CUCM blocking specific calling number failed

[lisazhao1221]

Hi Experts,

I took the exact procedures in the below link to block malicious external numbers, but it didn't work.

I run DNA test and it showed "call rejected" as configured, but when I did the real test, I still could go through.

Can anyone help? 

Thanks,

Lisa

[lisazhao1221]

forgot to add the link

https://community.cisco.com/t5/collaboration-knowledge-base/blocking-calls-based-on-calling-party-id/ta-p/3113978

[Roger Kallberg · Accepted solution]

If you as you say did follow the outline of what Dan wrote in the document it should work. We use the exact same setup and it works perfectly for us.

Can you please try to outline your setup in as much details as possible so that we can verify it? There is likely a seemingly small discrepancy between what you have and what is outlined in the document that you have overlooked.

[lisazhao1221]

Hi Roger,

We are using a MGCP gateway that I could not find a dial-peer to block the call, so I had to config it on the CUCM.

I configured two CSS that each has a partition. I configured  one "!" translation patterns in each new CSS , and a "block number" translation pattern in the filter CSS. I checked the "‘Route Next Hop By Calling Party" in the first "!" pattern.

I applied inbound CSS to the inbound traffic on the two ports of the MGCP.

I tested that the calling number matches the number I set in the "block number" pattern, and I used DNA test, it showed "call reject", but when I did the real test, the call could still go through.

Thank you!

[Roger Kallberg]

Your more or less just rephrased your original post, with a little bit of more details, but not so that at least I can fully understand exactly what you have. Can you please try to share your details on how your configuration looks like in a little bit of more detailed outline? If you could give a graphic view of this in a somewhat similar view as in the document it would greatly simplify the understanding of it. At least for me it’s not really understandable what you wrote in your last reply. The absolute best would be if you take screenshots of your configuration.

[lisazhao1221]

Roger，

I created two CSS

I applied the incoming call CSS to MGCP GW's  ports

The configs still do not take effect....

Thanks for the help.

[Roger Kallberg]

Thank you!

I see a few things that are not correct. First thing, in your last TP uncheck Route Next Hop by Calling Party Number and secondly on all your TPs uncheck Provide Outside Dial Tone and Urgent Priority as these are not needed.

Personally I also prefer to split the filter partition into two, one for the block pattern(s) and then another for the allow pattern(s). The block partition should be ordered first in the second CSS. This makes it easier and clearer what is allowed and what is not. Anyway it does for me.

If it still does not work for you you’ll have to verify that your gateway sends calling numbers as you have it in your block TP. If it was a SIP or H.323 gateway this would be easy as just running debug on the gateway, but as you use MGCP it gets a little trickier as you need to look in CM SDL traces.

[lisazhao1221]

Hi Roger,

I made all the changes, but it still doesn't work.

I saw the calling number in RTMT real time monitor. It matched the block pattern.

Dont know what else I can do...

Thank you!

[Roger Kallberg]

You’ll need to look in the CM traces to see why the number analysis process does not make a match on the calling number. It should be fairly clearly visible.