Several extensions getting forwarded to mystery external number from auto attendant

[ChuckHaynes]

Greeetings,

CUCM 10.5.2

CUC 10.5.2

We have several extensions that are getting forwarded to a mysterious external number from the auto attendant.

If you call the extension internally (4-digit), it works correctly.

If you call the full extension DID (10-digit), it works correctly, including a Remote Destination Profile.

If you call the main company number and reach the auto attendant, then enter the 4-digit extension, the call gets forwarded to an unknown external number (and that mailbox is full).

I am trying to determine where this forwarding is calling from and disable it. I checked the phone extension itself and the RDP. I also searched for all routes containing the mystery number in CUCM, but don't see it anywhere.

Does anyone have any suggestions?

Thanks

[Roger Kallberg]

Check what happens in Unity with port monitoring in RTMT. There you should be able to see how the call egress from your auto attendant.

[ChuckHaynes]

Thank you for the suggestion. For some reason, I didn't realize that RTMT also worked with Unity.

I have performed the test and captured two images. The first capture is when I dialed the main number. The second capture is when I dialed the 4-digit extension. There are no other outputs shown and then the call is transferred externally.

[ChuckHaynes]

Second image.

[ChuckHaynes]

It doesn't appear as if either of those pictures are very helpful. Is there a way to search CUCM and CUC for the mysterious external number to see where it is referenced?

[ChuckHaynes · Accepted solution]

This has been resolved. Someone had went into Unity, under Transfer Rules and manually forwarded to an 11-digit number (this makes no sense because it wasn't a phone number). However, the first 4-digits of the 11-digit number matched another 4-digit extension that we had at a remote site. Then, for a separate reason (unrelated), someone had all calls to that remote extension forwarded to a mobile phone. So calls from the Auto Attendant to the specific number were making their way around to the mobile device!

[ChuckHaynes]

I found and ran this command from the CLI.

run sql select d.name as device, n.dnorpattern, cfd.cfadestination from device as d inner join devicenumplanmap as dmap on dmap.fkdevice=d.pkid inner join numplan as n on dmap.fknumplan=n.pkid inner join callforwarddynamic as cfd on cfd.fknumplan=n.pkid where (cfd.cfadestination!='')

It lists all numbers that are being forwarded. I found the mystery number being forwarded to from a Front Gate phone at one of our remote locations.

Now the question is, why are some of our Corporate extensions also being forwarded to this number, ONLY when the auto attendant comes into play...?