1. Login with your non-root user. Because you never allow root to log in over ssh right?
2. Update the system

sudo yum upgrade -y

3. Upgrade the current modules.

sudo fwconsole ma upgradeall

4. Fix permissions, as module upgrades can leave some files owned by root.

sudo fwconsole chown

5. Reload the system to rewrite the config files.

sudo fwconsole reload

6. Reboot, to make sure everything in in a pristine state, or at least should be.

sudo reboot

7. Log back in and then switch to root. If you run the versionupgrade with sudo instead of as root, it fails to properly do everything, even though it says the upgrade succeeds.

sudo su -

8. Download the versionupgrade module

fwconsole ma downloadinstall versionupgrade

9. Fix permissions again as it messes up file permissions in /var/www/html after you install it.

fwconsole chown

10. Reload

fwconsole reload

11. Run the version upgrade check

fwconsole versionupgrade --check

• If you have an error about a deprecated module remove them and them reload.
  

fwconsole ma delete campon
fwconsle reload

• Then run the version check again.

12. It should be clean, so upgrade.

fwconsole versionupgrade --upgrade

13. Log back into the web interface

• Make sure everything looks normal
• Make a couple test calls, in, out, internal, etc.

14. Once everything looks good, hop back to your SSH session and reboot. Sure everything is runing now, but how do you know it will reboot correctly if you don't try it now?

reboot

15. Assuming everything come sup normally, you are done.

• The most common thing I find here is that I sometimes need to run fwconsole restart before the GUI shows a connection to Asterisk, even though everything is running.

1. Click the edit icon to the right of the Skyetel_Outbound_NA trunk.
   

2. Click the Duplicate at the bottom of the screen.
   

3. Now you can click on the edit icon of the duplicated trunk, currently named Skyetel_Outbound_NA_copy_3.
   

4. On the General tab, change the Trunk Name to Skyetel_Outbound_International.
   

5. Switch to the PJSIP Settings -> General sub tab and change the SIP Server to hc.skyetel.com
   

6. Click on the Submit button.
   

7. Click on the Apply Config button.
   

8. You will see your trunk listed in the list and show as Enabled.
   

1. Click the edit icon to the right of the trunk.
   

2. Click the Duplicate at the bottom of the screen.
   

3. Now you can click on the edit icon of the duplicated trunk, currently named Skyetel_Inbound_copy_2.
   

4. On the General tab, change the Trunk Name to Skyetel_Outbound_NA.

   • NA stands for North America. You will duplicate this trunk after it is done and that trunk up for International and High cost NA calls.
     

5. Change Continue if Busy to Yes.
   

6. Switch to the PJSIP Settings -> General sub tab and change the SIP Server to out.skyetel.com
   

7. Switch to the Advanced sub tab and remove the list of IP addresses and CIDR blocks from Match (Permit).
   

8. Click on the Submit button.
   

9. Click on the Apply Config button.
   

10. You will see your trunk listed in the list and show as Enabled.
    

1. Sign in to your FreePBX instance

2. Click on Connectivity and then Trunks
   

3. Click on the Add Trunk button to show a list of options and then click on Add SIP (chan_pjsip) Trunk

   • Be certain it says chan_pjsip or you will not have a working system.
   • Depending on your FreePBX configuration, you may still see the legacy chan_sip option. This will not work.
     

4. You will get the Add Trunk screen with 3 tabs, we will start on the General tab.
   

5. Trunk Name is a descriptive name for the trunk.

   • Name this one Skyetel_Inbound
   • It cannot have spaces, and FreePBX will auto populate an underscore (_) if you press space.
     

6. Hide CallerID should be set to No by default. Leave it that way.
   

7. Outbound CallerID should always be populated on all trunks as whatever your main number is with Skyetel.

   • This value is the default to use if a call goes out this trunk without any other Caller ID defined.
   • We will use the E.164 format for the number
   • + then Country Code then Number
   • The name section should be limited to 15 characters, the maximum for legacy POTS Caller ID.
   • Also, do not expect the name portion to be seen by most recipients. Skyetel will pass along whatever name is entered here, but it is up the the other side to accept it.
     

