<html>
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
span.EmailStyle17
{font-family:Arial;
color:navy;}
@page Section1
{size:595.3pt 841.9pt;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body bgcolor=white lang=EN-GB link=blue vlink=blue>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Thanks Lelio</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>I thought that was the case but didn’t
want to remove them too soon just in case.</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span lang=EN-US
style='font-size:10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma'>
Lelio Fulgenzi [mailto:lelio@uoguelph.ca] <br>
<b><span style='font-weight:bold'>Sent:</span></b> Thursday, September 14, 2006
1:40 PM<br>
<b><span style='font-weight:bold'>To:</span></b> Nick Kassel; Erick Bergquist;
IT; Voll, Scott; puckcisco@cumhur.com; cisco-voip@puck.nether.net<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [cisco-voip]
vulnerable gateway?</span></font></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt'>I believe all you really need are all the partitions the phones are in
and if you are sending any calls to IPCC, you need the partitions the CTI route
points and CTI ports are in. In addition, if you are using CTI route points as
phantom numbers for forwarding, etc. And any partition that contains
translations. </span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt'>The best would be to review each of your partitions and decide if Unity
has to call it. I don't think there are any hard and fast rules of what it
needs, etc. Previous versions of callmanager (3.x and below I believe) that
used call forwarding would need access to the partition the voicemail ports are
in as well. That was definately a hard and fast rule.</span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>--------------------------------------------------------------------------------<br>
Lelio Fulgenzi, B.A.<br>
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1<br>
(519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)<br>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ <br>
"I can eat fifty eggs." "Nobody can eat fifty eggs."</span></font></p>
</div>
<blockquote style='border:none;border-left:solid black 1.5pt;padding:0in 0in 0in 4.0pt;
margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>----- Original Message ----- </span></font></p>
</div>
<div style='font-color:black'>
<p class=MsoNormal style='background:#E4E4E4'><b><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial;font-weight:bold'>From:</span></font></b><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> <a
href="mailto:Nick.Kassel@charles-stanley.co.uk"
title="Nick.Kassel@charles-stanley.co.uk">Nick Kassel</a> </span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>To:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> <a
href="mailto:erickbe@yahoo.com" title="erickbe@yahoo.com">Erick Bergquist</a> ;
<a href="mailto:it@cimgroup.com" title="it@cimgroup.com">IT</a> ; <a
href="mailto:Scott.Voll@wesd.org" title="Scott.Voll@wesd.org">Voll, Scott</a> ;
<a href="mailto:puckcisco@cumhur.com" title="puckcisco@cumhur.com">puckcisco@cumhur.com</a>
; <a href="mailto:cisco-voip@puck.nether.net" title="cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a>
</span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>Sent:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> Thursday,
September 14, 2006 4:29 AM</span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>Subject:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> Re: [cisco-voip]
vulnerable gateway?</span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>What partitions does the Voicemail CSS need to access, we appear to
have<br>
spurious partitions added to this CSS and I'm not sure they need to be<br>
there?<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a><br>
[mailto:cisco-voip-bounces@puck.nether.net] On Behalf Of Erick Bergquist<br>
Sent: Wednesday, September 13, 2006 4:03 AM<br>
To: IT; Voll, Scott; <a href="mailto:puckcisco@cumhur.com">puckcisco@cumhur.com</a>;
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
Subject: Re: [cisco-voip] vulnerable gateway?<br>
<br>
You can limit this with the restriction tables in unity and ultimately<br>
with the CSS set on the Call Manager VM Port configuration. <br>
<br>
----- Original Message ----<br>
From: IT <<a href="mailto:it@cimgroup.com">it@cimgroup.com</a>><br>
To: "Voll, Scott" <<a href="mailto:Scott.Voll@wesd.org">Scott.Voll@wesd.org</a>>;
IT <<a href="mailto:it@cimgroup.com">it@cimgroup.com</a>>;<br>
<a href="mailto:puckcisco@cumhur.com">puckcisco@cumhur.com</a>; <a
href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
Sent: Tuesday, September 12, 2006 5:42:04 PM<br>
Subject: Re: [cisco-voip] vulnerable gateway?<br>
<br>
But where in unity is someone able to route their call to any arbitrary<br>
phone number?<br>
<br>
-----Original Message-----<br>
From: Voll, Scott [mailto:Scott.Voll@wesd.org] <br>
Sent: Tuesday, September 12, 2006 3:37 PM<br>
To: IT; <a href="mailto:puckcisco@cumhur.com">puckcisco@cumhur.com</a>; <a
href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
Subject: RE: [cisco-voip] vulnerable gateway?<br>
<br>
I would agree with TAC per your CDR of CiscoUM-VI1.<br>
<br>
Scott<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a><br>
[mailto:cisco-voip-bounces@puck.nether.net] On Behalf Of IT<br>
Sent: Tuesday, September 12, 2006 3:29 PM<br>
To: <a href="mailto:puckcisco@cumhur.com">puckcisco@cumhur.com</a>; IT; <a
href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
Subject: Re: [cisco-voip] vulnerable gateway?<br>
<br>
Actually, I tried both UDP and TCP.<br>
Would it still show up under a portscan? TAC seems to think they came in<br>
through voicemail...<br>
<br>
-----Original Message-----<br>
From: cumbur [mailto:zeus@cumhur.com] On Behalf Of <a
href="mailto:puckcisco@cumhur.com">puckcisco@cumhur.com</a><br>
Sent: Tuesday, September 12, 2006 3:19 PM<br>
To: IT; <a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
