🧩 PBX Integration Requirements & Checklist
Summary: A successful PBX integration depends on far more than plugging in a SIP trunk. Network readiness, bandwidth, firewall rules, codec support, security, dial plans, and licensing all must be verified before go-live. This guide delivers a complete requirements breakdown and a practical pre-deployment checklist covering infrastructure, SIP connectivity, security, compatibility, testing, and post-launch validation — so your cutover happens once, cleanly, and without downtime.
📖 Table of Contents
- 1. Why Requirements Planning Matters
- 2. Infrastructure Requirements
- 3. Network & Bandwidth Requirements
- 4. Firewall, NAT & Port Requirements
- 5. SIP Trunk & Provider Requirements
- 6. Security Requirements
- 7. Compatibility Matrix
- 8. Pre-Deployment Checklist
- 9. Testing & Validation
- 10. Common Integration Pitfalls
- 11. Frequently Asked Questions
- 12. Related Resources
Integrating a PBX with a modern SIP trunk is one of the highest-value projects a business communications team can undertake — but it is also one of the most detail-sensitive. Every element in the chain, from cabling and switching to firewall rules and codec negotiation, has to work together before a single call can be trusted in production.
Most failed PBX integrations do not fail because of the PBX itself. They fail because of unverified assumptions: bandwidth that was never measured, firewall rules that were never opened, NAT settings that were never tested, or codec preferences that silently fell back to something the endpoint could not handle. Each of these gaps produces the same symptoms — one-way audio, failed registration, dropped calls — and each is entirely preventable with proper requirements gathering.
This guide breaks PBX integration into its core requirement categories and then converts them into a practical, sign-off-ready checklist. Whether you are deploying an on-premises IP PBX, migrating to a hosted platform, or adding a second site to an existing estate, use this document as your single source of truth before cutover.
🔍 Why Requirements Planning Matters
PBX integration touches three separate domains — telephony, networking, and security — and each has its own owner and its own failure modes. A requirements checklist forces those owners to confirm readiness in writing before cutover, which eliminates the most common cause of post-launch incidents: undocumented assumptions.
Organizations that complete a formal pre-deployment checklist report up to 70% fewer post-cutover incidents than those that deploy without one
✅ What Good Planning Prevents
- One-way or missing audio after go-live
- Failed SIP trunk registration
- Call quality degradation under load
- Emergency calling failures
- Ported numbers going dark mid-migration
⚠️ What Poor Planning Causes
- Emergency rollback and re-scheduling
- Duplicate carrier and porting fees
- Lost customer calls during transition
- Extended downtime for remote staff
- Security exposure from rushed firewall changes
🏢 Infrastructure Requirements
Before any SIP configuration begins, confirm the physical and platform layer is ready.
| Requirement | Minimum Standard | Why It Matters |
|---|---|---|
| PBX Platform | IP-capable PBX or hosted PBX with SIP trunk support | Legacy TDM-only systems require a gateway |
| Server / Appliance Resources | Sufficient CPU and RAM for expected concurrent calls | Undersized hosts drop calls under peak load |
| Power Protection | UPS on PBX, switch, and router | Prevents corruption and abrupt service loss |
| IP Handsets / Softphones | PoE-capable or powered endpoints, firmware current | Outdated firmware breaks codec and security support |
| Cabling & Switching | Cat5e/Cat6 with VLAN-capable managed switches | Enables voice VLAN separation and QoS |
| Licensing | Valid PBX licences, SIP channel licences, user licences | Missing licences cause silent registration failures |
| Documentation | Up-to-date network diagram, extension list, DID inventory | Essential for dial plan design and troubleshooting |
💡 Pro Tip: Photograph and document existing cabling and switch port assignments before the integration begins. Restoration after an unexpected change is far faster with a baseline record.
📶 Network & Bandwidth Requirements
Voice is a real-time workload. Unlike file transfers, it cannot wait for retransmission — so bandwidth must be calculated per concurrent call and quality must be protected with QoS.
| Codec | Bandwidth per Call (per direction) | 10 Concurrent Calls | Best Use |
|---|---|---|---|
| G.711 | ~87 kbps | ~1.74 Mbps bidirectional | LAN and high-quality WAN links |
| G.729 | ~31 kbps | ~0.62 Mbps bidirectional | Constrained or remote links |
| G.722 (HD) | ~87 kbps | ~1.74 Mbps bidirectional | Internal HD calling |
| Opus (adaptive) | ~35–55 kbps | ~0.7–1.1 Mbps bidirectional | WebRTC and modern softphones |
🔹 Quality Thresholds to Verify
- Latency: under 150 ms one-way
- Jitter: under 30 ms
- Packet loss: under 1%
- Headroom: 20–30% above calculated peak
🔹 Network Controls to Enable
- QoS: mark voice as DSCP EF (46)
- Voice VLAN: separate voice from data
- Wired Ethernet: avoid Wi-Fi for desk phones
- Bandwidth caps: limit non-critical bulk traffic
⚠️ Important: Symmetric bandwidth matters. A link advertising 500 Mbps down but only 20 Mbps up may still fail when 15 staff join calls simultaneously. Always verify upload capacity against your concurrent call requirement.
