Inter-Asterisk eXchange (IAX) is a communications protocol native to the Asterisk private branch exchange (PBX) software, and is supported by a few other softswitches, PBX systems, and softphones. It is used for transporting voice over IP telephony sessions between servers and to terminal devices.

The original IAX protocol is deprecated and has been superseded by a second version, commonly called IAX2. The IAX2 protocol was published as an informational (non-standards-track) RFC 5456 by discretion of the RFC Editor in February 2010.^[1]

Basic properties

IAX is a binary-encoded voice over Internet protocol (VoIP) that is used for streaming media, but is primarily designed for IP voice calls.

IAX uses a single User Datagram Protocol (UDP) data stream and port number, by default 4569, between endpoints for both session signaling and media payloads. This feature provides benefits for traversing network address translators at network boundaries, as it simplifies firewall configuration. Other VoIP protocols typically use independent channels for signaling and media, such as the Session Initiation Protocol (SIP), H.323, and the Media Gateway Control Protocol (MGCP), which carry media with the Real-time Transport Protocol (RTP).

IAX supports trunking, multiplexing channels over a single link. When trunking, data from multiple sessions are merged into a single stream of packets between two endpoints, reducing the IP overhead. This is advantageous in VoIP transmissions, in which IP headers use a large fraction of bandwidth.

IAX2 supports native encryption of both control and media streams using AES-128.

Origin

Both versions of the IAX protocol were created by Mark Spencer and much of the development was carried out in the Asterisk open-source community.

Goals

The primary goals for IAX are to minimize bandwidth used in media transmissions, and to provide native network address translation (NAT) transparency. It was intended to be easy to use behind firewalls.

Drawbacks

• Awkward extensibility: Due to the lack of a generic extension mechanism, new features have to be added in the protocol specification, which makes the protocol less flexible than H.323, SIP, and MGCP.
• Vulnerability: Older implementations of IAX2 were vulnerable to resource exhaustion DoS attack methods that are available to the public.^{[citation needed]} While no solutions existed for these issues, the best practices included limiting UDP port access to specific trusted IP addresses. Internet-facing IAX2 ports are considered vulnerable and should be monitored closely. The fuzzer used to detect these application vulnerabilities was posted on milw0rm.^[2] and is included in the VoIPer development tree.^[3] These issues were briefly mentioned in the IAX RFC 5456 on page 94. This flaw does not exist in up-to-date installations.^[4]