Partitions and Calling Search Spaces

[IP_Cartel]

What is the best practice when setting up Partitions and CSS for internal devices that should not be able to reach the Trunks for PSTN access?  How do I go about creating a partition that can call all internal devices in a partition, but no PSTN?  Do you have samples I can see?  Meaning devices that are restricted I want it to be able to call internal DNs, which have higher access.   Is it a config that gets done in the Router Patterns?

Trunk 
Route Patterns: Internal, Local, Long Dist., Int'l etc
Directory Number: DN-PT
Device: CSS

So let's say I create a Restricted-PT and Unrestricted-PT.

Device: 
DN: 1234 Route Partition: Unrestricted-PT
CSS: Unrestricted-CSS (Restricted-PT, Unrestricted-PT, PSTN-PT)

DN: 4321 Route Partition: Restricted-PT 
CSS: Restricted-CSS (Restricted-PT)

PSTN SIP Trunk: PSTN-CSS (PSTN-PT)

The issue that I have is 1234 can call 4321 but 4321 cannot call 1234.  This is what I am trying to figure out. 

[b.winter]

Separate the calling patterns in different Partitions (internal DNs in one, outbound calling patterns like RP in another one).
In the CSS only assign Partitions you need.

In your problem:
CSS of 4321 doesnt't have the partition of 1234 (Unrestricted-PT).

E.g.:
1234 should be able to call internally, but no PSTN access.
4321 should be able to call everything.

PT: Internal
PT: PSTN

CSS: Internal
CSS: PSTN-International

1234 will be in PT Internal and will have CSS Internal assigned
4321 will be also in PT Internal and will have CSS PSTN-International assigned.
=> Both DNs can call each other, but only 4321 will be able to dial outside.

[Roger Kallberg]

The partition that a directory number is in has nothing to do with what it is allowed to call. This is all set by what partitions the device and/or directory number has in its device CSS and/or line CSS.

I would suggest that you modify your configuration with something like this.

Device: 
DN: 1234 Directory Number Partition: DirectoryNumber-PT
CSS: Unrestricted-CSS (DirectoryNumber-PT, PSTN-PT)

DN: 4321 Directory Number Partition: DirectoryNumber-PT
CSS: Restricted-CSS (DirectoryNumber-PT)

PSTN SIP Trunk: PSTN-CSS (assuming this is the inbound CSS? If so it should absolutely NOT see PSTN-PT as that can cause a loop where inbound calls can go back out to the PSTN. This can be used for call fraud, so it is a very bad idea to allow this.) My suggestion would be to include the partition DirectoryNumber-PT in the CSS that is used as the inbound CSS on the SIP trunk.

With this both DNs should be able to call each other and DN 1234 can also call to PSTN.

[Jaime Valencia · Accepted solution]

CSS and partitions are basic building blocks in CUCM, you really need to know how to use them, strongly suggest you read this chapter from the SRND

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab10/collab10/dialplan.html

[IP_Cartel]

Thank you for the info.  The people that originally setup this UCS network, setup all of the DNs and Trunks in the same partition.  This is why at the moment I cannot restrict PSTN outgoing via SIP trunk.  To take your example:

Device: 
DN: 1234 Directory Number Partition: DirectoryNumber-PT
CSS: Unrestricted-CSS (DirectoryNumber-PT, PSTN-PT)

DN: 4321 Directory Number Partition: DirectoryNumber-PT
CSS: Restricted-CSS (DirectoryNumber-PT)

TRUNK: PSTN-CSS (DirectoryNumber-PT)

In other words, I will need to do this?

Device: 
DN: 1234 Directory Number Partition: DirectoryNumber-PT
CSS: Unrestricted-CSS (DirectoryNumber-PT, PSTN-PT)

DN: 4321 Directory Number Partition: DirectoryNumber-PT
CSS: Restricted-CSS (DirectoryNumber-PT)

Outbound TRUNK: PSTN-CSS (PSTN-PT)

[Roger Kallberg]

---

@IP_Cartel wrote:

Outbound TRUNK: PSTN-CSS (PSTN-PT)

---

What do you mean by this? There is no CSS in the outbound direction on a SIP trunk. You control whom can use the trunk for outbound calls by the partition that you put the Route Patterns in. This has nothing to do directly with the SIP trunk.

[IP_Cartel]

I see. ok. got it. thanks