vcs expressway

[Chris Norfolk]

How do you block all inbound calls on an vcs expessway except from devices that are in the allow list?  I can't figure out how to stop unregistered devices from placing calls out the customer's isdn gateway.  The government customer wants all calls blocked unless it is from an endpoint allowed to register with the vcs.  The expressway is running version 7.1 and does not see to recognize the existing search rules.  I have a rule allowing calls leading with a 9 from the local zone with a priority of 45 and a rule blocking calls with a leading 8 from any zone with a priority of 46.  This rule does not seem to work.

[Tomonori Taniguchi]

There is several methods to archive what you are looking for.

One of it and quick method is to use local CPL to block all call from unregistered device on VCS (which CPL will run).

Example CPL to reject all call from unregistered device (regardless of destination).

====================================================================

  xmlns:taa="http://www.tandberg.net/cpl-extensions"

  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="urn:ietf:params:xml:ns:cpl cpl.xsd">

 
  
   
    

====================================================================

[Tomonori Taniguchi]

BTW, if you want to allow call to device with URL starting “9” but reject call to URL starting “8” (and also anything other than “9”) even call from unregistered device on VCS, you may configure CPL as follow (as example).

====================================================================

     xmlns:taa="http://www.tandberg.net/cpl-extensions"

     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

     xsi:schemaLocation="urn:ietf:params:xml:ns:cpl cpl.xsd">

====================================================================

You may remove 2^nd call reject parameter (destination “8.+” regex) as 3^rd call reject parameter (destination “.*”) will reject call to URL starting “8” as well. I just made more visible as example for this specific case.

[Tomonori Taniguchi]

Other method (specifically restricting the access to ISDN gateway) is configure search rule with specific method.

For VCS X7.1, please refer to “Step 16: Restrict access to ISDN gateways” section, page 42 of  http://www.cisco.com/en/US/docs/telepresence/infrastructure/vcs/config_guide/Cisco_VCS_Basic_Configuration_Cisco_VCS_Control_with_Cisco_VCS_Expressway_Deployment_Guide_X7-1.pdf

[Tomonori Taniguchi]

Redirect the incoming call to reception

BTW, advantage for using CPL, if customer have reception (or operator) and would like to redirect the incoming call from unregister device instead of rejecting the call (in case call is really urgent or came from executive member, etc.), you may configure call to proxy but define specific destination (I.e. reception).

For example, allow to make a call to URL starting 9, automatically reject call to URL starting 8, then all other call destination connect to reception (call from unregistered devices).

==========================================================================

     xmlns:taa="http://www.tandberg.net/cpl-extensions"

     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

     xsi:schemaLocation="urn:ietf:params:xml:ns:cpl cpl.xsd">

        reception@domain.com">

==========================================================================