Can rapid fire spam phone calls be blocked by the PA

[jdprovine]

Can rapid fire spam phone calls be blocked by the PA, they seem to be similar to a dial of service and they are making it possible for us to make outgoing calls or recieve incoming calls by using all our phone sessions? Is there a way to block them using the PA?

[BPry]

@jdprovine,

This would be better to control at your gateway/SBC instead of the firewall. 

[jdprovine]

SBC is a session border controller, one other person mentioned it and this is the first time I have ever hear of it. It is specifically for phone systems?

[BPry]

@jdprovine 

Yes, an SBC is generally setup for VoIP and a PBX would generally be either deployed alongside a gateway or act as its own gateway. Whether or not you have one would be dependent on what you are using as a phone system.

[jdprovine]

We have cisco IP phones, I would think it would be helpful to keep us from getting attacked so to speak

[jdprovine]

@BPry 

I am new to phones but I believe we do have a SBC - cisco cube, so I am wondering if the configuration is set way to broad and accepts way too much?

[BPry]

@jdprovine,

I'm not all that fimiliar with Cube, but I would assume that it would have a similar featureset as an Expressway and CUCM whcih would make this possible. 

You might want to verify that whoever setup your equipment has SIP UDP disabled so that toll fraud isn't chewing into your licenses. Look into whether or not Cube can do a CPL rule. 

[jdprovine]

@BPry 

I am totally new to Cube and phones in general,LOL I don't even know what expressway is. thanks for the suggestions I will check into it, 

[RobinClayton]

It's 5 years since I have managed a Cisco UCM, but your definatly going to have more success there than tryign anythig on the PA.

But if your on a SIP trunk, then speak to your phone system provider.

Rob

[jdprovine]

@RobinClayton 

And yes we are on a SIP trunk. When you say phone system provider do you mean cisco or the ISP that provides for our external lines?

[RobinClayton]

I would start with The ISP that provides the SIP trunk. At least ask them the question as they probably will be able to give you a yes or no in seconds.

As with most things it's better to block as close to the source as possible, if you try to do the blocking the "Session Initiation" is still trying to take place and impacting your PBX, Firewall, SIPtrunk and Internet. You may go from lots of nuicance calls to a saturation of Initiations.

The SIP/ISP provider should be able to limit the rate of new calls.

But a quick hunt arround sugests CUBE has a feature that may help.

"call spike"