Subject: RE: [cisco-voip] vulnerable gateway?<br>
<br>
Dear Avidan,<br>
<br>
H323 use TCP 1720 (not udp) port for call initiation also don't forget<br>
to<br>
block SIP ports TCP/UDP 5060.<br>
<br>
Regards.<br>
Cumhur<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a><br>
[mailto:cisco-voip-bounces@puck.nether.net] On Behalf Of IT<br>
Sent: Wednesday, September 13, 2006 12:59 AM<br>
To: <a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
Subject: [cisco-voip] vulnerable gateway?<br>
<br>
I just got a call from my long distance provider that someone has been<br>
using my PRI for many international calls. I check my CDR database<br>
tables, and it appears that calls have been coming from one of my branch<br>
office 2801's. But, in the CDR table, the origDeviceName alternates<br>
between the name of the gateway and CiscoUM-VI1.<br>
I ran a port scan against the router, and found that h.323 and callbook<br>
ports were open to the public. I shutdown the interface that had those<br>
ports open, because when I tried to do a "access-list 100 deny udp any<br>
any eq 1720" it still shows as open on the portscan.<br>
<br>
How can I secure/lock H.323 on these branch devices?<br>
How did someone utilize my gateway to make these calls?<br>
How can I avoid this in the future?<br>
<br>
I guess I should have made sure that the consulting group that set up<br>
these gateways in the first place locked them down, but hindsight is<br>
20/20.<br>
<br>
Thanks,<br>
Avidan<br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
<br>
<br>
<br>
-- <br>
No virus found in this incoming message.<br>
Checked by AVG Free Edition.<br>
Version: 7.1.405 / Virus Database: 268.12.3/446 - Release Date:<br>
12/09/2006<br>
<br>
<br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
***********************************************************************************************<br>
<br>
The information contained in this e-mail is strictly confidential, some or all<br>
of which may be legally privileged. It is for the intended recipient only.<br>
Access to this e-mail by any other person is prohibited. If you are not the<br>
intended recipient, any use, disclosure, copying, printing, distribution of,<br>
replying to or any action taken or omitted to be taken in reliance on this<br>
e-mail, is prohibited and may be unlawful. Please contact the sender
immediately<br>
should this e-mail have been incorrectly addressed or transmitted.<br>
<br>
You accept that any instructions are deemed to have been given at the time the<br>
recipient(s) accesses them and that delivery receipt does not constitute<br>
acknowledgement or receipt by the intended recipient(s). You accept that there<br>
may be a delay in processing the instructions received from e-mails after<br>
Charles Stanley has received them. You are advised that urgent, time sensitive<br>
and confidential communications should not be sent by e-mail. <br>
<br>
You acknowledge that e-mails are not secure and you accept the risk of<br>
malfunction, viruses, unauthorised interference, mis-delivery or delay.<br>
************************************************************************************************<br>
<br>
<br>
Charles Stanley & Co. Ltd<br>
Registered Office: 25 Luke Street London EC2A 4AR<br>
<br>
Tel: 0207 739 8200 Fax: 0207 739 7798<br>
Registered in England No. 1903304<br>
<br>
Charles Stanley Sutherlands and Charles Stanley Securities are divisions of
Charles Stanley & Co. Ltd<br>
<br>
Authorised and Regulated by the Financial Services Authority, Member of the<br>
London Stock Exchange, International Securities Markets Association, and The
London International Financial Futures &<br>
Options Exchange.<br>
<br>
This footnote also confirms that this email message has been swept by McAfee<br>
VirusScan and SurfControl Email Filter software.<br>
<br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a></span></font></p>
</blockquote>
</div>
<br><br><table bgcolor=white style="color:black"><tr><td><br>***********************************************************************************************<br>
<br>
The information contained in this e-mail is strictly confidential, some or all<br>
of which may be legally privileged. It is for the intended recipient only.<br>
Access to this e-mail by any other person is prohibited. If you are not the<br>
intended recipient, any use, disclosure, copying, printing, distribution of,<br>
replying to or any action taken or omitted to be taken in reliance on this<br>
e-mail, is prohibited and may be unlawful. Please contact the sender immediately<br>
should this e-mail have been incorrectly addressed or transmitted.<br>
<br>
You accept that any instructions are deemed to have been given at the time the<br>
recipient(s) accesses them and that delivery receipt does not constitute<br>
acknowledgement or receipt by the intended recipient(s). You accept that there<br>
may be a delay in processing the instructions received from e-mails after<br>
Charles Stanley has received them. You are advised that urgent, time sensitive<br>
and confidential communications should not be sent by e-mail. <br>
<br>
You acknowledge that e-mails are not secure and you accept the risk of<br>
malfunction, viruses, unauthorised interference, mis-delivery or delay.<br>
************************************************************************************************<br>
<br>
<br>
Charles Stanley & Co. Ltd<br>
Registered Office: 25 Luke Street London EC2A 4AR<br>
<br>
Tel: 0207 739 8200 Fax: 0207 739 7798<br>
Registered in England No. 1903304<br>
<br>
Charles Stanley Sutherlands and Charles Stanley Securities are divisions of Charles Stanley & Co. Ltd<br>
<br>
Authorised and Regulated by the Financial Services Authority, Member of the<br>
London Stock Exchange, International Securities Markets Association, and The London International Financial Futures &<br>
Options Exchange.<br>
<br>
This footnote also confirms that this email message has been swept by McAfee<br>
VirusScan and SurfControl Email Filter software.<br>
</td></tr></table></body>
</html>