Asterisk and FreePBX Phone Systems: Support, Upgrades and When to Move On
Asterisk is the open-source software that has powered business phone systems since 1999, and a large number of small and mid-sized businesses still run it, usually behind a FreePBX interface, on a server in the office. We have supported Asterisk-based systems for more than two decades and still install and maintain them, and this article, which replaces one written in 2012, is our current view: why businesses keep Asterisk, the version, operating-system and security problems that catch up with older installs, what our support covers, and an honest guide to when to keep the system and when to move to a hosted one. For the broader picture of business telephony, start with what VoIP is and whether it is right for your business.
What Asterisk and FreePBX are
Asterisk is the engine: the software that registers phones, connects calls, runs voicemail, queues, auto attendants and conferencing, and talks to the telephone network through SIP trunks or telephony cards. It is developed by Sangoma and a large open-source community. FreePBX is the most common way to run it: a web interface and a packaged distribution that turn Asterisk’s configuration files into menus a technician can manage. Sangoma sells commercial modules, support and PBXact appliances on top of FreePBX, and there are other Asterisk-based products and forks. When a business says it has “an Asterisk system”, it almost always means FreePBX on a server or appliance, connected to a SIP provider, with desk phones from Yealink, Sangoma or Polycom.
Why businesses keep it
- No per-user fees. A hosted system charges per seat every month; an Asterisk system costs a server, a trunk and support, however many phones hang off it. Past a few dozen handsets, the arithmetic favours Asterisk.
- Flexibility. Call flows, interactive menus, time conditions, paging, door phones, overhead speakers, integrations with the practice-management or dispatch system: Asterisk does things hosted systems cannot or will not.
- Ownership and control. The system is yours, in your building or in a data center you chose, with call recordings and data under your control.
- Works with anything. Any SIP trunk, any standards-based phone, analog lines and devices through gateways, and links to other systems.
- Existing investment. A working system with a hundred phones and years of tuning is worth keeping current rather than replacing on principle.
What catches up with old installs
The Asterisk systems that give us trouble are not the ones that are old; they are the ones that were installed and never touched. Four things accumulate.
- Versions. Asterisk ships long-term-support releases that receive fixes for about four years and security fixes for a year or so beyond. Versions 16 and 18 are past support; 20 receives only security fixes; 22 is the current long-term release. FreePBX has its own version line. Anything older than the current supported releases needs an upgrade plan.
- The operating system. Most FreePBX installs from the last decade run on a CentOS 7 based distribution, and CentOS 7 reached the end of its life in June 2024. The current FreePBX release runs on Debian, and moving to it is a migration rather than an update. This is the single most common reason we are called about an Asterisk system today.
- Hardware. Telephony cards, analog gateways and the server itself age out; a ten-year-old server running the phones is the same risk as a ten-year-old server running anything else. The fix is usually to run the PBX as a virtual machine, in the office or in our data center.
- Security. SIP or the web interface exposed to the internet, extension passwords that match the extension number, international dialling left open, no intrusion protection, and no updates. Toll fraud, where criminals register to your PBX and pump international calls through it overnight, still produces four-figure phone bills for businesses that left these open. Our article on outdated firewalls covers the perimeter side.
Two regulatory points also apply to any multi-line system, Asterisk included: Kari’s Law and RAY BAUM’s Act require direct 911 dialling without a prefix and a dispatchable location sent with the call, and the retirement of copper lines means older systems still on analog or PRI trunks need SIP trunking before the carrier disconnects them.
What our Asterisk support covers
| Service | What it includes |
|---|---|
| Assessment | Versions, operating system, trunks, call flows, phones, hardware, backups and security, written up with a plan and prices, whether you keep the system or not |
| Upgrades and migrations | Moving to the current Asterisk and FreePBX releases on a supported operating system, usually as a fresh virtual machine with the configuration, voicemail and recordings migrated and tested |
| Security hardening | Firewall and VPN placement, intrusion protection, strong extension credentials, international and after-hours dialling limits, admin interface locked down, update schedule |
| SIP trunking and number porting | Replacing analog or PRI trunks with SIP, porting numbers, configuring failover and emergency calling that complies with current law |
| Hosting | Running the PBX as a virtual machine in our Minneapolis data center on redundant power, monitored around the clock, with the office connected over a VPN |
| Day-to-day changes | Extensions, menus, time conditions, queues, paging, phone provisioning and firmware, integrations, call recording and reporting |
| Monitoring and backups | Trunk registration, call quality, disk and service health, and nightly configuration backups kept off the server |
| Documentation | The configuration, trunks, call flows and credentials written down and belonging to you |
Most of the Asterisk systems we support were installed by someone else, and the assessment is the first step in every case. Support is available by the hour for businesses that only need occasional help, and as part of a managed IT plan for those that want the phone system watched along with everything else. Our phone systems page covers what we install and support.
