Rogue calls on Expressway-E - can they be blocked/dropped

[gfolens]

Is there a way to automatically block calls from rogue SIP endpoints trying to dial internal PSTN numbers via the Expressway-E (see attached screenshot)?

Via the firewall protection of the Expressway you can add IP addresses, select UDP port 5060.

But these rogue endpoints change their public addresses all the time - so this list is difficult to maintain.

And Automated protection does not provide a rule for blocking public IP's that are attempting multiple calls to different destinations.

The problem with these calls is they are consuming RMS license because there's a translation rule that translates call to the public IP of the Expressway-E to the local domain. Or should I remove this rule?

Some endpoints use the IP address instead of the DNS name.

rgds ,Geert.

[Patrick Sparkman · Accepted solution]

What you're seeing is someone doing remote scans on public facing networks trying to exploit PTSN trunks and attempting to make toll fraud calls.

I'm not sure if you have this option on the Expressway Series, but on VCS you can turn of SIP UDP.  You can also use CPL to block the incoming calls as well.

FYI, searching the forums would have returned multiple discussions with solutions.

• nuisance-h323-calls-sx20
• ghost-calls-tandberg-e20
• sourceh323idcisco-incomingcalls
• vcs-sip-abuse-reported

[darmckin]

I agree with Patrick, and yes you can disable SIP UDP on the Expressway series.

[KY_]

How can I disable SIP UDP on Expressway ?

[Patrick Sparkman]

Can turn off SIP UDP under Configuration > Protocols > SIP. If this is a new install, after X7.x, than it should be off already by default. 

[KY_]

