The “Security Best Practices” section of the CME SRND should be required reading for all Cisco Voice engineers. Not as much a concern when using MGCP, due to how the POTS trunks are controlled… Until you go into fallback. So it IS still relevant! Be careful out there!

http://www.cisco.com/en/US/docs/voice_ip_comm/cucme/srnd/design/guide/security.html

If you restrict traffic between the CallManager and voice gateway, you will not be able to use the XLite SIP Phone.

You would need to modify the access-list or remove it temporarily.

Josh

Not everyone will need to make changes to their gateway. It is just something to think about.

Josh

I’ve always just used the ‘csim start’ command. This SIP method would allow an actual call.

I’d have to think about the ‘allow h323 to h323′. This would allow calls to forward off the VG. Not sure if I want that. But all I need is the ‘allow sip to h323′ for the XLite SIP Phone to work.

Also, if you restrict traffic between the CallManager and voice gateway with the firewall ACL, will the XLite SIP phone work? No SIP traffic from softphone to VG allowed.

You are completely right man. It worked flawlessly. Since the VGW I managed has all its channels for voice I think I don´t need to put any restriction, only the restrictions for dialing.

Anyway, thanks a lot for the tip.

Thanks,
Sephiroth