WHAT IS NUMBER PRESENTATION | SPOOFING?

A presentation number is a number nominated or provided by the caller that can identify that caller or be used to make a return or subsequent call. In the UK the industry has recognised a number of scenarios where presentation numbers may be provided, as a commercial service, to meet differing customer calling requirements. The purpose of this guide is to describe the various types of presentation number service that have been developed to meet these end-user requirements and the conditions that are to be observed for their use.

Unlike a network number, a presentation number will not necessarily identify a caller's point of ingress to a public network. However, it may well carry more useful information.

NUMBER PRESENTATION REQUIREMENTS

The requirements of a presentation number on the VoiceHost network are that:

(i) It must either be
                (a) a dial-able number, or
                (b) a number that has been received from the public network and passed on unchanged

(ii) It will have been allocated either to the caller or if allocated to a third party, only used with the third party's explicit permission

(iii) it must not be a number that connects to a Premium Rate Service prefixed 09 or 070, or to a revenue sharing number that generates an excessive or unexpected call charge (NB the exploitation of a Presentation Number to generate revenue sharing calls may constitute persistent misuse of an Electronic Communications Network or Electronic Communications Service).

(iv) It is supported by an underlying network number.

PROTECTING VOICEHOST CUSTOMERS

We will not allow calls into our network to present excessive revenue generating types 09 and 070. These Inbound calls will be marked as number 'withheld'. 

BENEFITS OF CLI MANIPULATION

Number presentation manipulation of the Calling Line Identifier (CLI) can be beneficial in order to:

1. Centralised and controlled callbacks to improve telephony capability and efficiency
2. Protect the privacy of private extensions or mobiles (Pertinent for DISA / Dial-Through)
3. Give a valid return route should the caller not have a DDI
4. Allow for updated inward routing whilst telephone number porting is in progress.
5. Improved perception by giving a local or national geographic image of presence.

TYPES OF NUMBER PRESENTATION

• Type 1 - A presentation number generated by the subscriber's network provider. The number is stored in the network and applied to an outgoing call at the local exchange by the provider. Because the number is applied by network equipment there is no need for it to be verified each time a call is made – instead, the level of authenticity will depend on the checks made by a network provider that a subscriber is entitled to use a particular presentation number.
• Type 2 - A presentation number which identifies a caller's extension number behind a DDI switchboard. Although the number or a partial number is generated by the user's own equipment, the network provider is able to check that it falls within the range and length allocated to a particular subscriber. In this way, the authenticity of the number may be ensured. It should be noted that some network providers classify type 2 presentation numbers as network numbers (especially where the full number is constituted at the local exchange). This type of number is considered to carry sufficient authenticity to be classified as a network number and is carried as such by some networks.
• Type 3 - A presentation number limited to the far-end breakout scenario where a call's ingress to the public network may be geographically remote from where it was originated. The number is generated by the user's equipment and is not capable of being subjected to network verification procedures. Verification is based on a contract between the subscriber and the network provider in which the subscriber gives an undertaking that only authentic calling party numbers will be generated.
• Type 4 - A presentation number available for the onward transmission of the originating number where a call breaks into a private network and breaks out again before termination, as in a DISA scenario. On the break outbound leg, the number is generated by the user's equipment although it will have already been verified in consequence of having been delivered to the private network. To maintain the verification it is necessary to ensure that the number submitted by the private network is the number that was received. Network providers wishing to offer a type 4 service will require a contractual commitment from customers that they will only submit CLIs that have been received from the public network. Unlike other types of presentation numbers, type 4 numbers may not always be dial-able; this will depend on the nature of the number received from the public network.
• Type 5 - Presentation numbers that identify separate groups of callers behind a private network switch wishing to send different outgoing CLIs. A typical scenario is a call centre making calls on behalf of more than one client. Type 5 presentation numbers are generated by the user's equipment. Subscribers will need to enter into a similar contractual commitment with their network providers as for type 1 presentation numbers - which they are entitled to use the numbers they have selected.

SPOOFING APPLICATION PROCESS

A signed declaration by a person with subscription authority for the CLI to be presented must be received by VoiceHost prior to presenting the number over the VoiceHost network.

How to configure Draytek 27xx and 28xx series routers for VoIP

This config guide applies to following routers:

1. Draytek Vigor 2820
2. Draytek Vigor 2830

Settings to change:

1. Disable SIP ALG
2. Allow traffic to/from VoiceHost
3. Update Firmware to latest version
4. Untick "Accept large fragmented UDP packets" under the firewall configuration

SIP ALG
Issues such as one way audio, lack of incoming calls, registration issues and etc. can be due to SIP ALG

To disable SIP ALG you have to telnet into the router and enter the following commands.

