From: Radioactive Frog (pbhatkoti@gmail.com)
Date: Tue May 27 2008 - 11:58:35 ART
Tony,
If you have a single ANI e.g. as u said 419616 or u know a buntch of ANI who
spams your CCM, then its easy to block.
Just create a xlation pattern and there put your 419616430 in there. THen
there down the bottom you will see 2 options, route this patter / or block.
Just select the block. And he would be blocked...
Easy, but make sure if significient digit in MGCP gw page is set to "4" then
you only need to put the last 4 digits in the block pattern. e.g. 6430.
Thats sort of NBAR,
For random numbers, & voice protocol security (h323, mgcp, sip, skinny),
you can route the signaling traffic thorugh the ASA firwarll or there are
other non-cisco products which do really deep packet inspection , matches
some pattern and declear the call as a unauthorised.
AFAIK there is no 100% solution for voip call spaming. It's same as we've
issue with DoS or DDoS attacks in IP world.
HTH,
Frog
On Tue, May 27, 2008 at 10:46 PM, Tony Edwards <tonyedwards.rs@gmail.com>
wrote:
> Hi Frog,
>
> It is PSTN /Cellular incoming # , for example 419 616 430.
>
> Number can be any I guess & let me understand on how to deploy the NBAR
> kind of filtering on CCM for this example external number.
>
> thanks for your help.
>
> tony
>
>
> On 5/27/08, Radioactive Frog <pbhatkoti@gmail.com> wrote:
>>
>> Hi Tony,
>> Do you know the ANI or DNIS of the call you want to block?
>> Cheers
>>
>> On Mon, May 26, 2008 at 8:29 PM, Tony Edwards <tonyedwards.rs@gmail.com>
>> wrote:
>>
>>> Hi GS,
>>>
>>> I was wondering is there any way ,where I can do NBAR Filtering ( where I
>>> can match any peer to peer apps and drop em) kind of config on CCM 4.2.x
>>> for incoming PSTN numbers ?
>>>
>>> I needed to ** block ** an incoming PSTN number that is hitting randomly
>>> on
>>> our MGCP gateways who are doing Q931 backhauling to our CCM. Even though
>>> I
>>> could able to find ways to do this filtering on H323 gateways , I am bit
>>> unsuccessful in doing the same on MGCP gateways ( i.e on CCM). I tried
>>> to match the incoming number with a Translation Pattern or CTI RP and
>>> then
>>> redirect it to a non existing voice mail port ..etc. Also I tried with
>>> playing with Calling Party T/M mask too with out much success.
>>>
>>> Any advise is much appreciated.
>>>
>>> tony.
>>>
>>>
>>> _______________________________________________________________________
>>> Subscription information may be found at:
>>> http://www.groupstudy.com/list/CCIELab.html
This archive was generated by hypermail 2.1.4 : Mon Jun 02 2008 - 06:59:18 ART