8. CID Options should be left on the default of Allow Any CID. You can read the help text to learn more about how this works.
   

9. Maximum Channels should be set to at least one higher than you set in the Fraud Alert for the Endpoint in Skyetel.

   • Only outbound calls are counted towards this maximum.
     

10. Asterisk Trunk Dial Options should never be changed from System
    

11. Continue if Busy can be left at No for the Skyetel_Inbound trunk as this only applies if the trunk is used in an Outbound Route
    

12. Disable Trunk must be set to No or the system will not use the trunk.
    

13. Monitor Trunk Failures is an advanced setting and does not mean what most people think. Leave it set to No.
    

14. Moving on to the Dialed Number Manipulation Rules tab, is easy as you will leave this all blank.

    • You do not do anything on this tab for a trunk, unless there are special circumstances.
    • More detail on this will be discussed in the Outbound Route setup.
      

15 On to the pjsip Settings tab, which has three sub tabs.

16. The General sub tab is where you tell the trunk what it is connecting to. You will leave Username, Auth username, and Secret empty.
    

17. Authentication will be changed to None, which cause the priors three fields to become disabled.
    

18. Registration is also set to None. This also gets changed automatically when Authentication was changed.
    

19. Language Code should be left on Default.

    • Trunk specific languages is an advanced task.
      

20. Sip Server will be set to in.skyetel.com

    • Prior to October 8, 2021 this was na.skyetel.com
      

21. SIP Server Port is 5060.

    • This is Skyetel's listening SIP port, not yours.
      

22. Context should be changed to from-pstn-e164-us, which matches the fact that our phone number in Skyetel will be sent in the E.164 standard.
    

23. Transport defaults to 0.0.0.0-udp and should be left that way.
    

24. Moving to the Advanced sub tab, most settings will be left at their default values.
    

25. Match (Permit) is the first that needs changed.

    • On this Skyetel_Inbound route, we need to enter the full list of IP addresses or CIDR blocks that Skyetel could ever send a call from. Skyetel maintains that list on the Skyetel IP Addresses article.
    • You need to add the 4 Standard IP addresses that in.skyetel.com resolves to, as well as the list of Emergency IPs
      
    • This must be added as a single comma separated line, here is a copy/paste version for you.

52.41.52.34/32,52.60.138.31/32,50.17.48.216/32,52.8.201.128/32,44.199.94.192/27,3.144.141.64/27,3.101.177.224/27,35.85.225.96/27,3.99.65.224/27,35.215.45.65,35.209.126.210,35.212.222.157

26. Trust RPID/PAI should be changed to Yes
    

27. Send RDPI/PAI should be changed to Both
    

28. Inband Progress, Direct Media, Rewrite Contact, and RTP Symmetric should be the correct value by default, but verify that they are No, No, No, and Yes respectively.
    

29. Final tab! Go to the Codecs tab and ensure that ulaw is in the list. By default it should be first.

    • Updating codecs is an advanced task not covered here.
      

30. Click on the Submit button.
    

31. Click on the Apply Config button.
    

32. You will see your trunk listed in the list and show as Enabled. Inbound calls will now hit your PBX.
    

Setup a number to route to your PBX

1. Expand Phone Numbers
2. Click on either Local Numbers or Toll Free Numbers depending on what type of number you bought or ported in.
   • You will see a list of the phone numbers of that type that you own through Skyetel.
3. Click on the gear to the far right to edit the number
   

Number Editing

• There are up to 5 tabs of information you need to edit for each number, depending on what feature you need or want for a number. This guide will only be covering the General tab.
  

The General tab is where you choose how a number routes and what you want it to do in a failure to route to that selection.

1. Phone Number is obvious, and not editable. This is the phone number you are editing.
   

2. SIP Format is the way that Skyetel will deliver calls to this number, to your PBX.

   • By default Skyetel uses an 11 digit number format familiar to people in North America. This is called the NANPA or NANP format. I always recommend to change this to the E.164 format as it is an international standard, either format can work for FreePBX.
   • This guide and others related to FreePBX will assume the E.164 format.
     