I turn of it  but still getting following error on Expressway-E

2016-11-10 05:12:32	2016-11-10 05:12:32	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 05:09:11	2016-11-10 05:09:12	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 05:05:35	2016-11-10 05:05:35	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 05:02:19	2016-11-10 05:02:19	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:57:09	2016-11-10 04:57:09	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:55:20	2016-11-10 04:55:20	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:50:39	2016-11-10 04:50:39	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:48:51	2016-11-10 04:48:51	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:43:47	2016-11-10 04:43:47	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:41:57	2016-11-10 04:41:58	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:40:31	2016-11-10 04:40:31	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:38:43	2016-11-10 04:38:44	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:35:26	2016-11-10 04:35:27	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:33:43	2016-11-10 04:33:43	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:31:55	2016-11-10 04:31:56	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:30:32	2016-11-10 04:30:33	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:28:45	2016-11-10 04:28:45	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:25:44	2016-11-10 04:25:45	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:22:11	2016-11-10 04:22:12	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:19:06	2016-11-10 04:19:06	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:17:25	2016-11-10 04:17:25	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:16:01	2016-11-10 04:16:01	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:12:59	2016-11-10 04:13:00	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:11:18	2016-11-10 04:11:19	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:08:14	2016-11-10 04:08:15	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:06:17	2016-11-10 04:06:17	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:04:37	2016-11-10 04:04:37	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 04:03:17	2016-11-10 04:03:18	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:59:59	2016-11-10 04:00:00	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:58:30	2016-11-10 03:58:31	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:52:10	2016-11-10 03:52:10	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:49:04	2016-11-10 03:49:05	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:47:22	2016-11-10 03:47:23	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:45:46	2016-11-10 03:45:46	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:44:21	2016-11-10 03:44:21	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:40:57	2016-11-10 03:40:58	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:39:33	2016-11-10 03:39:33	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:36:08	2016-11-10 03:36:09	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:33:13	2016-11-10 03:33:13	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:29:08	2016-11-10 03:29:09	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:23:27	2016-11-10 03:23:28	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:21:22	2016-11-10 03:21:23	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:19:44	2016-11-10 03:19:45	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:17:44	2016-11-10 03:17:45	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:14:07	2016-11-10 03:14:07	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:12:03	2016-11-10 03:12:03	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:08:27	2016-11-10 03:08:27	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:06:28	2016-11-10 03:06:28	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:04:35	2016-11-10 03:04:35	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:02:58	2016-11-10 03:02:59	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 03:00:55	2016-11-10 03:00:55	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:58:52	2016-11-10 02:58:52	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:55:03	2016-11-10 02:55:03	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:52:59	2016-11-10 02:53:00	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:51:22	2016-11-10 02:51:22	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:49:25	2016-11-10 02:49:25	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:47:39	2016-11-10 02:47:40	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:39:56	2016-11-10 02:39:56	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:37:56	2016-11-10 02:37:57	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:34:22	2016-11-10 02:34:23	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:28:41	2016-11-10 02:28:41	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:25:10	2016-11-10 02:25:11	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:23:07	2016-11-10 02:23:08	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:21:13	2016-11-10 02:21:13	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:19:36	2016-11-10 02:19:36	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:17:43	2016-11-10 02:17:43	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:14:02	2016-11-10 02:14:03	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:12:06	2016-11-10 02:12:06	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:10:09	2016-11-10 02:10:10	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:08:39	2016-11-10 02:08:39	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:06:41	2016-11-10 02:06:42	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 02:05:02	2016-11-10 02:05:03	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:59:16	2016-11-10 01:59:17	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:57:18	2016-11-10 01:57:19	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:55:17	2016-11-10 01:55:18	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:53:45	2016-11-10 01:53:46	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:51:39	2016-11-10 01:51:39	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:48:05	2016-11-10 01:48:05	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:46:06	2016-11-10 01:46:07	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:44:05	2016-11-10 01:44:06	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:42:23	2016-11-10 01:42:23	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:40:18	2016-11-10 01:40:19	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:36:31	2016-11-10 01:36:32	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:34:29	2016-11-10 01:34:29	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:32:38	2016-11-10 01:32:38	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:31:04	2016-11-10 01:31:05	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:27:34	2016-11-10 01:27:35	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:25:32	2016-11-10 01:25:32	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:21:58	2016-11-10 01:21:58	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:20:03	2016-11-10 01:20:03	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:18:04	2016-11-10 01:18:04	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:14:40	2016-11-10 01:14:41	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:12:49	2016-11-10 01:12:50	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:11:20	2016-11-10 01:11:20	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:09:28	2016-11-10 01:09:29	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:06:00	2016-11-10 01:06:00	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:03:57	2016-11-10 01:03:58	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:01:55	2016-11-10 01:01:56	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 01:00:04	2016-11-10 01:00:04	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:57:37	2016-11-10 00:57:37	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:55:29	2016-11-10 00:55:30	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:52:41	2016-11-10 00:52:42	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:49:44	2016-11-10 00:49:44	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:47:15	2016-11-10 00:47:16	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:44:17	2016-11-10 00:44:17	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:41:15	2016-11-10 00:41:16	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:38:48	2016-11-10 00:38:48	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:35:48	2016-11-10 00:35:49	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:32:45	2016-11-10 00:32:46	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:30:19	2016-11-10 00:30:20	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:27:16	2016-11-10 00:27:16	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:24:51	2016-11-10 00:24:51	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:21:52	2016-11-10 00:21:52	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:18:45	2016-11-10 00:18:46	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:16:20	2016-11-10 00:16:21	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:13:19	2016-11-10 00:13:20	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:10:54	2016-11-10 00:10:55	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:07:58	2016-11-10 00:07:58	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:04:58	2016-11-10 00:04:58	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-10 00:02:34	2016-11-10 00:02:35	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:59:35	2016-11-09 23:59:36	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:57:09	2016-11-09 23:57:10	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:54:13	2016-11-09 23:54:14	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:51:25	2016-11-09 23:51:26	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:48:55	2016-11-09 23:48:55	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:46:00	2016-11-09 23:46:00	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:43:38	2016-11-09 23:43:39	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:37:46	2016-11-09 23:37:46	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:35:25	2016-11-09 23:35:26	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:32:30	2016-11-09 23:32:31	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:30:07	2016-11-09 23:30:07	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:27:13	2016-11-09 23:27:13	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:24:19	2016-11-09 23:24:20	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:21:59	2016-11-09 23:22:00	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:19:06	2016-11-09 23:19:06	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:16:44	2016-11-09 23:16:45	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:13:48	2016-11-09 23:13:49	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:10:50	2016-11-09 23:10:51	1 second			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:08:30	2016-11-09 23:08:30	0 seconds			Non-traversal	H323 <->	Subscriber absent Called party not registered	This system	View
2016-11-09 23:05:35	2016-11-09 23:05:36	1 second			Non-traversal	H323 <->	Subscriber

