Re: [cisco-voip] CUBE call authorization ?

[Carlos G Mendioroz]

Thanks Ariel,
but incoming DP selection with URI matching, as advised by Brian and
later referenced by Nate, is the perfect fit for my needs (using COR
lists to do the authorization).

COR is the way to go for authorization AFAIK from ITS times, but I did
not know incoming DP selection could be done on extra info.

-Carlos


ROZA, Ariel @ 10/03/2017 16:59 -0300 dixit:
> Carlos,
> 
>  
> 
> Maybe something like this?
> 
> Inbound Leg Headers for Outbound Dial-Peer Matching
> http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/configuration/cube-book/inbound-hdr-for-outbound.html#concept_783172607421874995245657348632812
> 
>  
> 
>  
> 
> *De:*cisco-voip [mailto:cisco-voip-boun...@puck.nether.net] *En nombre
> de *Anthony Holloway
> *Enviado el:* viernes, 10 de marzo de 2017 03:29 p.m.
> *Para:* Carlos Mendioroz <t...@huapi.ba.ar>; cisco-voip@puck.nether.net
> *Asunto:* Re: [cisco-voip] CUBE call authorization ?
> 
>  
> 
> Fair enough.  I didn't understand what you were originally asking.  Good
> luck.
> 
>  
> 
> On Fri, Mar 10, 2017 at 9:52 AM Carlos Mendioroz <t...@huapi.ba.ar
> <mailto:t...@huapi.ba.ar>> wrote:
> 
> AFAIK, trusted list is just to enable signalling, but I want to
> differentiate what can each neighbour do.
> I need to talk to each SP, but I don't want one SP to be able to call
> via another...
> 
> Anthony Holloway @ 10/03/2017 10:44 -0400 dixit:
> > Maybe I'm missing what you're looking for, but why not just use the
> > built in ip address trusted list?
> >
> >
> 
> https://supportforums.cisco.com/document/46566/understanding-toll-fraud-enhancements-1512t
> 
> <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupportforums.cisco.com%2Fdocument%2F46566%2Funderstanding-toll-fraud-enhancements-1512t=02%7C01%7Cariel.roza%40la.logicalis.com%7Cd909c4b7d6974175222508d467e38043%7C2e3290cb8d404058abe502c4f58b87e3%7C0%7C0%7C636247674184942151=E011xo6yCv%2BmUX8vP89DOVgXUbQkoGYDfRrvArfl5uw%3D=0>
> >
> > On Thu, Mar 9, 2017 at 7:16 AM Carlos Mendioroz via cisco-voip
> > <cisco-voip@puck.nether.net <mailto:cisco-voip@puck.nether.net>
> <mailto:cisco-voip@puck.nether.net
> <mailto:cisco-voip@puck.nether.net>>> wrote:
> >
> > Hi,
> > I'm trying to migrate a CME install to a CUCM, and was
> thinking of doing
> > it gradually. In the end, the CME should be left as a CUBE,
> terminating
> > the ITSPs trunks.
> >
> > Now, I do want to have some sort of call authorization just to
> be on the
> > safe side, and not discovering that one SP ended up making
> calls accross
> > my GW. Thought of COR lists, but I found no easy way
> > to link a dial peer to an incoming call from a given SIP trunk.
> >
> > I'm currently using a prefix as a enablement "secret", but
> there has to
> > be a better way. I'm embarrased to admit I don't see it.
> > Help ?
> >
> > --
> > Carlos G Mendioroz  <t...@huapi.ba.ar
> <mailto:t...@huapi.ba.ar> <mailto:t...@huapi.ba.ar
> <mailto:t...@huapi.ba.ar>>>
> > LW7 EQI  Argentina
> > ___
> > cisco-voip mailing list
> > cisco-voip@puck.nether.net <mailto:cisco-voip@puck.nether.net>
> <mailto:cisco-voip@puck.nether.net <mailto:cisco-voip@puck.nether.net>>
> > https://puck.nether.net/mailman/listinfo/cisco-voip
> 
> <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpuck.nether.net%2Fmailman%2Flistinfo%2Fcisco-voip=02%7C01%7Cariel.roza%40la.logicalis.com%7Cd909c4b7d6974175222508d467e38043%7C2e3290cb8d404058abe502c4f58b87e3%7C0%7C0%7C636247674184942151=o0m9AEjkP91wYG7oTWiybKqb7oRwgNVdUkYP%2Falj7pQ%3D=0>
> >
> 
> --
> Carlos G Mendioroz  <t...@huapi.ba.ar <mailto:t...@huapi.ba.ar>> 
> LW7 EQI  Argentina
> 

-- 
Carlos G Mendioroz  <t...@huapi.ba.ar>  LW7 EQI  Argentina
___
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Re: [cisco-voip] CUBE call authorization ?