3. Call Routing is where you choose your normal destination for calls. In most cases, you will be using Endpoint Group.

   • There are use cases for the other options, but those are not covered in this guide.
     

4. Once you select Endpoint Group in Call Routing you get two new options inserted before Call Failure Routing.
   

5. Endpoint Group is here you select the Endpoint Group you previously created.

   • I have other Groups (obfuscated), you should only have the one at this point, Select it.
     

6. Endpoint Choice will not be used by most users as they only have one Endpoint in their Endpoint Group.

   • But if you have more than one, you can chose how this number chooses one. The default is By priority, and the priority is set in the Endpoint Group.
     

7. Call Failure Routing is what you want to happen to the call is Skyetel cannot reach your PBX. Leave it at the default until you go read the guide on this feature.
   

8. Tenant is an advanced need. If you have these set up, then you would select it here.
   

9. Description is useful when you have a lot of phone numbers. It lets you know at a glance what the purpose of that number is. If you only have one or two numbers, it is less important.
   

10. Click Save and the number will begin routing to your PBX. Typically within seconds, but it can take up to a minute to fully propagate.

Setting up a FreePBX or PBXact system to use Skyetel is a very easy process, but does have a few steps that can confuse the inexperienced.

1. Create an Endpoint Group in Skyetel to point to your PBX.
2. Set the phone number(s) in your Skyetel portal to route to your PBX.
3. Create the Skyetel Inbound Trunk
4. Create the Skyetel Outbound Trunk for North America
5. Create the Skyetel Outbound Trunk for International

1. Log in and expand Endpoints.
2. Click on Endpoint Groups.
3. Click on Add Endpoint Group.
   

Enter your PBX information, this creates an Endpoint Group and the first Endpoint inside the group.

1. Name is the name you will see for the endpoint group.
2. IP Address is the public IP address of your PBX.
3. Description is the description of the actual endpoint.
4. Click Add to finish.
   

Now you want to click on Endpoint Health to see your new group and set some alerts for it.

• Note, it will show your system down. This is because you have not yet set anything up in FreePBX to listen for it. One step at a time.
  

Click on Set under Fraud Alerts

1. Enter a value that is equal to the maximum number of simultaneous call you expect to have.
   • For example, if you used to have six lines from AT&T or Spectrum, then put 6 here to start.
2. Read what is highlighted!! It is not going to be Skyetel's fault if you have a bad actor on your system. It is your responsibility to keep an eye on your system.
3. Click Save
   

Now click on the toggle to enable uptime alerts.

• This is useful as Skyetel will then send you an email and text message (if you have a number in your profile) when two or more regions cannot reach your Endpoint.
  • It will use the Description from the Endpoint as set above. So make sure you populate that to something you understand.
    

Finally click on View more to see some advanced features.

• For now, the only thing to do is click in the circle in front of Network QOS. This will have Skyetel's system being to collect metrics from the "Hello, are you alive?" packets it sends to your Endpoint.
• There is a second section on this page for SNMP Metrics, but that is an advanced topic that will have its own guide.
  

Once it has been enabled and your PBX has been on line for a while, you will begin to see very useful data on this page. Here is a sample from a different Endpoint.

This will be different for every organization and has to be based on what works best for the business.

You have two choices.

1. Host it on your internal virtualization infrastructure
2. Host it on a public virtualization platform

Can it be installed on a physical appliance? Sure, but you would not want to run your main line of business application on random hardware, so why would you run your phone system that way?

You have to base this decision on a number of things.
Below is a general guideline to think about.

• Do you have a solid virtualization platform in place locally
  • if no, make the PBX hosted
  • if yes, make the PBX hosted or local
• Do you have more than one site needing to register phone to this PBX
  • make the PBX hosted
• Do you have solid backups locally
  • if no, make the PBX hosted
  • if yes, make the PBX hosted or local
• Do you have solid internet for the total concurrent call volume and well as extension to extension volume
  • if yes, make the PBX hosted
  • if no, make the PBX local
• What Needs to survive the most when the internet goes down
  • extension to extension calling
    • make the PBX local
  • inbound customer calls getting handled
    • make the PBX hosted

There are always more things to consider, but those are the key factors.

