I'm trying to forbid some probing attacks on a VCS Expressway.
The calls come in from unknown@(various IP addresses), and go to either sip:(string of 12-17 numbers)@(ip address of VCS express), or the same thing without the SIP: prefix (as an H323 setup request), or the latter prefixed with a '+'.
I thought that putting in a Local CPL to reject calls from unknown@.* going to .* would work. The Locate tool on the VCS indicates that it does; it comes back with a Forbidden response. Yet, in practice, these call attempts are not Rejected. They are passed to the Control and back, when the are stopped as a Loop.
Does anyone know why my CPL isn't working, and how to make it work?
