I have a Cisco 2911 with a TDM card installed on it. This connects to all the analog phones. This IAD has extension 7123 on the pbx. It is set under advanced CIDR the ip of the IAD 10.21.10.12/32. From my understanding this is the only IP that is allowed to make phone calls from this extension. There is no user/pass just the whitelisted IP. The problem is that someone got into my system and started making calls from that extension.
How was someone able to register to that extension and ultimately make phone calls? My ultimate goal is to prevent anyone from registering and/or making phone calls from this Cisco device unless they are whitelisted by IP.
--------------------------------------------------------------------------------------------------------
7123,10.21.10.4,2263808_195453586_585318608@10.21.10.6,sofia/internal/sip:7123@10.21.10.6:5060;dtg=ACCESS_TG;reg-info=228b00,1606087989,10.21.10.6,5060,udp,pbx01,
uuid,direction,created,created_epoch,name,state,cid_name,cid_num,ip_addr,dest,presence_id,presence_data,accountcode,callstate,callee_name,callee_num,callee_direction,call_uuid,hostname,sent_callee_name,sent_callee_num,b_uuid,b_direction,b_created,b_created_epoch,b_name,b_state,b_cid_name,b_cid_num,b_ip_addr,b_dest,b_presence_id,b_presence_data,b_accountcode,b_callstate,b_callee_name,b_callee_num,b_callee_direction,b_sent_callee_name,b_sent_callee_num,call_created_epoch
6fdf196b-d1f9-4cb7-ab48-0367338af452,inbound,2020-11-22 17:53:52,1606085632,sofia/internal/7123@1.2.3.156,CS_EXECUTE,7123,7123,10.21.10.6,19295182629,7123@10.21.10.4,,,HELD,,,,6fdf196b-d1f9-4cb7-ab48-0367338af452,hostedpbx01,,,40bf2350-6102-4962-a19e-b897fded3e22,outbound,2020-11-22 17:53:52,1606085632,sofia/external/19295182629,CS_EXCHANGE_MEDIA,7123,7123,10.21.10.6,19295182629,,,,ACTIVE,19295182629,19295182629,SEND,7123,7123,1606085633
2b09a189-de33-40ce-8567-9b8950505ff1,outbound,2020-11-22 17:53:52,1606085632,sofia/external/19295182629,CS_SOFT_EXECUTE,19295182629,19295182629,10.21.10.6,19295182629,,,,ACTIVE,19295182629,19295182629,SEND,2b09a189-de33-40ce-8567-9b8950505ff1,hostedpbx01,19295182629,19295182629,223a73df-f251-49e0-b297-19347618b94f,outbound,2020-11-22 17:53:51,1606085631,sofia/external/19295182629,CS_EXCHANGE_MEDIA,19295182629,19295182629,10.21.10.6,19295182629,,,,ACTIVE,19295182629,19295182629,SEND,19295182629,19295182629,1606085638
How was someone able to register to that extension and ultimately make phone calls? My ultimate goal is to prevent anyone from registering and/or making phone calls from this Cisco device unless they are whitelisted by IP.
--------------------------------------------------------------------------------------------------------
7123,10.21.10.4,2263808_195453586_585318608@10.21.10.6,sofia/internal/sip:7123@10.21.10.6:5060;dtg=ACCESS_TG;reg-info=228b00,1606087989,10.21.10.6,5060,udp,pbx01,
uuid,direction,created,created_epoch,name,state,cid_name,cid_num,ip_addr,dest,presence_id,presence_data,accountcode,callstate,callee_name,callee_num,callee_direction,call_uuid,hostname,sent_callee_name,sent_callee_num,b_uuid,b_direction,b_created,b_created_epoch,b_name,b_state,b_cid_name,b_cid_num,b_ip_addr,b_dest,b_presence_id,b_presence_data,b_accountcode,b_callstate,b_callee_name,b_callee_num,b_callee_direction,b_sent_callee_name,b_sent_callee_num,call_created_epoch
6fdf196b-d1f9-4cb7-ab48-0367338af452,inbound,2020-11-22 17:53:52,1606085632,sofia/internal/7123@1.2.3.156,CS_EXECUTE,7123,7123,10.21.10.6,19295182629,7123@10.21.10.4,,,HELD,,,,6fdf196b-d1f9-4cb7-ab48-0367338af452,hostedpbx01,,,40bf2350-6102-4962-a19e-b897fded3e22,outbound,2020-11-22 17:53:52,1606085632,sofia/external/19295182629,CS_EXCHANGE_MEDIA,7123,7123,10.21.10.6,19295182629,,,,ACTIVE,19295182629,19295182629,SEND,7123,7123,1606085633
2b09a189-de33-40ce-8567-9b8950505ff1,outbound,2020-11-22 17:53:52,1606085632,sofia/external/19295182629,CS_SOFT_EXECUTE,19295182629,19295182629,10.21.10.6,19295182629,,,,ACTIVE,19295182629,19295182629,SEND,2b09a189-de33-40ce-8567-9b8950505ff1,hostedpbx01,19295182629,19295182629,223a73df-f251-49e0-b297-19347618b94f,outbound,2020-11-22 17:53:51,1606085631,sofia/external/19295182629,CS_EXCHANGE_MEDIA,19295182629,19295182629,10.21.10.6,19295182629,,,,ACTIVE,19295182629,19295182629,SEND,19295182629,19295182629,1606085638