Toll Fraud

[Mike Buyarski]

I have been getting this constantly my log is filled with these:

1190852: Jul 26 09:39:54.058: %VOICE_IEC-3-GW: Application Framework Core: Internal Error (Toll fraud call rejected): IEC=1.1.228.3.31.0 on callID 110641 GUID=A690F976527511E681C3C621059668F7

how do I stop them from appearing. the only think I found when searching this was to make sure I have a trusted list which I do that only allows connection from the internal network.

voice service voip
 ip address trusted list
  ipv4 "internal subnet"
 allow-connections h323 to h323
 allow-connections h323 to sip
 allow-connections sip to h323
 allow-connections sip to sip
 fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none
 h323
  call service stop maintain-registration
 sip
  registrar server expires max 600 min 60
!

is there anything else I can do to stop those messages? FYI this is a MGCP connected router(2901), all calls come into it via POTS lines.

[ADAM CRISP]

Hi Mike,

You said your router receives calls on POTS lines only. Could the router be receiving VoIP calls that you're not aware of?

Adam

[Mike Buyarski]

Not aware of anything that would be trying internally, is there a debug I could run to possibly see where its coming from? "debug ccapi voice inout"?

[ADAM CRISP]

Yes, maybe I guess.

I'm a SIP guy, so have always liked debug ccsip messages - but obviously this won't show any h323 calls.

[Mike Buyarski]

well I did the debug ccsip messages and this is what I got. I removed our external IP but the other IP's don't know show they are.

[Mike Buyarski]

another one I got

[ADAM CRISP]

Hi Mike

You started the thread asking how to make the syslog messages go away. I suspect very much that the Toll fraud code is doing its job and you have a real issue with somebody trying to get your kit to do something.

The user agent of the originating calls is -> http://www.kaplansoft.com/sipcli/

There is evidence that the calls are originating from spoofed source addresses  - the 403 messages you are sending back are not acknowledged.

You're fix is to secure your network.....

Adam

[Mike Buyarski]

And what would be good things I need to do to secure the network more?

[ADAM CRISP]

Hi Mike,

I'm not sure it's possible to tell anybody how to secure their network without sitting down with them as a security consultant.

But you could start with the position that only Internet security devices should be connected to the Public Internet directly and those devices should be configured in a controlled manner.

So Is your router an Internet security device (or is it configurable to be so).  If yes then configure it to control access to itself and devices it protects. If not, then protect it with a configured security device.

Adam