ip address trusted list

[johnlloyd_13]

hi,

i'm not a voice expert so forgive me for my question.

i'm securing our voice router from toll fraud using the 'ip address trusted list'

my question are:

1. do i only add our CUCM IP address under the voice service voip 'ip address trusted list'?

2. do i need to add here the SIP provider public IP (which i found under 'voice class uri') and customer IP (from 'dial-peer session target')

3. will the VOIP or SIP service break or have an outage if i forgot to add any SIP public IP or downstream customer private IP (i.e. their CUBE) 

[Roger Kallberg]

That list would have the IPs of your CUCMs and any IP(s) that your SIP trunk service provider will source traffic from.

[johnlloyd_13]

hi roger,

how about IP address found on 'dial peer session target' command?

do i add them as well?

[Ayodeji Okanlawon]

Hi,

Any address in the session target will be automatically added, hence you dont need to add them. This will include IP address of your CUCM servers as well as IP address of your ITSP that is configured as a sessison target.

NB: You may need to add other IPs from your ITSP as they usually send requests from multiple IP address. You should just ask them for the subnet of their Signalling IPs and add the whole subnet to be safe

[johnlloyd_13]

hi,

any good show commands to view incoming IP, voice session/traffic, etc so i can capture the IPs needed to be added?

i also saw some config with and without the subnet mask. which format is 'best practice'?

voice service voip
ip address trusted list
ipv4 192.168.1.100 255.255.255.255
ipv4 10.1.1.10

[TONY SMITH]

Without a subnet mask it just trusts that one host.  Using a mask you can specify a range.  My understanding is that it's the signalling addresses that need to be trusted, not the media endpoints.  Maybe someone can confirm.  

If you have call history enabled you can see the signalling IP addresses that have been in use with the show command ..

sh call hist voice | i RemoteSignallingIPAddress