Configuring a Reliance Jio SIP Trunk Gateway in ASTPP

Internal configuration runbook for a leased-line / IP-authenticated SIP trunk delivered by Reliance Jio, covering server-side network interface setup and ASTPP/FreeSWITCH configuration.

Circuit Reference Details

The following parameters were supplied by Reliance Jio for this circuit and are used throughout this guide.

Parameter	Value

Parameter	Value
Circuit ID	SIP_9020188930_1413646870
Proxy IP / Jio SBC IP	100.64.24.4
Cube-side IP / Customer network address	100.64.64.132/29
Subnet mask	255.255.255.248
Gateway (next hop)	100.64.64.131/29
SIP signaling port	UDP 5060
Concurrent channels	500
Pilot number	1413646870
No. of FLNs (DIDs)	1499
DID / FLN range 1	1413646871 to 1413648369

Note: 100.64.0.0/10 is RFC 6598 shared address space, commonly used by Indian ILD/NLD carriers (Jio, Airtel, BSNL) for MPLS/leased-circuit SIP trunk handoffs. It is not a public range and is not reachable via the server's default internet route — a specific static route is required (Step 1.3).

1. Architecture Summary

This is a static, IP-authenticated SIP trunk (no SIP REGISTER handshake). Jio hands off the circuit as a private /29 subnet: our server takes the usable host address 100.64.64.132, Jio's own router/CE on that segment is 100.64.64.131 (the gateway), and Jio's actual SBC/proxy that originates and terminates SIP signaling sits at 100.64.24.4 — a separate address reached through that gateway, not on the local segment itself. Practically this means:

The server needs a secondary IP address (100.64.64.132/29) bound to a network interface.
A static route to 100.64.24.4 must point via 100.64.64.131, since that address is outside the local /29.
ASTPP/FreeSWITCH trusts inbound INVITEs from 100.64.24.4 by IP/ACL instead of digest registration.
A dedicated Sofia SIP profile (or profile alias) is bound to 100.64.64.132 so this carrier's signaling and RTP stay on the correct interface, separate from other vendors on the box.

2. Step 1 — Server / Network Interface Configuration

1.1 Add the customer-side IP to the server interface

On the FreeSWITCH/ASTPP host, add 100.64.64.132/29 as a secondary address on the interface that faces the Jio circuit (physical NIC, VLAN sub-interface, or the router/firewall in front of the box, depending on how the circuit is terminated on site).

Temporary (test immediately, does not survive reboot):

sudo ip addr add 100.64.64.132/29 dev eth1
sudo ip link set eth1 up

Persistent — Ubuntu/Debian with netplan (typical on the Hetzner boxes):

# /etc/netplan/01-jio-trunk.yaml
network:
  version: 2
  ethernets:
    eth1:
      addresses:
        - 100.64.64.132/29

# Apply:
sudo netplan apply

Persistent — classic /etc/network/interfaces:

auto eth1
iface eth1 inet static
    address 100.64.64.132
    netmask 255.255.255.248

1.2 Confirm reachability of the local segment

ping -c 4 100.64.64.131        # Jio-side gateway on the /29
ip addr show eth1              # confirm 100.64.64.132/29 is up

1.3 Add the static route to the Jio SBC

100.64.24.4 is outside 100.64.64.128/29, so it will not be reachable unless a route via the gateway is added explicitly (do not rely on the server's default route for this).

sudo ip route add 100.64.24.4/32 via 100.64.64.131 dev eth1

# Persist (netplan): add under the eth1 block:
#   routes:
#     - to: 100.64.24.4/32
#       via: 100.64.64.131

ping -c 4 100.64.24.4 # confirm the Jio SBC itself is now reachable

1.4 Firewall / ACL

Open SIP signaling and RTP to and from the Jio SBC only, and make sure the SIP fail2ban jail does not blacklist this IP after the OPTIONS keepalive volume it generates.

