Check "Expressway Policy Protection" in BRKCOL-2018, it has a good example for CPL.
But yeah, the best that Expressway can do is to respond with Forbidden to fraud call attempts instead of Not Found. I wish we could make it 'invisible' like CUBE can be, but per that CiscoLive you'd need to have some sort of an IPS device in front of it. On Mon, Apr 29, 2019 at 1:23 PM Brian Meade <bmead...@vt.edu> wrote: > Yea, they're hoping you allow inbound calls with source of @yourdomain.com > or @populardomainhere.com. > > Usually they're not targeting Expressways on purpose, they just see it as > a device responding to SIP messages. A lot of PBX's on the internet have > very little security on them so things like changing the source domain will > work. > > I try to do TLS only where possible but TCP is usually needed as well. I > always disable UDP SIP on the Expressways which cuts down a little bit. > > Then from there, you have to allow more based on destination than source > if you want to allow B2B calls from any potential source. > > On Mon, Apr 29, 2019 at 1:14 PM Pawlowski, Adam <aj...@buffalo.edu> wrote: > >> All, >> >> >> >> I know I’d asked here and elsewhere in the past regarding spam calls and >> call setup attempts, which seem to be part of the reality of being on the >> public internet. We see consistent call attempts from our own domain, as >> well as @google.com . More lately, I see them pop up with the from >> address of what appears to be another customer’s Expressway E. Not many, >> but a few. >> >> >> >> When I set up CPL on our appliances I had referred initially to this blog >> post: >> >> >> >> >> https://ciscoshizzle.blogspot.com/2016/05/hardening-your-cisco-vcs-expressway.html >> >> >> >> Expressway was new to me and the documentation was (is) not such that you >> could simply open it and understand how to set it all up end to end without >> going through the process as the tasks are sort of split between documents. >> I wanted to note that in this blog they mention that they don’t make any >> attempt to block routing externally, such that you wouldn’t necessarily >> care to block calls from the default zone back out across DNS because they >> weren’t coming to your enterprise. I am assuming that it is possible to >> configure your search rules to allow this to happen. >> >> >> >> I don’t understand the point of this, other than perhaps you could >> attempt calls through known hosts in case they happened to have some sort >> of trust relationship running, or to try and skirt (or poison) blacklists. >> >> >> >> Is anyone else seeing that type of call attempt? Do you think it’s worth >> trying to reach out to groups that appear to be proxying these calls? >> >> >> >> Best, >> >> >> >> Adam Pawlowski >> >> SUNYAB NCS >> >> >> _______________________________________________ >> cisco-voip mailing list >> cisco-voip@puck.nether.net >> https://puck.nether.net/mailman/listinfo/cisco-voip >> > _______________________________________________ > cisco-voip mailing list > cisco-voip@puck.nether.net > https://puck.nether.net/mailman/listinfo/cisco-voip >
_______________________________________________ cisco-voip mailing list cisco-voip@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-voip