[ROZA, Ariel]

Carlos,

Maybe something like this?

Inbound Leg Headers for Outbound Dial-Peer Matching
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/configuration/cube-book/inbound-hdr-for-outbound.html#concept_783172607421874995245657348632812


De: cisco-voip [mailto:cisco-voip-boun...@puck.nether.net] En nombre de Anthony 
Holloway
Enviado el: viernes, 10 de marzo de 2017 03:29 p.m.
Para: Carlos Mendioroz <t...@huapi.ba.ar>; cisco-voip@puck.nether.net
Asunto: Re: [cisco-voip] CUBE call authorization ?

Fair enough.  I didn't understand what you were originally asking.  Good luck.

On Fri, Mar 10, 2017 at 9:52 AM Carlos Mendioroz 
<t...@huapi.ba.ar<mailto:t...@huapi.ba.ar>> wrote:
AFAIK, trusted list is just to enable signalling, but I want to
differentiate what can each neighbour do.
I need to talk to each SP, but I don't want one SP to be able to call
via another...

Anthony Holloway @ 10/03/2017 10:44 -0400 dixit:
> Maybe I'm missing what you're looking for, but why not just use the
> built in ip address trusted list?
>
> https://supportforums.cisco.com/document/46566/understanding-toll-fraud-enhancements-1512t<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupportforums.cisco.com%2Fdocument%2F46566%2Funderstanding-toll-fraud-enhancements-1512t=02%7C01%7Cariel.roza%40la.logicalis.com%7Cd909c4b7d6974175222508d467e38043%7C2e3290cb8d404058abe502c4f58b87e3%7C0%7C0%7C636247674184942151=E011xo6yCv%2BmUX8vP89DOVgXUbQkoGYDfRrvArfl5uw%3D=0>
>
> On Thu, Mar 9, 2017 at 7:16 AM Carlos Mendioroz via cisco-voip
> <cisco-voip@puck.nether.net<mailto:cisco-voip@puck.nether.net> 
> <mailto:cisco-voip@puck.nether.net<mailto:cisco-voip@puck.nether.net>>> wrote:
>
> Hi,
> I'm trying to migrate a CME install to a CUCM, and was thinking of doing
> it gradually. In the end, the CME should be left as a CUBE, terminating
> the ITSPs trunks.
>
> Now, I do want to have some sort of call authorization just to be on the
> safe side, and not discovering that one SP ended up making calls accross
> my GW. Thought of COR lists, but I found no easy way
> to link a dial peer to an incoming call from a given SIP trunk.
>
> I'm currently using a prefix as a enablement "secret", but there has to
> be a better way. I'm embarrased to admit I don't see it.
> Help ?
>
> --
> Carlos G Mendioroz  <t...@huapi.ba.ar<mailto:t...@huapi.ba.ar> 
> <mailto:t...@huapi.ba.ar<mailto:t...@huapi.ba.ar>>>
> LW7 EQI  Argentina
> ___
> cisco-voip mailing list
> cisco-voip@puck.nether.net<mailto:cisco-voip@puck.nether.net> 
> <mailto:cisco-voip@puck.nether.net<mailto:cisco-voip@puck.nether.net>>
> 
> https://puck.nether.net/mailman/listinfo/cisco-voip<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpuck.nether.net%2Fmailman%2Flistinfo%2Fcisco-voip=02%7C01%7Cariel.roza%40la.logicalis.com%7Cd909c4b7d6974175222508d467e38043%7C2e3290cb8d404058abe502c4f58b87e3%7C0%7C0%7C636247674184942151=o0m9AEjkP91wYG7oTWiybKqb7oRwgNVdUkYP%2Falj7pQ%3D=0>
>

--
Carlos G Mendioroz  <t...@huapi.ba.ar<mailto:t...@huapi.ba.ar>>  LW7 EQI  
Argentina
___
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Re: [cisco-voip] CUBE call authorization ?

[Anthony Holloway]

Fair enough.  I didn't understand what you were originally asking.  Good
luck.

