got lot of unknown call logs

[oracat777]

hello all experts,

I am getting lot of abnormal call logs in the VCS expressway, I am afraid we are suffering an attempting to make illegal call via our VCS expressway, could you please kindly help me to look at the attached logs,

thanks in advance.

Yu.

[mahkrish]

Hi Yu, What is the software version installed on the VCS expressway device ? i would recommend to open a TAC case to further investigate this calls with diagnostic logs enabled in debug mode.

BR, Mahesh Adithiyha

[oracat777]

hi Mahesh,

thanks for your prompt reply, the version of VCSc is 7.2 and VCS expressway version is 7.2.1.

I just want to confirm firstly is it abnormal or everyone are facing it? or it have no change to be successful ? or is there any guide I can take a look?

thanks,

Yu.

[Jens Didriksen]

I've seen a lot of SIP call attempts in the past, mainly trying to access a gateway to make free phonecalls.

Hardly seeing any after we implemented call policies on the VCS-E blocking them.

/jens

[oracat777]

hello Jens,

how can I make call policies on VCS?

can you give me an example?

thanks.

Yu.

[mahkrish]

Hi yu, One of the option is to terminate all hairpin calls by using # in the ISDN Service if it is hitting the ISDN gateway and deploy the configuration defined in "Restrict access to ISDN Calls" topic in "VCS Expressway and VCS Control deployment guide". Also, deploy device authentication on VCS Expressway to restrict unauthorized users and devices from registering and making calls.

You can read through the document http://www.cisco.com/en/US/docs/telepresence/infrastructure/vcs/config_guide/Cisco_VCS_Basic_Configuration_Control_with_Expressway_Deployment_Guide_X7-2.pdf, page 40 , section "

Restrict access to ISDN gateways ".

HTH.

BR, Mahesh Adithiyha

[oracat777]

thanks Mahesh,

thanks for your document, I will read it carefully.

as for me, there is no unauthorized devices registered to the VCS E(I have checked at the register history), but there are so many unknown call can be found in the "call history".

I just want to known how can they make it.....

Yu.

[Jens Didriksen]

These threads might be of interest as well:

https://supportforums.cisco.com/message/3542721

https://supportforums.cisco.com/thread/2092832

https://supportforums.cisco.com/message/3929888

Remember, there's no need to actually register with your VCS-E to make calls, external sites should be able to call you end-points (assuming "normal deployment",) by dialling alias@VCS-E_IP_address or alias@domain.

You'll find examples in the above mentioned threads.

/jens

Please rate replies and mark question "Answered" if applicable.

[nguyenngoctuyen]

Hi oracat777,

i have proplem same you, Expressway C and E got a lot of abnormal call on call log.

you have to control this problem? Please help me!

[Patrick Sparkman]

Make sure SIP udp is turned off, it should be by default.  The best method to block the calls is to use a CPL script, however it won't stop the attempts, but it will prevent the calls from consuming Expressway resources such as RMS licenses.  Can you provide examples of what the source and destination address are as seen in the search history for some of the calls?

[nguyenngoctuyen]

Many thanks Patrick,

please refer to attach file for example!

[Patrick Sparkman]

Is SIP UDP on or off, you can check by going to Configuration > Protocols > SIP, it should be off by default.  If it is on, can you turn it off, and then see if you get any more unwanted calls?  Otherwise, we would need to come up with a CPL script to block the calls.  Also, if you have any SRV records that use SIP UDP, I suggest these not be used either.

[nguyenngoctuyen]

Many thanks Patrick,

yes, this is the problem of SIP UDP, i enabled it, follow your guide and abnormal calls they do not exist.

[Patrick Sparkman]

Glad that resolved your problem, don't forget to rate helpful replies.  I'll try to take a look at your other thread whenever I have the time.

[nguyenngoctuyen]

Hi, Patrick

please help me for this case: https://supportforums.cisco.com/discussion/12930396/integrate-cucm-mcu-rmx2000-polycom