[quote=“rdpierce”]Hey,
While I’ve got you here, is there a recommended method to perform trunk group access from certain extensions aside from passwording those trunks?
The thought being to permit certain extensions to, say, dial out while others can only dial SIP… seems like it should be a basic security feature, but the document seems to be mostly about auth codes and changing passwords.
Thanks! 
[/quote]
While I am sure there are many ways to do this, I would create a context and allow only those extensions that are in that context the ability to utilize that trunk. This is how I do it with my international traffic:
in sip.conf:
[1001]
type=friend
username="TJones"
secret=1001
qualify=500
host=dynamic
fromuser=“TJones Home” <8664231504>
dtmfmode=rfc2833
nat=yes ; This phone may be natted
canreinvite=no
disallow=all ; First disallow all codecs
allow=g729
callerid=“TJones Home” <8664231504>
context=ok_international
In my extensions.conf:
[ok_international]
include => international_calls_ok
include => normal_extensions
[normal_extensions]
include => pstn_outbound
include => system_extensions
[system_extensions]
include => no_international_calls
include => operator
include => conferences
etc, etc, etc
So in this case, this phone is dropped into the [ok_international] context any time he makes a call. That context includes access to the [international_calls_ok] context as well as all normal extensions. Regular extensions are placed into the [normal_extensions] context which includes system extensions and that includes the [no_international_calls] context which gives those folks a recording saying they are not allowed to make international calls.
Another way I do it on another system is a lot cleaner:
in sip.conf:
[rjs_linksys]
type = friend
host = dynamic
nat=yes
callerid = “Richard J. Sears” <2377>
secret = xxxxxxxxx
context = from-internal
mailbox = 2377@default
setvar=USERID=rjs
setvar=HOMEAREACODE=760 ; What is this users home area code…?
setvar=INTERNATIONAL=YES ; Is this user allowed to make international calls
accountcode = 18884 ; What is this users account code for tracking calls…?
Notice in this instance that I am setting a variable in the actual sip entry showing if international calls are allowed to be made by this extension. In my extensions.conf here is how I trap that info:
; For international calls, we have to check and see if the caller is allowed to
; make international calls or not.
exten => _011N.,1,GotoIf($["${INTERNATIONAL}" = “YES”]?international_ok:)
exten => _011N.,n,Answer
exten => _011N.,n,Wait,1
exten => _011N.,n,Playback(digium/pbx01_no_international_calls)
exten => _011N.,n,Playback(goodbye)
exten => _011N.,n,Macro(hangupcall)
exten => _011N.,n(international_ok),NoOp(International Call is ALLOWED from ${CALLERID} to ${EXTEN})
exten => _011N.,n,Macro(hangupcall)
In this particular case, you would replace the Macro(hangupcall) with whatever dial string you wanted.
If the variable is not set at all or set to NO they get a recordning letting them know they cannot make international calls.
All of this could be changed to allow access to an outside trunk or dialtone as opposed to internal only.
Hope this helps.