On Fri, Mar 10, 2017 at 9:52 AM Carlos Mendioroz  wrote:

> AFAIK, trusted list is just to enable signalling, but I want to
> differentiate what can each neighbour do.
> I need to talk to each SP, but I don't want one SP to be able to call
> via another...
>
> Anthony Holloway @ 10/03/2017 10:44 -0400 dixit:
> > Maybe I'm missing what you're looking for, but why not just use the
> > built in ip address trusted list?
> >
> >
> https://supportforums.cisco.com/document/46566/understanding-toll-fraud-enhancements-1512t
> >
> > On Thu, Mar 9, 2017 at 7:16 AM Carlos Mendioroz via cisco-voip
> > > wrote:
> >
> > Hi,
> > I'm trying to migrate a CME install to a CUCM, and was thinking of
> doing
> > it gradually. In the end, the CME should be left as a CUBE,
> terminating
> > the ITSPs trunks.
> >
> > Now, I do want to have some sort of call authorization just to be on
> the
> > safe side, and not discovering that one SP ended up making calls
> accross
> > my GW. Thought of COR lists, but I found no easy way
> > to link a dial peer to an incoming call from a given SIP trunk.
> >
> > I'm currently using a prefix as a enablement "secret", but there has
> to
> > be a better way. I'm embarrased to admit I don't see it.
> > Help ?
> >
> > --
> > Carlos G Mendioroz  >
> > LW7 EQI  Argentina
> > ___
> > cisco-voip mailing list
> > cisco-voip@puck.nether.net 
> > https://puck.nether.net/mailman/listinfo/cisco-voip
> >
>
> --
> Carlos G Mendioroz    LW7 EQI  Argentina
>
___
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Re: [cisco-voip] CUBE call authorization ?

[Carlos Mendioroz via cisco-voip]

AFAIK, trusted list is just to enable signalling, but I want to
differentiate what can each neighbour do.
I need to talk to each SP, but I don't want one SP to be able to call
via another...

Anthony Holloway @ 10/03/2017 10:44 -0400 dixit:
> Maybe I'm missing what you're looking for, but why not just use the
> built in ip address trusted list?
> 
> https://supportforums.cisco.com/document/46566/understanding-toll-fraud-enhancements-1512t
> 
> On Thu, Mar 9, 2017 at 7:16 AM Carlos Mendioroz via cisco-voip
> > wrote:
> 
> Hi,
> I'm trying to migrate a CME install to a CUCM, and was thinking of doing
> it gradually. In the end, the CME should be left as a CUBE, terminating
> the ITSPs trunks.
> 
> Now, I do want to have some sort of call authorization just to be on the
> safe side, and not discovering that one SP ended up making calls accross
> my GW. Thought of COR lists, but I found no easy way
> to link a dial peer to an incoming call from a given SIP trunk.
> 
> I'm currently using a prefix as a enablement "secret", but there has to
> be a better way. I'm embarrased to admit I don't see it.
> Help ?
> 
> --
> Carlos G Mendioroz  > 
> LW7 EQI  Argentina
> ___
> cisco-voip mailing list
> cisco-voip@puck.nether.net 
> https://puck.nether.net/mailman/listinfo/cisco-voip
> 

-- 
Carlos G Mendioroz    LW7 EQI  Argentina
___
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Re: [cisco-voip] CUBE call authorization ?

[mtarpey1]

it must be..

- Original Message -
From: Anthony Holloway 
Date: Friday, March 10, 2017 8:46 am
Subject: Re: [cisco-voip] CUBE call authorization ?
To: Carlos Mendioroz , cisco-voip@puck.nether.net

> Maybe I'm missing what you're looking for, but why not just use 
> the built
> in ip address trusted list?
> 
> https://supportforums.cisco.com/document/46566/understanding-
> toll-fraud-enhancements-1512t
> 
> On Thu, Mar 9, 2017 at 7:16 AM Carlos Mendioroz via cisco-voip <
> cisco-voip@puck.nether.net> wrote:
> 
> > Hi,
> > I'm trying to migrate a CME install to a CUCM, and was 
> thinking of doing
> > it gradually. In the end, the CME should be left as a CUBE, 
> terminating> the ITSPs trunks.
> >
> > Now, I do want to have some sort of call authorization just to 
> be on the
> > safe side, and not discovering that one SP ended up making 
> calls accross
> > my GW. Thought of COR lists, but I found no easy way
> > to link a dial peer to an incoming call from a given SIP trunk.
> >
> > I'm currently using a prefix as a enablement "secret", but 
> there has to
> > be a better way. I'm embarrased to admit I don't see it.
> > Help ?
> >
> > --
> > Carlos G Mendioroz LW7 EQI Argentina
> > ___
> > cisco-voip mailing list
> > cisco-voip@puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-voip
> >
>
___
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Re: [cisco-voip] CUBE call authorization ?