 1. > sys sip_alg 0 -- Disables sip alg
 2. > sys commit -- Apply changes
 3. > sys reboot -- Reboot router

Once the router is back online, reboot the IP phone or press re-register.

Incoming Call Problems

This is caused by a large IP SIP packet that is fragmented, but the router will not forward it. I understand that the new version will work if the checkbox under firewall -> general setup -> Accept large incoming fragmented UDP or ICMP packets is UNTICKED. This is the opposite to what you would expect.

Paxton Access Net2Entry SIP Intercom Panel Configuration

Once the hardware and configuration utility is installed you should allocate an extension your VoiceHost control panel.

Enter the details for the extension into the SIP tab within the Paxton Access Net2Entry configuration utility.

VoIP calls can be instigated from the Intercom panel and once answered simply press '1' to release the door as per the Net2 settings.

Video codec negotiation is not optional nor transcode and should is forced to H.264 on all other endpoints on the VoiceHost Network.

You will be able to do the following which does have limitations:

1. Release the Net2 door ACU from any handset or softphone on the VoiceHost network. NOTE: You will not be able to release/open the door off-network (i.e mobile NTS) as DTMF is not carried are per RFC2833 'out-of-band'
2. Instigating a call directly to the panel will not work as the SIP stack does not register at custom intervals
3. The far-end will experience echo as the SIP stack doesn't allow the settings to be changed.

Enable SIP in the Net2Entry Configuration Utility

Load the Paxton Access Net2 Entry Configuration Utility and select the site you wish to enable SIP for. Navigate to the SIP Account tab and enter the VoiceHost SIP details as shown below.

You should now be able to make calls to your VoiceHost extension(s) via the Paxton Net2 Entry Intercom Panel

1. Download Zoiper Here
2. The only option required from this screen to make the softphone work is the Accounts button. All the other options are personal to your own requirements from the phone and will rarely be needed to get Zoiper working with your VoIP account.
3. After selecting Accounts you then need to add an account by tapping the + symbol highlighted above, then choose SIP account and enter your extension credentials:
   • Account name: This can be set as you wish and is merely for reference. If you’re configuring multiple accounts then it makes sense to set this to something relevant.
   • Domain: As per your VoiceHost control panel.
   • User name: As per your VoiceHost control panel.
   • Password: This is the password relevant to your ext/seat
   • Network Settings: In this option is another setting titled Refresh which should be set to 60.
4. With all the above done, come out of the Network Settings screen so your back at the SIP Account screen, scroll to the top and tap Register.
5. Your Zoiper softphone should now be registered.

Configuration instructions for Android and iOS

A browser extension which converts telephone numbers into clickable links to call using the VoiceHost desktop softphone application

How does it work?

This extension recognizes phone numbers on web pages and converts them into clickable links.

This is done by passing the phone number to the configured system protocol handler and from there to the application which registered this protocol handler. Just like an URL starting with “http”, a link can also start with other protocol specifiers, e.g. “tel”, “sip” or “callto”.

Phone numbers on a web page recognized by the extension and highlighted with an optional icon. When you click on a number. By clicking on this menu item the phone number is passed to the dial-pad of the desktop application “as is”.

Download the Extension for your browser:

How to configure pfSense firewall for VoIP

pfSense is a free and open source firewall and router that also features unified threat management, load balancing, multi WAN, and more.

Configure Ports

Configure your SIP and RTP ports. SIP port is the default 5060 and RTP is between 10000 and 65335.

Configure the WAN IP Address

Asterisk Example - Also be sure to specify "externip" or "externhost" in sip.conf. externhost configured to a dyndns.org account that resolves to my WAN ip address.

Configure NAT

Asterisk Example - Make sure you have "nat=yes" and "canreinvite=yes" in sip.conf

Configure your local network

Make sure you have localnet setup to correspond with your local network in sip.conf. You can use the RFC1918 method or CIDR method.

localnet=192.168.1.0/24

Configure your SIP context

In your SIP provider's context in sip.conf, make sure you have "outboundproxy=192.168.1.1", replacing 192.168.1.1 with whatever your pfSense running siproxd ip address is.

[sipconvergence]
type=peer
user=phone
host=SEE VOICEHOST CONTROL PANEL FOR DETAILS
outboundproxy=192.168.1.1
fromdomain=SEE VOICEHOST CONTROL PANEL FOR DETAILS
fromuser=<censored>
secret=<censored>
username=<censored>
insecure=very
context=ivr
authname=<censored>
canreinvite=yes

Please note that if you don't use a PBX like Aterisk and use a softphone to connect, you will use your pfSense ip address for the proxy instead of sip.sipconvergence.co.uk

Configure pfSense firewall/nat rules

RTP

Add a NAT rule for RTP. This is essential or you will have no audio or one way audio in your calls. Also change the NAT IP to whatever your Asterisk server is and change the description to something that makes sense for you.