# iptables example
sudo iptables -A INPUT  -p udp -s 100.64.24.4 --dport 5060 -j ACCEPT
sudo iptables -A INPUT  -p udp -s 100.64.24.4 --dport 16384:32768 -j ACCEPT   # RTP range
sudo iptables -A OUTPUT -p udp -d 100.64.24.4 -j ACCEPT

# fail2ban: add to the SIP jail's ignoreip
# /etc/fail2ban/jail.local
ignoreip = 127.0.0.1/8 100.64.24.4

3. Step 2 — Add Reliance Jio as a Vendor in ASTPP

ASTPP Admin Portal → Manage → Vendors → Add Vendor

Vendor Name: Reliance Jio (or a naming convention matching other carriers, e.g. JIO-SIP-9020188930 to tie back to the Circuit ID).
Currency, billing increment and rate card as agreed with Jio for this circuit.
Save the vendor before adding its gateway (ASTPP nests gateways under a vendor record).

4. Step 3 — Add the Gateway Under the Vendor

Open the Reliance Jio vendor → Gateways → Add Gateway and set:

Field	Value / Setting

Field	Value / Setting
Gateway name	JIO-SIP_9020188930_1413646870
Host / Proxy	100.64.24.4
Port	5060
Transport	UDP
Register	No (IP-authenticated trunk — no SIP credentials from Jio)
From-domain / From-user	Pilot number 1413646870 (or as specified by Jio)
Codec(s)	PCMU/PCMA (G.711) unless Jio confirms otherwise
Channel / CPS limit	500 concurrent channels

Note: Because Register is off, ASTPP will not show this gateway as REGED. Expect a NOREG / NOREG-OK state in fs_cli — that is normal for IP-auth trunks. Health is confirmed via the SIP OPTIONS ping (Step 8), not registration state.

5. Step 4 — Bind a Sofia SIP Profile to the Jio Interface

Keep this carrier's signaling and media on its own IP rather than the server's main sofia profile. Either add a new external profile bound to 100.64.64.132, or, if ASTPP's existing external profile already binds to "all" interfaces, add the address as a bind-params entry.

<!-- conf/sip_profiles/external-jio.xml (new profile) -->
<profile name="external-jio">
  <settings>
    <param name="sip-ip" value="100.64.64.132"/>
    <param name="rtp-ip" value="100.64.64.132"/>
    <param name="ext-sip-ip" value="100.64.64.132"/>
    <param name="ext-rtp-ip" value="100.64.64.132"/>
    <param name="sip-port" value="5060"/>
    <param name="context" value="public"/>
    <param name="auth-calls" value="false"/>
  </settings>
</profile>

No NAT/ext-ip translation is needed here since 100.64.64.132 is the address actually bound on the interface facing Jio (unlike a server behind a public-facing NAT). If this box also sits behind a firewall doing NAT for other carriers, keep this profile's ext-sip-ip / ext-rtp-ip equal to the local IP so SDP is not rewritten incorrectly for this leg.

fs_cli -x "sofia profile external-jio restart"
fs_cli -x "sofia status profile external-jio"
fs_cli -x "sofia status gateway JIO-SIP_9020188930_1413646870"

6. Step 5 — Trust the Jio SBC Without Registration

Add 100.64.24.4 to the ACL that lets calls in without a SIP account/registration, matching how the other IP-authenticated carriers are already trusted on this cluster.

<!-- conf/autoload_configs/acl.conf.xml -->
<list name="jio_trunks" default="deny">
  <node type="allow" cidr="100.64.24.4/32"/>
</list>

Reference this list from the external-jio profile's apply-inbound-acl parameter, then reload:

fs_cli -x "reloadacl"

7. Step 6 — Import the DID / FLN Range Into ASTPP

ASTPP Admin Portal → Manage → DIDs → Import DIDs (bulk CSV) or Add DID for a single number.

Range: 1413646871 to 1413648369 (1,499 numbers, matching "No. of FLNs").
Vendor: Reliance Jio (the vendor created in Step 2).
Assign a cost/rate if this range is billed, or mark it as a flat-rate/bundled range per the circuit commercial terms.
Assign each DID (or the whole range) to the correct customer/account and routing/dialplan so inbound calls land in the right place — IVR, extension, or an onward on-net route.