[Anthony Holloway]

Maybe I'm missing what you're looking for, but why not just use the built
in ip address trusted list?

https://supportforums.cisco.com/document/46566/understanding-toll-fraud-enhancements-1512t

On Thu, Mar 9, 2017 at 7:16 AM Carlos Mendioroz via cisco-voip <
cisco-voip@puck.nether.net> wrote:

> Hi,
> I'm trying to migrate a CME install to a CUCM, and was thinking of doing
> it gradually. In the end, the CME should be left as a CUBE, terminating
> the ITSPs trunks.
>
> Now, I do want to have some sort of call authorization just to be on the
> safe side, and not discovering that one SP ended up making calls accross
> my GW. Thought of COR lists, but I found no easy way
> to link a dial peer to an incoming call from a given SIP trunk.
>
> I'm currently using a prefix as a enablement "secret", but there has to
> be a better way. I'm embarrased to admit I don't see it.
> Help ?
>
> --
> Carlos G Mendioroz    LW7 EQI  Argentina
> ___
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>
___
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Re: [cisco-voip] CUBE call authorization?

[NateCCIE]

Dial peer groups don't work like you think they would. The round robin between 
all of the dial peers on the outbound side, with no looking at the destination 
pattern.

What I have settled on is using COR to restrict the dial peers.  As with dial 
peers groups above, and always, inbound dial peer matching is paramount.  For 
this I am using incoming URI matching. You can match all sorts of headers like 
from to via etc. 

Sent from my iPhone

> On Mar 9, 2017, at 10:15 AM, Pawlowski, Adam <aj...@buffalo.edu> wrote:
> 
> Carlos,
> 
> I have made use of the dial-peer group feature, available 15.4+, to set this 
> up:
> 
> http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/configuration/cube-book/multiple-outbound-dial-peer.html
> 
> You can more or less use that like an access list to say some particular dial 
> peer can only "see" a list of applicable dial peers to route to (with the 
> listed caveats).
> 
> I did put this together with COR but that was a massive pain. 
> 
> Regards,
> 
> Adam Pawlowski
> SUNYAB NCS
> 
> --
> 
> Message: 9
> Date: Thu, 9 Mar 2017 10:12:21 -0300
> From: Carlos Mendioroz <t...@huapi.ba.ar>
> To: cisco-voip@puck.nether.net
> Subject: [cisco-voip] CUBE call authorization ?
> Message-ID: <902f2bde-89bb-df5f-8eb8-78f308c06...@huapi.ba.ar>
> Content-Type: text/plain; charset=utf-8
> 
> Hi,
> I'm trying to migrate a CME install to a CUCM, and was thinking of doing
> it gradually. In the end, the CME should be left as a CUBE, terminating
> the ITSPs trunks.
> 
> Now, I do want to have some sort of call authorization just to be on the
> safe side, and not discovering that one SP ended up making calls accross
> my GW. Thought of COR lists, but I found no easy way
> to link a dial peer to an incoming call from a given SIP trunk.
> 
> I'm currently using a prefix as a enablement "secret", but there has to
> be a better way. I'm embarrased to admit I don't see it.
> Help ?
> 
> -- 
> Carlos G Mendioroz  <t...@huapi.ba.ar>  LW7 EQI  Argentina
> ___
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
___
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Re: [cisco-voip] CUBE call authorization?

[Pawlowski, Adam]

Carlos,

I have made use of the dial-peer group feature, available 15.4+, to set this up:

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube/configuration/cube-book/multiple-outbound-dial-peer.html

You can more or less use that like an access list to say some particular dial 
peer can only "see" a list of applicable dial peers to route to (with the 
listed caveats).

I did put this together with COR but that was a massive pain. 

Regards,

Adam Pawlowski
SUNYAB NCS

--

Message: 9
Date: Thu, 9 Mar 2017 10:12:21 -0300
From: Carlos Mendioroz <t...@huapi.ba.ar>
To: cisco-voip@puck.nether.net
Subject: [cisco-voip] CUBE call authorization ?
Message-ID: <902f2bde-89bb-df5f-8eb8-78f308c06...@huapi.ba.ar>
Content-Type: text/plain; charset=utf-8

Hi,
I'm trying to migrate a CME install to a CUCM, and was thinking of doing
it gradually. In the end, the CME should be left as a CUBE, terminating
the ITSPs trunks.

