<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
In full disclosure, I have not looked at the links you've referenced, just offering my thoughts on your questions. First, lets agree that preventing 100% of toll-fraud is a fool's errand; the only way to 100% prevent it is to power it off.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
That said, making toll-fraud "less possible" in Expressway is more challenging than a traditional "CUBE" because unlike NANP, URI's can be damn well what the business pleases, and you also have to consider the calling scenarios (Example: Hybrid call connect
could absolutely have "<i>e164@domain.call.ciscospark.com</i>" calls coming inbound as source URIs). A system that will only ever have outbound calls to Webex CMRs can have a call policy written to prevent calls with source URIs matching the internal domain
whereas a multi-national deployment of two separate systems (with the same doamian), not on-net and separated by the Internet may not be able to.<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
To that end, writing call policies for Expressway has (and always will be) something that is customized to the deployment.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I have found the following to be two good "reject" policies that tend not to interfere with most deployments (though they could if the internal URIs match the policy). Most organizations have Directory URIs that ultimately have been inherited from the user's
email address or other corporate standardizations which these policies tend to avoid and also tend to deny routing to a surprising amount of obvious junk (typically, I apply CPL at the edge):
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<ul>
<li>^[0-9,a-z,A-Z]{0,6}@.*</li><ul>
<li> The first 0-6 characters are made up of alphanumerics 0-9 and/or upper/lower case letters, “@“ anything</li><ul>
<li>Example: 123456@domain.com</li><li>Example: NoAuth@domian.com</li><li>Example: 9999@domain.com</li></ul>
</ul>
</ul>
<ul>
<li>^[0-9,a-z,A-Z]{0,6}$</li><ul>
<li>The first 0-6 characters are made up of alphanumerics 0-9 and/or upper/lower case letter and do not exceed the 6th character</li><li>Example: 1000</li><li>Example: 9999</li><li>Example: NoAuth</li></ul>
</ul>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="Signature">
<div></div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
Thanks,</div>
<div style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
Ryan Huff, CCDP, CCNP<br>
</div>
<div style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
Cisco Certified Network and Design Professional</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> cisco-voip <cisco-voip-bounces@puck.nether.net> on behalf of Pawlowski, Adam <ajp26@buffalo.edu><br>
<b>Sent:</b> Monday, April 29, 2019 1:13 PM<br>
<b>To:</b> cisco-voip@puck.nether.net<br>
<b>Subject:</b> [cisco-voip] External call attempts to Expressway E</font>
<div> </div>
</div>
<div lang="EN-US">
<div class="x_WordSection1">
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
All,</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
I know I’d asked here and elsewhere in the past regarding spam calls and call setup attempts, which seem to be part of the reality of being on the public internet. We see consistent call attempts from our own domain, as well as @google.com . More lately, I
see them pop up with the from address of what appears to be another customer’s Expressway E. Not many, but a few.
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
When I set up CPL on our appliances I had referred initially to this blog post:</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
<a href="https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fciscoshizzle.blogspot.com%2F2016%2F05%2Fhardening-your-cisco-vcs-expressway.html&data=02%7C01%7C%7Cba259ed920cc480bce2908d6ccc61e5b%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636921548609965133&sdata=nJTRYojsHwoCXwo9gb%2BRETRszZtbZc%2BlwPpqp9IviCw%3D&reserved=0" originalsrc="https://ciscoshizzle.blogspot.com/2016/05/hardening-your-cisco-vcs-expressway.html" shash="JNWco4UyhGXneElEwRnYh/olB+BeCCAnfsxWhAvME3r0anbFqTvunwN+OrbM1Fw0UmQOCGr4auk1OJzSFaI5KP0NLw3mpV8c3Cwy+EYjG6ljoqaD/R+M6HTeov7jgiscJtnunTyVnf2J5Djbp6G/+GsnLVUdgR2UjEBqHPNdxd0=">https://ciscoshizzle.blogspot.com/2016/05/hardening-your-cisco-vcs-expressway.html</a></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
Expressway was new to me and the documentation was (is) not such that you could simply open it and understand how to set it all up end to end without going through the process as the tasks are sort of split between documents. I wanted to note that in this blog
they mention that they don’t make any attempt to block routing externally, such that you wouldn’t necessarily care to block calls from the default zone back out across DNS because they weren’t coming to your enterprise. I am assuming that it is possible to
configure your search rules to allow this to happen.</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
I don’t understand the point of this, other than perhaps you could attempt calls through known hosts in case they happened to have some sort of trust relationship running, or to try and skirt (or poison) blacklists.
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
Is anyone else seeing that type of call attempt? Do you think it’s worth trying to reach out to groups that appear to be proxying these calls?</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
Best,</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
Adam Pawlowski</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
SUNYAB NCS</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 0.0001pt; font-size:11pt; font-family:"Calibri",sans-serif">
</p>
</div>
</div>
</div>
</div>
</body>
</html>