Each of them need thought about without emotion to determine what is best for the business.

• Initial Discovery
• Decide where you want your PBX
• Decide where to get your phone service from
  • Estimating costs

Installation
Once you know have worked through the items above, you are ready to begin installing FreePBX.

For this guide, we will use Vultr to host the system.
There are only a few differences in steps 2 and 3 if you do not use Vultr.
The rest of the guide is the same, irregardless of where you host the system.

1. Creating a FreePBX Instance on Vultr
2. ISO Installation
3. Standard Setup Part 1: Command Line
4. Standard Setup Part 2: Initial GUI Wizard
5. Configure the Firewall
6. System Admin setup
7. Create your first exentsions
8. Trunk setup
9. Conference setup
10. Ring group setup
11. Creating system recordings
12. IVR setup
13. Using time groups and time conditions
14. Caller ID setup
15. Inbound call routing
16. Outbound call routing

Setting up Desk Phones

• With Endpoint Manager
• Manually - git backed

Because of that, this guide will generalize some terms where possible.

Screens may differ after an update.

1. Upon first log in to the web interface, you will be presented with this screen to create the initial admin user account.
   

2. Create a username and secure password.
   

3. Enter an email address for the user. This can be changed later if needed.
   

4. Give the system a name. This will used in various system emails that are generated, as well as in voicemail notification emails.
   

5. Change the update settings as desired.
   We recommend not using automatic updates, but instead actively updating things monthly. Enable email notification, in order to be made aware of anything important.
   Finally, set it to check daily in the morning. You don't need yet another system email coming in over night when sleeping.
   

6. Click Setup system
   

7. The system will apply the settings and you will be presented with the standard FreePBX home screen. Click on FreePBX Administration.
   

8. Enter your just created administrator log in and click continue.
   

9. You will be asked to activate your system. There is no cost to it and you will want your system activated, but this screen has been intermittently buggy. Click Skip, you will activate it later.
   

10. Now you will get a couple screens of advertisement for Sangoma owned products. Click skip on each of them. If you want the product you can order it later.
    
    

11. Set your default locale information as appropriate for your needs.
    

12. The red Apply Config button will appear at the top, ignore it for now.
    

13. The system will now ask you to setup the built in firewall. We alays recommend this be enabled. Even if your system if behind a hardware firewall and NAT. Click continue.
    

14. Click Next.
    

15. Click Yes here, or you can lock yourself out during the initial setup. This will be modified later.
    

16. Click No here, even if you are on a local LAN that you want trusted. For now, you only care that the computer you are doing the setup from is allowed access.
    

17. Click No to the responsive firewall. This is a very useful tool depending on your needs. It is something to configure later, not during initial setup.
    

18. Click Yes here, to let the system correctly setup your Asterisk settings. They can be changed later, but this is the easiest way to get it right for most people.
    

19. If your browser pops up a warning about resending, click resend.
    

20. At this point the FreePBX dashboard will load.
    

21. Now click the Apply Config button.
    

22. You will see a reloading screen.
    

23. You have completed the Initial GUI wizard. Welcome to FreePBX.

They do this because once the physical phones are setup, they almost never make changes often that require learning how to use and maintain the endpoints via EPM.

EPM is a solid product for a very reasonable cost. But like all things, the cost must be weighed against the benefit.

For customers that do not use EPM, we setup a private git repository to easily maintain things. To automate that, the PBX needs to use key based SSH.

Everything FreePBX does is owned by the user asterisk so you need to create a keypair under that user.

1. Log in to your PBX console via ssh as yourself.
   ssh pbx.domain.com or ssh yourusername@pbx.domain.com

2. Switch to the asterisk user.
   sudo su asterisk

3. Create the ssh keypair using modern strong methods.
   ssh-keygen -o -t ed25519 -C "FreePBX Asterisk User"

4. It will ask what directory, to store the key, press enter.
   The default is what you want: /home/asterisk/.ssh

5. It will ask for a passphrase, do not enter anything. This is for automation, there will be no user to enter the passphrase every time the key is used.

6. It will ask to confirm the passphrase, press enter again.

7. It will then display the key fingerprint and ascii art.
   

Because of that, this guide will generalize some terms where possible.

