Security and Policy Enforcement
Domain 5 - Security and Policy Enforcement
This domain (25%) covers keeping the dial plan from being abused and keeping signaling and media confidential: authorization beyond reachability, toll-fraud controls, secure cluster operation, and identity integration.
Authorization vs reachability
A CSS answers can the digits reach this pattern? Class of Restriction (COR) answers is this caller allowed to use it? Named CORs are configured under Class of Control and assigned to calling devices and the destinations they may reach; when no COR matches, the call is denied and the trace shows Call Rejected with cause 63 - not a missing pattern. Use both layers: CSS to steer, COR to authorize.
Toll-fraud controls
- Keep international and premium patterns out of general CSSs, and require Forced Authorization Codes (FAC) on those patterns for the few users who need them; Client Matter Codes (CMC) are for billing, not authorization.
- On PSTN trunks enable Block OffNet to OffNet Transfer and Block OffNet to OffNet Forward so an outside caller cannot be transferred or forwarded back out.
- Restrict call forwarding to external numbers and audit route patterns that match
@or!broadly.
Secure signaling and media
Cluster security mode (Non Secure, Mixed, Secure) determines whether phones download a CTL file. In mixed mode, CAPF issues Locally Significant Certificates and a phone security profile sets Device Security Mode to authenticated or encrypted, giving TLS signaling and SRTP media. SIP trunk security profiles enable TLS on 5061, digest authentication, and X.509 subject-name checking. SAML SSO gives administrators and Jabber users single sign-on using IdP metadata, a trusted tomcat certificate, and synchronized NTP.
Worked example
A contractor's phone can dial local but not international, because the international route pattern sits in partition INTL, which is absent from the contractor CSS. Yet the contractor receives an outside call, presses Transfer, and reaches an international number - the transferred call was routed using the inbound trunk's CSS, not the phone's. The fix is to enable Block OffNet to OffNet Transfer and Block OffNet to OffNet Forward on the PSTN trunk, and require an FAC on the international pattern.
Traps that cost marks
- Believing a restrictive CSS alone prevents toll fraud; transfers and forwards pivot on the trunk's CSS.
- Confusing FAC (authorization) with CMC (accounting).
- Forgetting that phone security profile changes require a phone reset and that the CTL must be updated after certificate changes.
- Locking yourself out with SAML SSO; know the CLI recovery path (
utils sso disable).