CSV import format (check the exact column headers in your ASTPP version's sample template before uploading):

did_number,vendor,rate,customer_id,status
1413646871,Reliance Jio,0.00,<customer_id>,active
1413646872,Reliance Jio,0.00,<customer_id>,active
...
1413648369,Reliance Jio,0.00,<customer_id>,active

8. Step 7 — Inbound Routing and Channel/CPS Limits

Inbound routing: match the To-user / Request-URI against the imported DID range and route to the assigned customer's destination (extension, IVR, or the on-net routing logic already in use for cross-customer DID handling).
Enforce the 500-channel limit both in the ASTPP gateway/trunk settings and in the sofia gateway/profile (caller-id-in-from, or a session-limit on the profile) so a spike cannot exceed what Jio has provisioned for this circuit.
If this circuit is also used for outbound termination, add a matching outbound route/trunk group referencing the same gateway, with its own CPS pacing if Jio requires it.

9. Step 8 — Testing and Validation

Confirm interface and routing: ping 100.64.64.131 and ping 100.64.24.4 both succeed from the server.
Confirm the sofia profile is up: sofia status profile external-jio.
Capture signaling with sngrep or tcpdump -i eth1 host 100.64.24.4 -w jio_trunk.pcap and confirm OPTIONS keepalives (if Jio sends them) get a 200 OK.
Have Jio (or the on-site test tool) place an inbound test call to one of the FLNs in 1413646871–1413648369; confirm the call arrives at the external-jio profile and a CDR is written in ASTPP.
Check audio both ways on the test call — one-way audio on a new trunk is almost always an ext-rtp-ip/NAT mismatch (see Step 4) rather than a carrier-side issue.
Confirm the codec negotiated is what Jio expects (G.711 typically); mismatched absolute_codec_string overrides elsewhere in the dialplan have caused DTMF/codec issues on other trunks before — check this is not being forced on the new profile unintentionally.
Load-test or at least monitor concurrent channel count during go-live to confirm it tracks correctly against the 500 CC ceiling.

10. Step 9 — Post-Go-Live Monitoring

Add the external-jio profile/gateway to existing Prometheus/Grafana dashboards (channel count, registration/NOREG state, CDR volume) alongside the other carrier trunks.
Confirm CDR billing rules pick up calls on this DID range/vendor correctly for reporting.
Keep the fail2ban ignoreip and ACL entries under change control — revisit if Jio ever changes 100.64.24.4 or the /29 allocation.

11. Troubleshooting Quick Reference

Symptom	Likely cause / first check

Symptom	Likely cause / first check
No inbound calls arrive at all	Static route to 100.64.24.4 missing (Step 1.3); firewall/ACL blocking the SBC IP (Step 1.4 / Step 5); gateway or ACL list not referenced by the profile.
Calls arrive but get 403/488	IP not yet whitelisted on Jio's side to match ours, or codec mismatch — confirm with Jio NOC which IP they expect INVITEs to come from (should be 100.64.64.132).
One-way or no audio	ext-rtp-ip/ext-sip-ip on external-jio profile not matching the actual bound interface, or RTP port range blocked in the firewall (Step 1.4).
DID not routing to the right customer	FLN not imported/assigned correctly in Step 6, or inbound routing rule matching the wrong field (To vs Request-URI).
Gateway always shows NOREG	Expected — this is an IP-authenticated trunk with Register off. Confirm health via OPTIONS ping / test call instead of registration state.
fail2ban blocks the Jio SBC after volume of OPTIONS pings	Add 100.64.24.4 to the SIP jail's ignoreip (Step 1.4).

Prepared as an internal ASTPP/FreeSWITCH configuration runbook for the Reliance Jio SIP trunk (Circuit ID SIP_9020188930_1413646870). Verify exact field names against the ASTPP version in use, as UI labels can vary slightly between releases.