Keep it or move on?
| Keeping Asterisk makes sense when | A hosted system makes sense when |
|---|---|
| You have many handsets in one or two buildings and the per-seat cost of hosting would be significant | You have a small office, several locations or many remote staff |
| Your call flows, integrations or devices are unusual and the system does them well | Your needs are standard: auto attendant, voicemail to email, mobile app, a few queues |
| You have someone to maintain it, in house or us, and a budget for upgrades every few years | Nobody has touched the system in years and nobody wants to |
| You want the system and its data under your control | You would rather pay monthly and never think about versions again |
| The system is on a supported version and supported hardware, or can be brought there at reasonable cost | The version, operating system and hardware are all past support and the upgrade is a rebuild anyway |
When a business moves on, the path is usually a hosted system or Microsoft Teams Phone, with the numbers ported and the existing SIP phones re-provisioned where the models allow it. We run both, and we will say which fits rather than defend the system we happen to know well. The phone system quote tool gives a monthly figure for a hosted system, which is the number to compare against the cost of keeping Asterisk current.
What it costs to keep Asterisk current
There is no per-seat licence. The costs are a server or virtual machine, a SIP trunk priced per channel or per minute, phones when they need replacing, and support: an assessment and upgrade project every few years, plus hours or a monthly plan for changes and monitoring. For a business with fifty or more phones that arithmetic usually beats a hosted system by a wide margin; for a business with eight, it usually does not. The pricing calculator gives the monthly figure for a managed plan that includes the phone system, and an assessment tells you the upgrade cost for your specific install.
Free tools from OAC Technology
- Phone system quote tool: a monthly figure for a hosted phone system
- Managed services pricing calculator: a monthly figure for managed IT, in about a minute
- IT glossary: the terms in this article, explained plainly
Common questions
Is Asterisk still supported and maintained?
Yes. Asterisk is actively developed by Sangoma and a large open-source community, with long-term-support releases that receive fixes for several years each. What is not supported is the old version on many business servers; anything older than the current long-term-support releases needs an upgrade plan.
Is FreePBX free?
The FreePBX software is free and open source. Sangoma sells commercial modules, support and its PBXact appliances on top of it, and the SIP trunk, the server and someone to maintain the system all cost money. Free to license is not the same as free to run, but for a business with many handsets it is often the cheapest system per phone.
Can Asterisk run as a virtual machine or in a data center?
Yes, and it should. A modern Asterisk or FreePBX system runs well as a virtual machine, which makes backups and hardware replacement simple. We host client PBX systems as virtual machines in our Minneapolis data center, and a PBX moved out of an office closet is usually more reliable for it.
Is an Asterisk system secure?
It is as secure as its configuration and updates. The common failures are the same in every case we have cleaned up: SIP or the admin interface exposed to the internet, weak extension passwords, international dialling left open, and years without updates. A hardened, patched system behind a firewall with fraud limits is safe to run.
Can we keep our phones if we change systems?
Usually. Most SIP desk phones from Yealink, Polycom, Sangoma and others can be re-provisioned to a new Asterisk system or to a hosted service. We check the models before proposing anything, because it changes the cost of a move considerably.
Do you support Asterisk systems you did not install?
Yes. Most of the Asterisk and FreePBX systems we support were built by someone else, often years ago and undocumented. The first step is an assessment that records versions, trunks, call flows, hardware and risks, and produces a plan you can act on whether or not you keep the system.
Talk to us
If you run an Asterisk or FreePBX system and are not sure what version it is on, whether it is secure, or whether to keep it, we will assess it and give you a written plan with prices. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
