Trunk outbound prepend prefix added in the call history

[fgc92210]

We are using Flowroute as a SIP Trunk carrier in the USA.
For security reasons, Flowroute recommends to use IP Based authentication, with a prefix in front of the number you dial.
So basically, when a user dials 1xxxyyyzzzz , the PBX sends NNNNNNN*1xxxyyyzzzz which is fine.
The issue is that in the web client we see the prefix sent with the number, and when we hit redial, it obviously does not work.

Beside changing the SIP Carrier authentication method to a less secure one, which would not need the prefix, anyone has a work around?
Thank you

 

[NickD_3CX]

In the WebClient, if you call a number the modify the number in the Outbound Rules (prefix and strip), then in the Call History of the WebClient you will see:

• The modified number if the call was answered by the far end (NNNNNNN*1xxxyyyzzzz in your case)
• The unmodified number of the call was not answered by the far end (1xxxyyyzzzz in your case)

This is how it works.

Although I don't understand completely why a lot of SIP Trunk Carriers call Auth-based trunks "unsecure", you can simply have Authentication AND can limit registrations only from the PBX's IP.
In fact, then you have double the security.

 

[fgc92210]

Thank you for your answer @NickD_3CX
I will go ahead and check it out.

I think they call it insecure, because if someone gets your credentials, but you are not limiting IP authentications, then someone from another part of the world can use your SIP trunk at your expense. I will get back to this post after my tests. Thanks!

 

[fgc92210]

FYI, I found Flowroute explanation on IP Authentication with tech prefix:

If your telephony devices connect from a static IP address, we strongly recommend disabling outbound SIP credentials and using IP-based authentication.

Outbound call authentication by SIP credentials is important if your telephony devices cannot use a static IP address (e.g. if you use a SIP softphone on a laptop that roams among networks, or if your Internet Service Provider gives you dynamic IP address assignment.)

However, VoIP hackers are increasingly attacking vulnerable telephony devices to steal SIP credentials. Hackers can commit outbound toll fraud if they steal your SIP credentials.

To avoid service interruption, ensure your clients are using IP-based authentication for outbound calls before disabling SIP credentials.

 

[fgc92210]

@NickD_3CX

From Flowroute, it is not possible to have authentication AND limit registration from a particular IP address.
I've done it no matter what. I do not have the tech prefix anymore which is good.

I'm just curious. What's the reason why an answered number vs non answered number would shot the prefix or not in the outbound call history?

In our case, we use different DID depending on who we call.
In order to do so, we use different trunk seizure prefixes.

When a call was answered, we see the number now without the tech prefix from flowroute, but we can't "redial" from the web interface because the number does not show the trunk seizure prefix we used.

 

[NickD_3CX]

I'm just curious. What's the reason why an answered number vs non answered number would shot the prefix or not in the outbound call history?

It has to do with the way some data is managed on the backend, in order to show it nicely in the Call History, but the handling is slightly different between when a call is answered and when it isn't.

We are looking though to adjust this at some point in the future, don't ask me for an ETA though.