Enhancing System Security
System Security Checklist
326
Administrator’s Guide for Avaya Communication Manager
November 2003
7
Restrict Call Forwarding Off Net on every class of service.
See
Class of Service
on page 696 for more information on Class of Service.
NOTE:
You cannot administer loop-start trunks if Call Forwarding Off Net is required.
8
If loop start trunks are administered on Communication Manager and cannot be changed by the
Local Exchange Company, block all class of service from forwarding calls off-net. In the Class of
Service screen,
Restriction Call Fwd-Off Net
field, set to y for the 16 (0-15) COS numbers.
See
Class of Service
on page 696 for more information.
NOTE:
If a station is call forwarded off-net and an incoming call to the extension establishes using
a loop-start trunk, incorrect disconnect supervision can occur at the Local Exchange
Central Office when the call terminates. This gives the caller recall or transfer dial tone to
establish a fraudulent call.
9
Administer Call Detail Recording on all trunk groups to record both incoming and outgoing calls.
See
Collecting Information About Calls
on page 503 for more information.
10
On the
Route Pattern
on page 1125, be careful assigning route patterns with an
FRL
of 0; these
allow access to outgoing trunking facilities. Avaya recommends assigning routes with an FRL of
1 or higher.
NOTE:
An exception might be assigning a route pattern with an FRL of 0 to be used for 911 calls
so even restricted users may dial this in emergencies.
Tip:
You can use the
list route-pattern print
command to print a copy of your FRLs and check
their status.
11
On all trunk group screens, set the
Dial Access
field to n. If set to y, it allows users to dial Trunk
Access Codes, thus bypassing all the ARS call screening functions.
12
On the
AAR and ARS Digit Analysis Table
on page 603, set all dial strings not required to
conduct business to den (deny).
13
If you require international calling, on the
AAR and ARS Digit Conversion Table
on page 607,
use only the 011+ country codes/city codes or specific dial strings.
14
Assign all trunk groups or same trunk group types a unique Class of Restriction. If the trunk group
does not require networking through Communication Manager, administer the Class of
Restriction of the trunk group where the
FRL
is 0, the
Calling Party Restriction
field is outward,
and all unique Class of Restriction assigned to your outgoing trunk groups are
n
. See
Class of
Restriction
on page 682 for more information.
Tip:
You can use the
list trunk-group print
command to have a printout of all your trunks
groups. Then, you can use the
display trunk-group x
command (where x is the trunk
group) to check the COR of each trunk group.
15
For your AUDIX, on the System Appearance screen, set: