Kamailio combined with Asterisk creates and incredibly robust and durable VoIP framework. With scalability and security, adding Kamailio to an asterisk deployment makes sense and saves money.

1. Expanding Asterisk with
Kamailio Fred Posner
@fredposner
qxork.com

2. Who am I?

3. Why Asterisk?

4. If Asterisk can do all that...

5. Why do we need Kamailio?
and....

6. How do you pronounce Kamailio?
Kah – Mah – Illie - Oh

7. What is Kamailio?
SIP Proxy Server
SIP Registrar Server
SIP Location Server
SIP Application Server
SIP Dispatcher Server

8. What isn't Kamailio?
SIP Phone
B2BUA
Media Server

9. Typical Reasons to Implement Kamailio
● Scaling
– High Volume of Calls
– High Number of Users
● Security
● Load Balancing
● LCR (Least Cost Routing)

10. How many calls can Asterisk handle?
200 or 400. There is no 100.

11. Asterisk “Activities” Affect CPS/Load
● Music on Hold
● Codec Transcoding
● IVR Handling
● AGI Scripts
● Call Recording
● Queues
● Voicemail

12. Registrations
Authentication
NAT
CallsPresence
Call LimitExt to Ext
Location
STOPSTOP
THETHE
INSANITINSANIT

13. Internet / PSTN
Kamailio
There must be a better way!
Kamailio:
– Authentication, NAT,
Location, LCR, Registration,
Extension to Extension calls,
Security
Asterisk:
– Queues, Media, Call
Processing, Voicemail,
Conferences, etc.

14. Load Balancing
n + 1 scaling made easy with dispatcher module

15. DISPATCHER Module
# Dispatch requests
route[DISPATCH] {
# round robin dispatching
if(!ds_select_dst("1", "4")) {
send_reply("404", "Ouch");
exit;
}
t_on_failure("RTF_DISPATCH");
route(RELAY);
exit;
}
failure_route[RTF_DISPATCH] {
if (t_is_canceled()) {
exit;
}
# next DST - only for 500 or local timeout
if (t_check_status("500") or (t_branch_timeout() and !t_branch_replied()))
{
if(ds_next_dst()) {
t_on_failure("RTF_DISPATCH");
route(RELAY);
exit;
}
}
}

16. Internet / PSTN
Kamailio

17. Security

18. Ever seen something like this?
[Oct 1 23:01:26] NOTICE[3063][C-00002d55] chan_sip.c: Call from '' (158.69.52.94:11067) to extension '!2#48' rejected because extension not
found in context 'default'.
[Oct 1 23:01:26] NOTICE[3063][C-00002d56] chan_sip.c: Call from '' (158.69.52.94:11067) to extension '!' rejected because extension not found in
context 'default'.
[Oct 1 23:01:26] NOTICE[3063][C-00002d57] chan_sip.c: Call from '' (158.69.52.94:11067) to extension '!' rejected because extension not found in
context 'default'.
[Oct 1 23:01:26] NOTICE[3063][C-00002d58] chan_sip.c: Call from '' (158.69.52.94:11067) to extension '!' rejected because extension not found in
context 'default'.
[Oct 1 23:01:26] NOTICE[3063][C-00002d59] chan_sip.c: Call from '' (158.69.52.94:11067) to extension '!' rejected because extension not found in
context 'default'.
[Oct 1 23:01:26] NOTICE[3063][C-00002d5a] chan_sip.c: Call from '' (158.69.52.94:11067) to extension '!qaz' rejected because extension not found
in context 'default'.

19. Asterisk Security Tools
● fail2ban
● custom script
● IPTABLES
● hardened dialplan
● Hardened sip.conf
● Log analyzers happen
after the attack
● CPU/Memory resources
● Only protects single box

20. Kamailio Security
● GEOIP
● HTABLE
● PIKE (flood
detection)
● PIPELIMIT (counter)
● PERMISSIONS
● RATELIMIT (counter)
● SANITY (formatting)

21. PIKE / HTABLES/PERMISSIONS
if((src_ip!=myself) && !allow_source_address(1)) {
if($sht(ipban=>$si)!=$null) {
# ip is already blocked
exit;
}
if (!pike_check_req()) {
$sht(ipban=>$si) = 1;
exit;
}
}

22. SIP Message Inspection / HTABLES
if ($ua =~ "(friendly-scanner|sipvicious|sipcli)") {
if(src_ip!=myself) {
$sht(ipban=>$si) = 1;
}
exit;
}
if($au =~ "(=)|(--)|(')|(#)|(%27)|(%24)" and $au != $null) {
if(src_ip!=myself) {
$sht(ipban=>$si) = 1;
}
exit;
}

23. Handle Before Reaching Asterisk
[R-REQINIT:PIPELIMIT] invites to 192.168.101.21 exceeded 5cps
[R-REQINIT:PIPELIMIT] invites to 192.168.101.23 exceeded 5cps
[R-REQINIT:PIPELIMIT] invites to 192.168.101.22 exceeded 5cps
[R-REQINIT:ANTIFLOOD] script kiddies from
IP:85.93.91.162:5063 - dropping and blocking
[R-REQINIT:ANTIFLOOD] script kiddies from
IP:212.83.188.161:5068 - dropping and blocking
[R-REQINIT:ANTIFLOOD] script kiddies from
IP:85.93.89.219:5066 - dropping and blocking
[R-REQINIT:ANTIFLOOD] script kiddies from
IP:85.25.74.70:5150 - dropping and blocking

24. Kamailio Saves Money

25. Financial Benefits
● Kamailio reduces fraud risk (security)
● Kamailio reduces carrier cost (lcr)
● Kamailio reduces opportunity costs (downtime)

26. Kamailio Plays Well with Others
● IPv4 & IPv6
● UDP/TCP
● TLS
● SCTP
● All codecs
● WebRTC
● Supporting RFC3261, RFC3262, RFC3263,
RFC3880, RFC4474, RFC2865, RFC2866,
RFC4975, RFC3486, RFC 3265, RFC 3856, RFC
3863, RFC 4480, RFC 3903, RFC 3857, RFC
3858, RFC 3680, RFC3581, RFC1918, RFC2617,
RFC4122, RFC4510, RFC4515, RFC4662,
RFC4826, RFC4745 and RFC5025, RFC3410,
RFC3327, RFC2741, RFC4516, etc.

27. Kamailio: Positives
● Very fast
● Minimal hardware
● More than 200 modules
● Centralization
● Saves Money
● LCR
● Scalable
● Failover
● Strong Community
● Promotes Growth

28. Kamailio: Negatives
● Must know SIP
● Must really know SIP
● Need strong SIP knowledge

29. Expanding Asterisk with
Kamailio Fred Posner
@fredposner
qxork.com
Thank you

30. Expanding Asterisk with
Kamailio Fred Posner
@fredposner
Questions