SIP Signaling & Gateway Topology

The Asterisk 2 border routing architecture establishes a highly secure, resilient edge integration boundary. It sits between external telecommunication carriers, physical GSM gateway devices, and the internal Asterisk voice server cluster, managing signaling translation, routing loop resolution, and session state tracking.

Edge Signaling Ingress Topology

The following high-fidelity chart traces the path of an external call leg splitting into authenticated application channels:

graph LR
    %% Edge Boundary
    subgraph CarrierEdge["Public Telecommunications Network"]
        SIP_Trunk["Carrier SIP Trunks"]
        SIM_Racks["Dinstar GSM Hardware Arrays"]
    end

    %% Ingress Security & Routing Layer
    subgraph BorderProxy["Kamailio Security & Load Balancer"]
        WAF_SIP["SIP Validation Engine<br/>(ACL & Topology Hiding)"]
        Dispatcher["Dynamic Dispatcher Module<br/>(Weighted Round-Robin)"]
    end

    %% Voice Execution Core
    subgraph InternalCluster["Internal PBX Core Infrastructure"]
        Ast_NodeA["Asterisk Node Alpha<br/>(Active Media Loop)"]
        Ast_NodeB["Asterisk Node Beta<br/>(Active Media Loop)"]
    end

    %% State Control
    subgraph DataOrchestration["ASP.NET Core State Services"]
        AppBroker["AppFlow Execution Controller"]
        DB_Tel[("TelephonyDbContext<br/>(Gateway Channel State)")]
    end

    %% Signaling Pipelines
    SIP_Trunk ==>|"Inbound SIP INVITE"| WAF_SIP
    SIM_Racks ==>|"Inbound SIP INVITE<br/>(with Custom Hardware Headers)"| WAF_SIP
    
    WAF_SIP -->|"Validated Payload"| Dispatcher
    Dispatcher ==>|"UDP/TCP Handshake"| Ast_NodeA
    Dispatcher ==>|"UDP/TCP Handshake"| Ast_NodeB
    
    Ast_NodeA <==>|"ARI WebSocket Event Stream"| AppBroker
    Ast_NodeB <==>|"ARI WebSocket Event Stream"| AppBroker
    AppBroker ==>|"Sync Gateway Pool State"| DB_Tel

    %% Styling Matrix
    classDef edgeToken fill:#0f172a,stroke:#38bdf8,stroke-width:3px,color:#ffffff,rx:8px,ry:8px;
    classDef proxyToken fill:#1e293b,stroke:#a855f7,stroke-width:3px,color:#ffffff,rx:8px,ry:8px;
    classDef clusterToken fill:#312e81,stroke:#ec4899,stroke-width:3px,color:#ffffff,rx:8px,ry:8px;
    classDef stateToken fill:#065f46,stroke:#10b981,stroke-width:3px,color:#ffffff,rx:8px,ry:8px;

    class SIP_Trunk,SIM_Racks edgeToken;
    class WAF_SIP,Dispatcher proxyToken;
    class Ast_NodeA,Ast_NodeB clusterToken;
    class AppBroker,DB_Tel stateToken;

High-Density Routing Overview

1. Ingress Edge Security

All inbound signaling traffic arriving at the border routing layer must clear strict network access filters. The platform blocks anonymous direct IP scanning attempts and strips external transport metadata to enforce strict edge isolation.

2. Multi-Leg Session Orchestration

When an inbound call arrives, the edge proxies isolate the external network interaction as Leg A. Internal switching engines establish independent outgoing channels (Leg B) targeting designated internal application logic or automated IVR structures. This complete decoupling protects internal media IP addresses from external caller visibility.

3. Dynamic Gateway Failover

Outbound communications automatically utilize persistent health tables to select active, unblocked SIM channels. If an individual trunk or SIM gateway returns an error code, routing scripts immediately fall back to backup hardware paths.

# SIP Signaling & Gateway Topology

The **Asterisk 2** border routing architecture establishes a highly secure, resilient edge integration boundary. It sits between external telecommunication carriers, physical GSM gateway devices, and the internal Asterisk voice server cluster, managing signaling translation, routing loop resolution, and session state tracking.

---

## Edge Signaling Ingress Topology

The following high-fidelity chart traces the path of an external call leg splitting into authenticated application channels:

```mermaid
graph LR
    %% Edge Boundary
    subgraph CarrierEdge["Public Telecommunications Network"]
        SIP_Trunk["Carrier SIP Trunks"]
        SIM_Racks["Dinstar GSM Hardware Arrays"]
    end

%% Ingress Security & Routing Layer
 subgraph BorderProxy["Kamailio Security & Load Balancer"]
 WAF_SIP["SIP Validation Engine (ACL & Topology Hiding)"]
 Dispatcher["Dynamic Dispatcher Module (Weighted Round-Robin)"]
 end

%% Voice Execution Core
 subgraph InternalCluster["Internal PBX Core Infrastructure"]
 Ast_NodeA["Asterisk Node Alpha (Active Media Loop)"]
 Ast_NodeB["Asterisk Node Beta (Active Media Loop)"]
 end

%% State Control
 subgraph DataOrchestration["ASP.NET Core State Services"]
 AppBroker["AppFlow Execution Controller"]
 DB_Tel[("TelephonyDbContext (Gateway Channel State)")]
 end

%% Styling Matrix
    classDef edgeToken fill:#0f172a,stroke:#38bdf8,stroke-width:3px,color:#ffffff,rx:8px,ry:8px;
    classDef proxyToken fill:#1e293b,stroke:#a855f7,stroke-width:3px,color:#ffffff,rx:8px,ry:8px;
    classDef clusterToken fill:#312e81,stroke:#ec4899,stroke-width:3px,color:#ffffff,rx:8px,ry:8px;
    classDef stateToken fill:#065f46,stroke:#10b981,stroke-width:3px,color:#ffffff,rx:8px,ry:8px;

class SIP_Trunk,SIM_Racks edgeToken;
    class WAF_SIP,Dispatcher proxyToken;
    class Ast_NodeA,Ast_NodeB clusterToken;
    class AppBroker,DB_Tel stateToken;
```

---

## High-Density Routing Overview

### 1. Ingress Edge Security
All inbound signaling traffic arriving at the border routing layer must clear strict network access filters. The platform blocks anonymous direct IP scanning attempts and strips external transport metadata to enforce strict edge isolation.

### 2. Multi-Leg Session Orchestration
When an inbound call arrives, the edge proxies isolate the external network interaction as **Leg A**. Internal switching engines establish independent outgoing channels (**Leg B**) targeting designated internal application logic or automated IVR structures. This complete decoupling protects internal media IP addresses from external caller visibility.

### 3. Dynamic Gateway Failover
Outbound communications automatically utilize persistent health tables to select active, unblocked SIM channels. If an individual trunk or SIM gateway returns an error code, routing scripts immediately fall back to backup hardware paths.