Restrict calls between a subzone and particular extensions on Cisco VCS

[misha_bac]

Hello, I use Cisco VCS 8.5.3, my goal is to restrict calls between a subzone and particular extentions.
I've tried following solutions:

1. Uploading call policy XML file
2. Use of Call policy web interface to restrict calls

XML file:

<taa:routed>
 <address-switch field="originating-zone">
 <address is="Zone_ABC">
  <address-switch field="destination">
   <!-- Allow inter-zone calls -->
   <address regex="11111|11112">
    <proxy/>
   </address>
   <!-- Block all other calls -->
    <address regex="1.*">
     <reject status="403" reason="Denied by policy"/>
    </address>
   </address-switch>
  </address>
</address-switch>
</taa:routed>

But when I apply XML file, or try to use very simple web rule (for example: source 11111, destination 12222, action reject) I am still able to place the call from 11111 to 12222.

What can be the cause of the problem and what else can I try to be able to forbid calls between a subzone and particular exentions?

[Patrick Sparkman · Accepted solution]

Attached is an example CPL script that should work.  Using that CPL script, I was able to block calls from an entire subzone to a destination alias located in the default subzone, and was still able to call any other endpoint in the default subzone without issue.  Note, you should enter the name of the subzone as you have it configured on the VCS, including spaces if any are present.

The script is based on the CPL example "restricting access to a local gateway" in the VCS X8.5 Admin Guide on pg 413, other CPL reference material and examples can be seen starting on pg 410.