Hello!
Yes, I noticed that in VCS logs as well.
Before the common scans were on sip/5060/udp.
The same issue you might have when SIP is expoded to the public, especially the udp port, but there are also scans on tcp and at one point there will be TLS as well.
Its like spam, the spammers adopt.
For now I would say, as you did put it behind a firewall and only allow sources you really want to have communication with (which might not be ideal or even possible) or use a call control, like vcs or cucm+expressway upfront.
If you have your firewall upfront you could log the ip addresses which try to do h323 and sip connections, you could try to block them. But its also just playing hide and seek, there are no common ips used for scanning and anyhow you do not know where they scan from, often compromised systems are used for these scans.
Some firewalls have geo-ip features, so you could block continents / countries / areas which you are not communicating with.
Anyhow, consider to use a call control and do admission control there.
Please rate this posting using the stars below.
