PBX / UCM

For: IT teams with an on-premise PBX (Grandstream UCM or equivalent).

  • Calls through AstraDial ride your own SIP trunk, and are logged and recorded.
  • Your desk phones and your carrier trunk keep working exactly as they do today.

Values we will supply

Fields shown as <...> are issued by AstraDial during onboarding. The pre-shared key and trunk password are credentials — we send those over a secure channel, separately from this guide, and ask that you keep them out of email and shared documents.

1. What gets connected

flowchart LR subgraph SITE["Your site"] direction TB TRUNK["Your SIP trunk<br/>your carrier, your numbers"] PBX["Your on-site PBX<br/>Grandstream UCM or equivalent"] PHONES["Your desk phones<br/>unchanged — stay local"] TRUNK --> PBX PBX --- PHONES end subgraph CLOUD["AstraDial cloud"] direction TB AD["AstraDial<br/>call logs · recordings"] APP["AstraDial app<br/>any PC, any network"] AD --- APP end PBX ==>|" encrypted tunnel"| AD classDef site fill:#eef2ff,stroke:#4f46e5,stroke-width:1px,color:#1e1b4b classDef cloud fill:#ecfdf5,stroke:#059669,stroke-width:1px,color:#064e3b classDef quiet fill:#f8fafc,stroke:#94a3b8,stroke-dasharray:4 3,color:#334155 class TRUNK,PBX site class AD,APP cloud class PHONES quiet

Two independent connections:

Connection Path Firewall change
PBX ↔ AstraDial trunk Encrypted WireGuard tunnel from your site router Outbound UDP only
AstraDial app on a PC Your normal internet connection (HTTPS/TLS) None — works off-site too

Nothing is exposed to the internet on your side

Your router dials out to us; we never dial in. No port forwarding, no public IP, no SIP open to the internet.

2. What appears in AstraDial

Call type In AstraDial call logs & recordings
Incoming on a number routed to AstraDial Yes
Outgoing placed from the AstraDial app Yes
Desk phone to desk phone on your PBX No
Desk phone dialling out directly on your own trunk No

Want a desk phone's outgoing calls recorded too? Tell us — its outbound route can point at the AstraDial trunk instead.

3. Step one — the secure tunnel

Terminate the tunnel on your site router — a Grandstream GWN managed in GDMS, or any WireGuard-capable router or Linux host.

a. Generate a key pair on your router. In GDMS: Settings → VPN → WireGuard → Add → One-Click Generation. Send us the public key only — never the private key.

b. We reply with your tunnel IP address and a pre-shared key.

c. Create the WireGuard interface:

Field Value
Name AstraDial
Status On
Interface / WAN the internet link this should use
Local IP address / mask <YOUR_TUNNEL_IP> / 32
Private key from One-Click Generation
MTU 1420

d. Add the peer — this points at AstraDial:

Field Value
Name AstraDial_cloud
Status On — the peer will not connect if this is left off
Public key <ASTRADIAL_PUBLIC_KEY>
Pre-shared key <YOUR_PRESHARED_KEY>
Allowed IP <ASTRADIAL_TUNNEL_IP> / 32
Endpoint address <ASTRADIAL_ENDPOINT_IP>
Endpoint port <ASTRADIAL_ENDPOINT_PORT>
Keep-alive interval 25

Save & Apply, then tell us. We confirm the tunnel is up from our side before you touch the PBX.

Two things worth knowing

Allowed IP must be the AstraDial tunnel IP, not the endpoint address — routers reject the tunnel otherwise.

If you later change which WAN interface the tunnel is bound to, GDMS deletes the peer automatically. You'll need to re-add section (d). Nothing else is affected and no keys change.

If you are not using a GWN router

Standard WireGuard client config:

[Interface]
PrivateKey = <generated on your side>
Address    = <YOUR_TUNNEL_IP>/32
MTU        = 1420

[Peer]
PublicKey           = <ASTRADIAL_PUBLIC_KEY>
PresharedKey        = <YOUR_PRESHARED_KEY>
Endpoint            = <ASTRADIAL_ENDPOINT_IP>:<ASTRADIAL_ENDPOINT_PORT>
AllowedIPs          = <ASTRADIAL_TUNNEL_IP>/32
PersistentKeepalive = 25

4. Step two — the SIP trunk on your PBX

Only after we confirm the tunnel is up

Do not start this step until AstraDial has confirmed the tunnel is handshaking.

Extension / Trunk → VoIP Trunks → Add (or edit the AstraDial trunk) → Edit

Field Value Why
SIP Server / Host <ASTRADIAL_TUNNEL_IP>
Port <ASTRADIAL_SIP_PORT>
Username <YOUR_TRUNK_USERNAME>
Password <YOUR_TRUNK_PASSWORD>
Transport UDP
Codec alaw only Indian carrier trunks carry alaw; other codecs cause negotiation failures
NAT Off Traffic is already inside the tunnel — NAT handling interferes
SIP ALG Off Same reason

Save → Apply Changes.

5. Step three — routing

Direction What to configure
Incoming For each number being routed to AstraDial, set its inbound route destination to the AstraDial trunk
Outgoing Add an outbound route matching the AstraDial extension range → AstraDial trunk. Leave every other route as it is.
  • We agree the list of numbers with you before this step.
  • Simultaneous calls: capped by what your carrier provisioned on your trunk.

6. Testing together

Have someone with a mobile phone ready. We run these with you:

  1. Incoming — call one of the routed numbers from a mobile. It should ring in AstraDial, with clear audio both ways.
  2. Outgoing — place a call from AstraDial to a mobile. It should show your landline number as the caller ID.
  3. Unaffected — make a normal internal call between two desk phones, confirming your existing system still works as before.

7. If anything goes wrong

  • Change the PBX trunk Host field back to its previous value → Save → Apply.
  • Takes about 10–30 seconds.
  • Desk phones and your carrier trunk are unaffected — they stay on their local routes throughout.

8. Before we schedule

  • PBX model and firmware version
  • Site router model, and whether it's managed in GDMS
  • Number of simultaneous calls your trunk supports
  • The list of numbers to route to AstraDial
  • Your router's WireGuard public key
  • A preferred low-traffic window for the change

AstraDial — IT and Ops · cats@astradial.com