http://www.voip-info.org/wiki/index.php?page=Asterisk+config+iax.conf

http://www.voip-info.org/wiki/view/Asterisk+iax+qualify

IAX2 is a VoIP protocol for connecting IP phones and IP PBXs together (or iPBXs to other iPBXs). It is Asterisk-specific. IAX2 has the excellent quality of functioning on a specific UDP port (4569) and being easy to get through firewalls…even via port forwarding.

We use phones with IAX2 support for remote extensions when the iPBX is not Internet-attached. It's just plain easier than fighting with SIP and NAT…the right tool for the job.

At the Asterisk console:

asterisk -vvvvvvvvvvvr

iax2 set debug on

If you see an error something like:

Rx-Frame Retry[ No] -- OSeqno: 000 ISeqno: 000 Type: IAX Subclass: REGREQ
Timestamp: 00003ms SCall: 00380 DCall: 00000 [192.168.20.116:4569]
USERNAME : 5556
REFRESH : 60 

Rx-Frame Retry[ No] -- OSeqno: 001 ISeqno: 001 Type: IAX Subclass: ACK
Timestamp: 00003ms SCall: 00380 DCall: 00001 [192.168.20.116:4569]

or:

[Dec  4 14:13:01] ERROR[11674]: chan_iax2.c:4909 handle_call_token: Call rejected, CallToken Support required. If unexpected, resolve by placing address 72.200.111.140 in the calltokenoptional list or setting user 201 requirecalltoken=no

Try adjusting the IAX2 extension definition:

requirecalltoken=auto

It is 'yes' by default enabling the new DoS protection feature.

This worked for Citel C-4110 IAX phone.

You can globally limit/disable the new feature like this:

For FreePBX, install IAX Settings module, then add to Other IAX Settings:

calltokenoptional = 0.0.0.0/0.0.0.0
maxcallnumbers = 16382

(or modify /etc/asterisk/iax_general_custom.conf)

You can limit the effect by using a more limited network definition such as:

192.168.1.0/255.255.255.0

IAX2 extensions just work.

[local-extensions]

exten => 110,1,Macro(tl-userexten,IAX2/110,110,)
exten => 110,hint,IAX2/110

[110]
qualify=no
vmexten=110
pickupgroup=1
secret=xxxxxxxxx
host=dynamic
username=110
callerid=[[Test]] User <110>
subscribecontext=local-extensions
callgroup=1
context=from-inside
type=friend
mailbox=110
disallow=all
allow=ulaw
allow=alaw
allow=gsm

[13]
deny=0.0.0.0/0.0.0.0
secret=xxxxxxxxxx
transfer=no
context=from-internal
host=dynamic
type=friend
port=4569
qualify=yes
dial=IAX2/13
accountcode=
mailbox=13@device
permit=0.0.0.0/0.0.0.0
requirecalltoken=auto
callerid=device <13>
setvar=REALCALLERIDNUM=13

[ext-local]

exten => 13,1,Macro(exten-vm,novm,13)
exten => 13,n,Goto(${IVR_CONTEXT},return,1)
exten => 13,hint,IAX2/13