Set up IP-to-IP authentication

Wholesale partners rarely register with a username and password. They exchange IP addresses instead: the customer’s switch sends calls from a fixed IP, and the vendor accepts calls from yours. This tutorial sets up both sides. It covers authentication only; tariffs, termination routes and the routing group are in Quickstart: wholesale. Allow about 15 minutes.

The example customer sends calls from 203.0.113.10 and 203.0.113.11; the vendor’s gateway is 192.0.2.50.

Before you start

• The vendor exists under Vendors → Vendors, and the customer’s account exists with a service plan and a routing group. See Vendors and Accounts.
• You have the customer’s source IP addresses and the vendor’s gateway address.

Step 1: Give your IP address to both partners

1. Open System Management → Environments. Assigned IPs lists the signalling addresses of your environment.
2. Send the address to the vendor, to add to their allowed list, and to the customer, as the destination of their calls.
3. If the environment has several addresses and the vendor allows only one, remember it for step 2.

Result: both partners know where your calls come from and where theirs must go.

Step 2: Add the vendor connection

1. Open Vendors → Vendors and click Connections in the row of the vendor.
2. Click Add Connection.
3. Enter Connection Name: Example Carrier IP.
4. Select Protocol SIP/UDP and enter Destination: 192.0.2.50. Add :port if the gateway does not listen on 5060.
5. Leave Username and Password empty. Without them the switch sends calls without digest credentials, and the vendor recognises you by your IP.
6. If the vendor allows only one of your addresses, select it as Outbound IP under Advanced Parameters.
7. Click Save & Close.

Screenshot "admin-panel/connections-list" has not been generated yet — see scripts/screenshots/screens.yml.

Result: the list shows the connection with Destination SIP/UDP:192.0.2.50. Add it to a routing group to use it. See Connections.

Step 3: Add the customer’s IP addresses

1. Open My Customers → Accounts, then Actions → Authentication Rules for the customer’s account.
2. Click Add.
3. Enter Remote IP Address: 203.0.113.10. Leave the other fields empty to accept any number from this address.
4. Click Save & Close.
5. Repeat for 203.0.113.11. A rule holds one IPv4 address; ranges and subnets are not accepted, so every source address needs its own rule.

Result: the account’s Authentication Rules list both addresses. Calls from them are authenticated to the account without a password.

Caution

If you restricted SIP/UDP in System Management → IP Firewall, add an allow rule for each customer address and for the vendor’s gateway, or their calls never reach the switch. See Set up the firewall.

Step 4: Test it

1. Open Tools & Debugs → Test Dialplan.
2. Select Mode Not Authenticated Call and enter Remote Address[:Port] 203.0.113.10, a CLI and a CLD (destination) the customer would send.
3. Click Proceed. The result shows the customer’s account under Authenticated as and the vendor’s connection in Routing Entries.
4. Ask the customer to send a test call, then check it under Reports → Call Records (CDRs).

Screenshot "getting-started/test-dialplan" has not been generated yet — see scripts/screenshots/screens.yml.

If the test shows no account, check the address for typos; if the call reaches the vendor but fails with 403, the vendor has not yet allowed your IP.

What’s next

• Authentication: how the switch chooses between rules when one IP carries several customers.
• Route and price calls by CLI or CLD: different tariffs for traffic from the same IP.
• Quickstart: wholesale: the full setup with rates and routing.