[Patrick Sparkman]

Turning off SIP UDP will prevent most, but not all toll fraud calls.  Those calls are H323 based, so you'll need to use CPL to prevent those.  Somewhere within the links in the earlier replies in this thread contains how to create a CPL, if you can't figure it out, we can help if needed, but would need to see a snippet of your VCS search history.

[KY_]

Thanks Patrick for your good recomnendation, I disabled sip udp and its good right now but i can see on my expressway-E  unwanted calls attemps.

How can block it complately , I see on expressway firewall rule section is it possible for that or how can I implement CPL.

Thanks

[Patrick Sparkman]

Can you provide a few examples from the search history of the calls you're seeing, also what software version is your Expressway running?

[KY_]

Hi Patrick

Here is a few search history on my Expressway-E

2016-11-10 14:30:42    SIP (INVITE)     40002@90.158.111.150     sip:000441764910300@90.158.111.150     Loop Detected     View
2016-11-10 14:30:42    SIP (INVITE)     40002@90.158.111.150     sip:000441764910300@90.158.111.150     Loop Detected     View
2016-11-10 14:21:59    SIP (INVITE)     40002@90.158.111.150     sip:00441764910300@90.158.111.150     Loop Detected     View
2016-11-10 14:21:59    SIP (INVITE)     40002@90.158.111.150     sip:00441764910300@90.158.111.150     Loop Detected     View
2016-11-10 14:17:13    SIP (INVITE)     17911@90.158.111.150     sip:000442030024871@90.158.111.150     Loop Detected     View
2016-11-10 14:17:13    SIP (INVITE)     17911@90.158.111.150     sip:000442030024871@90.158.111.150     Loop Detected     View
2016-11-10 14:13:11    SIP (INVITE)     40001@90.158.111.150     sip:900441764910300@90.158.111.150     Loop Detected     View
2016-11-10 14:13:10    SIP (INVITE)     40001@90.158.111.150     sip:900441764910300@90.158.111.150     Loop Detected     View
2016-11-10 14:10:46    SIP (OPTIONS)     100@1.1.1.1     sip:100@90.158.111.150     Loop Detected     View
2016-11-10 14:10:46    SIP (OPTIONS)     100@1.1.1.1     sip:100@90.158.111.150     Loop Detected     View
2016-11-10 14:10:14    SIP (INVITE)     16401@90.158.111.150     sip:900441224928282@90.158.111.150     Loop Detected     View
2016-11-10 14:10:14    SIP (INVITE)     16401@90.158.111.150     sip:900441224928282@90.158.111.150     Loop Detected     View
2016-11-10 14:04:26    SIP (INVITE)     40001@90.158.111.150     sip:000441764910300@90.158.111.150     Loop Detected     View
2016-11-10 14:04:26    SIP (INVITE)     40001@90.158.111.150     sip:000441764910300@90.158.111.150     Loop Detected     View
2016-11-10 14:02:31    SIP (OPTIONS)     100@1.1.1.1     sip:100@90.158.111.150     Loop Detected     View
2016-11-10 14:02:31    SIP (OPTIONS)     100@1.1.1.1     sip:100@90.158.111.150     Loop Detected     View
2016-11-10 13:55:41    SIP (INVITE)     40001@90.158.111.150     sip:00441764910300@90.158.111.150

[Patrick Sparkman]

Those are all SIP, so they should stop with turning off SIP UDP.  Do you have any that show up as H323?