There are several 'port scanning' tools that probe IP address ranges with SIP invites messages and build up a list of 200 OK responses. This way they determine SIP capable devices and can then concentrate on determining dial plans. .
To prevent the unauthorised SIP and H323 calls, the simplest fix is to add an access list that blocks access via UDP port 5060 and TCP port 1720/5060 on any public facing interface.
In terms of basic security for a VOIP router, there are some well known security holes that can be easily exploited -
Â
   Connection of an ethernet interface to the public internet without any form of firewalling or access blocking
   Basic passwords (do you know how many people use 'cisco'!) used for login access
Using Telnet for access instead of SSH - password as sent in the clear with telnet
   Using a destination pattern of '.T' for outgoing POTS dial peers
Â
There are three simple way of blocking SIP or H323 unauthorised traffic. Some of these recommendations include blocking MGCP port numbers as well, but this is generally less of of a risk because of the complex external call processing required for MGCP control -
Â
1) Using standard access lists and applying them to the interface Â
Â
access-list 128 deny tcp any eq 5060 any
access-list 128 deny tcp any any eq 5060
access-list 128 deny udp any eq 5060 any
access-list 128 deny udp any any eq 5060
access-list 128 deny tcp any eq 1720 any
access-list 128 deny tcp any any eq 1720
access-list 128 permit ip any any
Â
interface FastEthernet 0/0Â
 ip access-group 128 inÂ
Â
2) Turning off SIP transport.
Â
sip-ua
 no transport upd
 no transport tcp
Â
(When applying this workaround to devices that are processing MGCP or H.323 calls, the device will not allow SIP processing to stop while active calls are being processed. As a result, the workaround should be implemented during a maintenance period when active calls can be stopped)
Â
3) Using control plane policing and policy maps
Â
access-list 111 deny tcp any any eq 5060
access-list 111 deny tcp any any eq 5061
access-list 111 deny udp any any eq 5060
access-list 111 deny udp any any eq 5061
access-list 111 deny udp any any eq 2427
access-list 111 deny tcp any any eq 1720
access-list 111 deny tcp any any eq 11720
access-list 111 deny udp any any range 16384 32767
access-list 111 permit ip any any
Â
class-map match-all drop-voice-class
 match access-group 111
policy-map drop-voice-traffic
 class drop-voice-class
 drop
control-plane
 service-policy input drop-voice-traffic
You can also use some of the other CME call blocking features described in the other posts. The best solution is to prevent the unauthorised trafffic from reaching the gateway in the first place.