🚀 Want Your Integration Audited Before Cutover?
NetviaVoice engineers review your bandwidth, firewall, and SIP configuration end-to-end, then deliver a signed readiness report before you go live.
Visit NetviaVoice🔐 Firewall, NAT & Port Requirements
Firewall and NAT configuration is where most integrations stall. Confirm every rule in writing with both your network team and your SIP provider.
| Protocol / Service | Port | Direction | Purpose |
|---|---|---|---|
| SIP signaling | UDP/TCP 5060 | Inbound & outbound | Registration and call setup |
| SIP over TLS | TCP 5061 | Inbound & outbound | Encrypted signaling |
| RTP media | UDP 10000–20000 (typical) | Inbound & outbound | Voice audio streams |
| RTP media (3CX) | UDP 9000–10999 | Inbound & outbound | Voice audio streams |
| Web management | TCP 443 | Inbound (restricted) | Admin access and provisioning |
⚠️ Critical: Disable SIP ALG on the router. SIP ALG is intended to assist NAT traversal but routinely corrupts SIP headers, breaks registration, and causes one-way audio. Use proper NAT settings and STUN instead.
🔹 NAT Configuration Checklist
- Set the PBX external/public IP correctly
- Define local network ranges in PBX NAT settings
- Enable consistent/symmetric RTP where supported
- Configure STUN on remote endpoints
- Disable SIP ALG on all routers
🔹 Firewall Hardening
- Whitelist SIP provider IP ranges only
- Block port 5060 from all other sources
- Restrict 443 management access to admin IPs
- Rate-limit inbound SIP requests
- Log denied SIP traffic for review
🔗 SIP Trunk & Provider Requirements
Confirm these details with your provider before scheduling cutover.
| Item | Detail Required |
|---|---|
| Authentication method | Registration (username/password) or IP-based whitelisting |
| SIP server address | Hostname or IP of provider edge |
| Supported codecs | Confirm G.711 / G.729 / Opus support and preferred order |
| Channel capacity | Number of concurrent calls provisioned |
| DID inventory | Full list of inbound numbers and routing intent |
| E.164 format | Agreed number presentation standard |
| Failover options | Secondary trunk, secondary carrier, or PSTN fallback |
| Support escalation | NOC contact and escalation path for cutover night |
💡 Pro Tip: Request a test DID from your provider before cutover. It lets you validate inbound routing, caller ID, and audio quality without touching production numbers.
🛡️ Security Requirements
PBX integration opens a public-facing signalling path. Security controls are not optional.
✅ Transport Security
- TLS 1.2+ for SIP signalling (port 5061)
- SRTP for media encryption
- Valid, non-expired certificates on PBX and SBC
- Strong cipher suites only
✅ Access & Fraud Controls
- Strong, unique SIP credentials
- Multi-factor authentication on admin accounts
- Concurrent call caps per trunk
- 24-hour spend limits with alerts
- International calling blocked unless required
- Registration rate limiting enabled
✅ Monitoring & Logging
- Real-time call detail record review
- Automated alerts at 80% of spend limits
- Retain logs for audit and investigation
- Quarterly review of firewall and trunk rules
✅ Emergency Services
- E911 / emergency address registered per site
- Emergency routes configured on all trunks
- Emergency calls bypass call caps
- Test emergency routing before go-live
📊 Compatibility Matrix
Verify each layer of the stack is confirmed compatible before ordering hardware or licences.
| Layer | Check | Status |
|---|---|---|
| PBX ↔ SIP Provider | Provider certified or tested with your PBX version | ☐ Confirmed |
| PBX ↔ IP Phones | Handset firmware supported by PBX release | ☐ Confirmed |
| PBX ↔ Softphone / Mobile | App supported codec and transport | ☐ Confirmed |
| PBX ↔ CRM / Integrations | API or connector version compatibility | ☐ Confirmed |
| PBX ↔ Legacy Devices | Fax, alarms, door entry, analogue adapters | ☐ Confirmed |
| Router / Firewall | SIP-aware, SIP ALG disabled, QoS supported | ☐ Confirmed |
✅ Pre-Deployment Checklist
Use this checklist as your formal go/no-go gate. Every line should be signed off by an accountable owner.
