Can I call from FXS1 port to FXS2 port?

Yes, they can communicate with each other by dialing the respective extension number. Both FXS ports need a valid sip account registered on the server. Route call automatically and transparently to PSTN line according to user configuration

Can we prevent random calls from any IP by limiting to accept calls from the SIP server only?

Yes. A user can enable a feature called "Allow Incoming SIP Messages from SIP Proxy Only". This field can be found under the FXS port configuration page in the web-gui.

Can you explain the use of 'PSTN pass through' and 'FXO port'?

PSTN Pass through port:
What it can do:
Local manual switching between PSTN and IP mode on a per call basis.
User can switch to PSTN line by pressing *00 (or the configured strings) for each call before they are placed. The device will revert back to the default IP mode once the phone is hung up.
It can allow a PSTN call to ring/call the phone connected to the FXS port.
It also serves as a life line in case of power outage.

What it CANNOT do:
Terminate a VoIP call into the PSTN port.
Allow a call from PSTN to route other VoIP devices (different from the FXS phone) over the IP network.
Automatically route calls made by the local user to PSTN line.

FXO port:
It can support all the functions of a PSTN pass through plus:

Terminate a VoIP call into the PSTN port
Allow a PSTN call to call either the FXS phone or other VoIP devices over the IP network
Route call automatically and transparently to PSTN line according to user configuration

Does Grandstream allow HTTPS Provisioning with Grandstream Internal Certificate?

Yes. Grandstream allows HTTPS provisioning with Grandstream's very own certificate. If the server is configured to require a certificate for authentication, our devices can send an internal certificate that is flashed on all Grandstream devices. If you would like to use this feature please get in contact with our Grandstream Support for the GS Certificate.
Note: This is not the same as the "HTTP/HTTPS" user/password, which in this case this option is for authentication only once the connection has been established.

How can I disable hook/flash?

On the Advanced Settings page, there is a field On-Hook Threshold. One on the selections for this field is 'Hook/Flash OFF', this option will disable hook/flash on the phone connected to the ATA. To switch to a second channel, press FLASH button on the phone, instead of doing hook/flash. Note: This feature is not available on older hardware revision models.

How do I perform attend transfer?

Attend Transfer from A to B through HT:

A calls HT
HT talks to A
HT presses FLASH or does hook/flash to get new dialtone.
A is on Hold
HT calls B
HT talks to B
HT hangs up to perform the Attend Transfer.
A and B are in call now.

How do I setup a 3-way conference call?

Setting up a 3-way conference calling between parties using an HT, A and B is easy:

HT calls A
HT talks to A
HT presses FLASH or hook/flash and gets a new dialtone
A is on Hold
HT dials *23 and number for B
HT talks to B
HT presses FLASH or hook/flash to initiate the 3-way calling

What is a dial-plan and how do I configure it?

The dial-plan is a set of rules that governs the call-routing behavior of a device. When a user dials a sequence of number the device will refer to the rules in the dial-plan in order to determine how best to connect the call. Users can refer to the user manual for more details on how to configure the dial-plan. All user manual for your products can be found HERE.