voice service voip no ip address trusted authenticate? Do I still need a Trusted List

[lowfell]

Can someone please explain WHY you would run this command on VGW

1. #no ip address trusted authenticate  ?

Surely you WANT ip address authenticate??

2. if I did run this command

#no ip address trusted authenticate

Would I still MUST define a trusted list?

Thanks in advance

[acampbell]

Hi,

I remember this feature coming into play a few years ago.

This was all about anti-fraud

Have a read at this document:-

https://www.cisco.com/c/en/us/support/docs/voice/call-routing-dial-plans/112083-tollfraud-ios.html

[lowfell]

Hello Alex. I've read that, but I'm still don't understand why you firstly say

#no ip address trusted authenticate

Does this allow all connections?

Or once you've said

#no ip address trusted authenticate

do you then have to define a trusted list?

If you do then surely that's a contradiction?

[acampbell]

Hi,

If you want to turn off the anti-fraud feature on the voice gateway:-

!
voice service voip
no ip address trusted authenticate
!

REMEMBER -- If you turn off the feature you are leaving your device open to
fraudulent calls. -- BE AWARE

So in answer to yor question all calls will be allowed

[lowfell]

Hello Alex. So are you saying if you turn this off you wouldn't need a trusted list?

[acampbell]

If you apply

!
voice service voip
no ip address trusted authenticate
!

You are turning OFF the call anti-fraud feature.

You will not need any trust lists at all

[lowfell · Accepted solution]

OK. I get that but why would you want to allow alk connections?

[lowfell]

Thaks again for your help. Greatly appreciated.

[lowfell]

Why would you want to turn this off, for what scenario would you want to allow the possibility of Toll Fraud?

[Ayodeji Okanlawon]

+ 5 to Alex for the excellent points he has provided

There maybe cases where you want to turn this off temporarily. If you are doing an integration with a SIP provider and you dont know all their subnet range for signaling/media traffic you want want to turn it off just to get you going. Once you ascertain the IP addresses you need to enable IP address trust list with those IPs. There may be other cases as well, this is just one I could think of