📋 Phase 1 — Discovery & Design
- Extension list, DID inventory, and call flows documented
- Legacy devices identified (fax, alarms, elevators, POS)
- Dial plan designed for local, long-distance, and international
- Concurrent call requirement calculated
- SIP provider selected and contract reviewed
📋 Phase 2 — Network & Security
- Bandwidth measured against requirement with headroom
- QoS configured and verified on switches and router
- Voice VLAN implemented
- Firewall rules applied and SIP provider IPs whitelisted
- SIP ALG disabled on all routers
- NAT settings and external IP configured in PBX
- TLS and SRTP enabled and certificates valid
- Rate limits, spend caps, and international restrictions configured
📋 Phase 3 — Configuration
- SIP trunk added and showing Registered
- Codec order set with G.711 primary and fallback defined
- Inbound routes created for every DID
- Outbound routes created with trunk priority order
- Emergency routes configured and tested
- Voicemail, auto-attendant, and queues configured
- Backup/failover trunk configured
📋 Phase 4 — Validation & Go-Live
- Inbound test calls successful on all DIDs
- Outbound test calls successful with correct caller ID
- Failover tested by disabling primary trunk
- Audio quality verified on wired and remote endpoints
- Number porting scheduled and LOA confirmed
- Rollback plan documented and agreed
- Support escalation contacts confirmed for cutover window
- User communication and training completed
🧪 Testing & Validation
| Test | Method | Pass Criteria |
|---|---|---|
| Registration | Check trunk status in PBX | Shows Registered with green status |
| Inbound calls | Dial each DID from an external mobile | Reaches correct destination, no delay |
| Outbound calls | Call landline, mobile, and long-distance | Connects, correct caller ID, two-way audio |
| Failover | Disable primary trunk | Calls route via backup automatically |
| Emergency routing | Test emergency route to a non-emergency test number | Routes correctly regardless of spend caps |
| Load test | Simulate peak concurrent calls | No dropped calls, MOS remains acceptable |
⚠️ Common Integration Pitfalls
❌ Pitfall 1: SIP ALG Left Enabled
One of the most frequent causes of one-way audio and failed registration. Disable it and rely on proper NAT configuration.
❌ Pitfall 2: RTP Ports Not Opened
Signalling registers successfully but calls connect with no audio. Always open the full RTP range, not a subset.
❌ Pitfall 3: No Headroom Planned
Systems that pass testing fail under real load. Reserve 20–30% bandwidth above calculated peak.
❌ Pitfall 4: Legacy Devices Forgotten
Fax machines, alarms, and door entry systems often surface after cutover. Identify and migrate them during discovery.
❓ Frequently Asked Questions
Basic PBX integration requirements include: a compatible PBX or IP PBX system, reliable broadband internet with sufficient bandwidth, a SIP trunk account from a provider, correct firewall and NAT configuration, open SIP and RTP ports, adequate power and cabling, and a documented dial plan. Security measures such as TLS, SRTP, and strong credentials are also essential.
Each concurrent call requires roughly 87 kbps with G.711 or about 31 kbps with G.729. A business expecting 10 simultaneous calls should plan for approximately 1.7 Mbps of dedicated voice bandwidth with G.711, plus 20–30% headroom. Always calculate both upload and download capacity and implement QoS.
Required ports typically include UDP/TCP 5060 for SIP signaling, TCP 5061 for SIP over TLS, and a UDP range for RTP media (commonly 10000–20000 or 9000–10999 depending on the platform). HTTPS 443 is used for management and provisioning. Always confirm exact ranges with your PBX vendor and SIP provider.
SIP ALG should generally be disabled. Although it is designed to help SIP traffic traverse NAT, it frequently corrupts SIP messages, breaks registrations, causes one-way audio, and interferes with call transfers. Instead, rely on proper NAT settings, STUN, and correctly configured firewall rules.
A small single-site PBX integration can be completed in 1–2 weeks, while multi-site enterprise deployments with number porting typically take 4–8 weeks. Timelines depend on number porting, carrier coordination, network readiness, and user training. Always allow buffer time for porting delays and rejections.
📢 Ready to plan a clean, checklist-driven PBX integration? Our engineers will audit your requirements and deliver a signed readiness report before cutover.