SIP REFER (blind transfer)

[Anonymous]

Hi All,

I've recently come across a 'function' on a few of the models we have inhouse. 320, 321 and  VVX600.

If I telnet to port 5060 on a persons individual phone and then paste the SIP REFER (blind transfer) message below, the phone makes the call to the external number without any involvement of the person at that phone. i.e it seems to auto answer and make the call.

REFER sip:223@172.20.30.240 SIP/2.0
Via: SIP/2.0/TLS 172.20.30.4:5061;branch=z9hG4bKnashds7
Max-Forwards: 70
From: <sip:172.20.30.4>;tag=1234567
To: 223 <sip:223@172.20.30.4>
Call-ID: 1234560183434
CSeq: 1 REFER
Refer-To: <sip:<EXTERNAL NUMBER>@172.20.30.240>
Refer-Sub: false
Contact: <sip:172.20.30.4>
Content-Length: 0

I see this as open to abuse and would like to know if there is any way I can restrict this behaviour?

Cheers

Byron

[SteffenBaierUK]

Hello Byron,

welcome to the Polycom Community.

This is a SIP standard functionality and if you have ports exposed to the internet I would suggest you check the voIpProt.SIP.requestValidation.x.request and voIpProt.SIP.requestValidation.x.method parameters in the Admin guide.

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

Polycom Global Services

[Anonymous]

Thank you Steffen, I'll have a look in to that.

Just FYI, the same does not happen with either Digium D70 nor Yealink T42G, or indeed with any softphone I've tried. The problem only occurs on the Polycom handsets. Also, these phones are all on a LAN with no internet access.

I'll have a look, however, at your suggestions above and go from there.

Many thanks for your time.

Regards

Byron

[Anonymous]

Not sure how you're configured for SIP registration but try adding/setting these in your config file:

reg.1.server.1.address=<should be your SIP registrar/proxy address>
reg.1.outboundProxy.failOver.onlySignalWithRegistered="1"
reg.1.server.1.failover.reRegisterOn=”1”

These 3 settings worked for my IP7000 phones so they would ignore any SIP messages not from the registrar/proxy (which is the same server for me).

-Sam

---