Screens may differ after an update.

If your method for accessing the console does not allow you to copy and paste into the console, then we strongly recommend that you use SSH, as the root user, for this initial setup.

This process requires that you have created a SSH keypair for secure login to Linux systems.

If you need instruction for that see: Creating an ed25519 key in Windows 10

1. However you installed FreePBX from the ISO, when that installation completes, the console screen should be waiting for a log in.

   1. The only login available immediately after installation will be the root user.
   2. You can log in to the console or via SSH. Be aware of the notice above about copy and paste.
      1. On the Console, enter root for the login and hit enter.
      2. Enter the root password you set during installation, the password will not be echoed back, then press enter.
         
      3. Or log in initially via SSH.
         
   3. Either way you will be greeted by the standard FreePBX message of the day (MOTD).
      

2. The first thing to do is to secure SSH. This is accomplished by:

   1. Creating a non-root user with administrator rights (sudo).
   2. Disabling the ability of the root user to log with the SSH protocol.
   3. Disabling the ability to log in with a password.
   4. We have created a script to handle this initial root setup process. If you want to do it manually, please read the script to see how we did it.

3. Execute this command to download the script from our public GitLab with this command:
   wget https://gitlab.com/bundyassociates/freepbx-scripts/setup-scripts/-/raw/master/root_setup.sh
   

4. Set the downloaded script to be executable: chmod +x root_setup.sh
   

5. Execute the script: ./root_setup.sh

   1. It will prompt for your SSH username
      
   2. Then tell you to log out.
      

6. Logout of the root session by entering: exit

7. Log in as the user you just created. You will be forced to update your password.

   1. Your current password is: ChangeMe
   2. Your new password can be whatever you want, try to be a bit secure about it.
   3. You will enter ChangeMe once to log in. Then again as the "current password" to be changed.
   4. It will automatically log you out after changing your password.
      

8. Before logging back in, you need to copy your SSH public key to the system.
   The command to do that is: ssh-copy-id USERNAME@demo.bundystl.com
   
   I have multiple keys on my system, so I need to specify the key I want to use with the -i option.

9. Log in via SSH again, it will not ask for a password.
   

10. Execute, with sudo, the setup script that was pre-downloaded during the root setup.
    sudo ./setup.sh

11. You will be prompted for your password in order to execute the commands in the script with sudo access.
    

12. Get a coffee, this will take a while to finish.
    

    1. Especially if the updates include a new Linux kernel.
       

13. When completed, it will tell you to reboot and go to the web interface to complete the setup.
    

14. Reboot the system as instructed
    sudo reboot
    

15. Wait for the reboot to complete and then go to the web interface as previously instructed to complete the setup.

    1. You know the reboot is complete when the console screen returns to this.
       
    2. Be prepared for warnings about insecure connections the the web interface. Part of the GUI process will be to create a valid SSL certificate.
       

Because of that, this guide will generalize some terms where possible.

Screens may differ after an update.

1. Once you boot to the ISO file, you will be presented with a screen to select what version of Asterisk you want to install.
   

2. For most companies, there is no reason to stay back on an LTS version, I always recommend using the current release. That is Asterisk 17 as of the writing of this guide. So select that version with the arrow keys on the keyboard and hit enter.
   

3. On the next screen, leave it on Output to VGA and hit enter.
   

4. Hit enter again on the next screen, confirming what you previously chose.
   

5. You will now see various Linux boot screens go past.
   
   
   
   

6. When you see this screen, click on ROOT PASSWORD to set the Linux root user password.
   

7. Enter the password twice, and then click done on the top left.
   

8. It will show that the root password has been set.
   

9. Now wait for the reboot button to appear on the bottom right. Depending on the resources of the system you are installing on, this can take up to 10 minutes. Once it appears, click reboot.
   

10. Your system should boot to the Linux login prompt.
    If your system does not automatically eject the installation media, Vultr instances do not, you will get the initial setup screen again. Manually remove the installation media and reboot again.
    

11. The FreePBX ISO Installation is complete. You can now continue with the FreePBX Standard Setup Part 1: Command Line guide.