Now, I do want to have some sort of call authorization just to be on the
safe side, and not discovering that one SP ended up making calls accross
my GW. Thought of COR lists, but I found no easy way
to link a dial peer to an incoming call from a given SIP trunk.

I'm currently using a prefix as a enablement "secret", but there has to
be a better way. I'm embarrased to admit I don't see it.
Help ?

-- 
Carlos G Mendioroz  <t...@huapi.ba.ar>  LW7 EQI  Argentina
___
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Re: [cisco-voip] CUBE call authorization ?

[Carlos Mendioroz via cisco-voip]

GREAT!
That was the feature I was missing. I could not believe COR could not be
linked to a given peer.
The prefix was a kludge, works but is ugly.
Thanks!

Brian Meade @ 09/03/2017 11:43 -0400 dixit:
> I like to use the "voice class uri" feature to match the IP address in
> the Via header to an incoming
> dial-peer- 
> https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube_fund/configuration/xe-3s/asr1000/cube_fund-xe-3s-asr1000-book/voi-inbnd-dp-match-uri.html
> 
> This allows me to have a different incoming dial-peer for each SIP
> carrier and then a different one for CUCM without having to worry about
> the calling/called numbers.
> 
> On Thu, Mar 9, 2017 at 8:12 AM, Carlos Mendioroz via cisco-voip
> > wrote:
> 
> Hi,
> I'm trying to migrate a CME install to a CUCM, and was thinking of doing
> it gradually. In the end, the CME should be left as a CUBE, terminating
> the ITSPs trunks.
> 
> Now, I do want to have some sort of call authorization just to be on the
> safe side, and not discovering that one SP ended up making calls accross
> my GW. Thought of COR lists, but I found no easy way
> to link a dial peer to an incoming call from a given SIP trunk.
> 
> I'm currently using a prefix as a enablement "secret", but there has to
> be a better way. I'm embarrased to admit I don't see it.
> Help ?
> 
> --
> Carlos G Mendioroz  > 
> LW7 EQI  Argentina
> ___
> cisco-voip mailing list
> cisco-voip@puck.nether.net 
> https://puck.nether.net/mailman/listinfo/cisco-voip
> 
> 
> 

-- 
Carlos G Mendioroz    LW7 EQI  Argentina
___
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Re: [cisco-voip] CUBE call authorization ?

[Brian Meade]

I like to use the "voice class uri" feature to match the IP address in the
Via header to an incoming dial-peer-
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/cube_fund/configuration/xe-3s/asr1000/cube_fund-xe-3s-asr1000-book/voi-inbnd-dp-match-uri.html

This allows me to have a different incoming dial-peer for each SIP carrier
and then a different one for CUCM without having to worry about the
calling/called numbers.

On Thu, Mar 9, 2017 at 8:12 AM, Carlos Mendioroz via cisco-voip <
cisco-voip@puck.nether.net> wrote:

> Hi,
> I'm trying to migrate a CME install to a CUCM, and was thinking of doing
> it gradually. In the end, the CME should be left as a CUBE, terminating
> the ITSPs trunks.
>
> Now, I do want to have some sort of call authorization just to be on the
> safe side, and not discovering that one SP ended up making calls accross
> my GW. Thought of COR lists, but I found no easy way
> to link a dial peer to an incoming call from a given SIP trunk.
>
> I'm currently using a prefix as a enablement "secret", but there has to
> be a better way. I'm embarrased to admit I don't see it.
> Help ?
>
> --
> Carlos G Mendioroz    LW7 EQI  Argentina
> ___
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>
___
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

[cisco-voip] CUBE call authorization ?

[Carlos Mendioroz via cisco-voip]

Hi,
I'm trying to migrate a CME install to a CUCM, and was thinking of doing
it gradually. In the end, the CME should be left as a CUBE, terminating
the ITSPs trunks.

Now, I do want to have some sort of call authorization just to be on the
safe side, and not discovering that one SP ended up making calls accross
my GW. Thought of COR lists, but I found no easy way
to link a dial peer to an incoming call from a given SIP trunk.

I'm currently using a prefix as a enablement "secret", but there has to
be a better way. I'm embarrased to admit I don't see it.
Help ?

-- 
Carlos G Mendioroz    LW7 EQI  Argentina
___
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip