trunk rejects the call with SIP `503`.

Use **Codecs** to limit the audio codecs. If your PBX offers none of the listed codecs on an inbound call, the trunk rejects the call with SIP `488`. The trunk does not convert one codec to another. The system always keeps DTMF (`telephone-event`).

## Call path

### Inbound call

1. The caller dials one of your numbers.
2. Your carrier or voice gateway delivers the call to your PBX.
3. Your PBX sends a SIP `INVITE` to Hams over the trunk.
4. The system checks the source IP address against **Allowed source CIDRs**. If the address is not on the list, the system rejects the call with `403`.
5. The system finds the DID. A DID for a single number goes before a number block. If the number is not a DID, the system rejects the call with `404`.
6. If **Trust identity headers** is on, the system takes the caller from `P-Asserted-Identity`. It also reads who forwarded the call.
7. The call enters the call flow of the DID.

### Outbound call

1. An agent dials a number in the softphone.
2. The system finds the outbound route that matches the number.
3. The system sends the call over the trunk of the route to your PBX.
4. Your PBX places the call to the callee.

## Related

* [Trunks](/cloud-call-center/settings/trunks)
* [IPsec VPN](/platform/integration/ipsec-vpn)
* [DIDs](/cloud-call-center/settings/dids)
* [Outbound routes](/cloud-call-center/settings/outbound-routes)
* [Call flows](/cloud-call-center/call-flows)