Interface: WAN
Protocol: UDP
External port range: From: 10000
External port range: To: 65335
NAT IP: 192.168.1.50
Local Port: 10000
Description: Hosted PBX - RTP
Enable Auto-add a firewall rule to permit traffic through this NAT rule

SIP

Add a NAT rule for SIP. This is essential or you won't be able to receive calls and you may have trouble registering with your SIP provider. Also change the NAT IP to whatever your Asterisk server is and change the description to something that makes sense for you.

Interface: WAN
Protocol: UDP
External port range: From: 5060
External port range: To: 5060
NAT IP: 192.168.1.50
Local Port: 6000
Description: Hosted PBX - SIP
Enable Auto-add a firewall rule to permit traffic through this NAT rule

The SIP Proxy siproxd

Install siproxd

Go to the pfSense web UI and going to System -> Packages. Hit the "+" button to the right of siproxd and let pfSense install the SIP proxy.

Configure siproxd

Go back to the main pfSense web UI page then go to Services -> siproxd. It may be under Services -> SIP Proxy as well. siproxd configured, be sure to change your "Outbound Proxy Hostname" to the hostname or IP (IP in my case) to your sip provider. Options not specified, leave blank or default.

Inbound Interface: LAN
Outbound Interface: WAN
Enable RTP Proxy: Enable
RTP Port Range (lower): 7070
RTP Port Range (upper): 7080
Outbound Proxy Hostname: xx.xx.xx.xx

Summary

Basically when you make a call your asterisk box will talk to the SIP proxy, the SIP proxy will then talk to your VoIP provider. When you receive a call your VoIP provider will talk directly with your asterisk box (this is important for setting "externip" or "externhost" in sip.conf).

QoS (Traffic Shaping) Traffic shaping can be enabled to allow n simultaneous 64kbps calls to happen and guarantee bandwidth. Please refer to http://doc.pfsense.org/index.php/Traffic_Shaping_Guide for traffic shaping help.

Outbound calls error with "all circuits busy" or "congestion":

This is the default configuration of Asterisk regardless of the actual error generated (which is infuriating when you are trying to diagnose the real problem) unless PBX is updated to send back the real error rather than the changed error. This error most commonly occurs when the call is not authenticating properly, at which point check the above in the SIP trunk configuration (If Asterisk, swap username= for defaultuser= to see if this solves the issue. Just because a trunk is showing as registered does not mean it will authenticate correctly.

Outbound calls fail with SIP error 488 (Not Accepted Here) or I-SUP errors 58 (bearer capability not available) or 88 (incompatible destination):

Check the codecs allowed in the SIP trunk configuration above, VoiceHost only supports: alaw, ulaw, gsm
If a codec is defined in Asterisk that is not one of the above, or is offering a differing sample rate or interval rate (e.g. 8000/20i - 8000Hz at 20ms) cannot interwork with 16000/30i - 16000Hz at 30ms) the call will fail and the codecs in the SIP trunk configuration need to be aligned to use one of the above codecs.

Inbound calls fail with SIP error 408 (Request Timeout):

Check the inbound number is mapped in the system correctly, if necessary the SIP trunk on the portal can be configured to strip the plus, e.g. if Asterisk is configured to use plus somewhere else. Check the trunk is registered. Ascertain how long the 408 error took to come back if it was immediate the trunk is usually unregistered if it took a few seconds the number is usually not mapped correctly.

Calls fail with SIP error 503, I-SUP errors 34 or 38:

If our platform replies back with 503 it usually means the gateway trying to process the call can't due to "issues", or the customer has hit their Calls-Per-Second (CPS) limit and is sending too many calls at once. Sometimes the error is passed back from IP Exchange through VoiceHost to the customer's system, at which point the call will usually hunt to another route to try and place the call.
 

Initial Broadband fault checks for VoiceHost ADSL and FTTC connections

1. Check the router is set to an 'Always on' connection and not 'On demand'.
2. If you have ADSL try changing the ADSL Micro Filter, the most common cause of intermittent connections is a faulty filter. If you have FTTC please skip this step.
3. Please ensure that you change the RJ-11 lead between the microfilter/FTTC faceplate and the router/modem.
4. Make sure your router is connected to the BT Master Socket and no telephone extension leads are used between the wall and the router. Only use the supplied modem cable directly into the BT master socket.
5. You can also try disconnecting any additional devices connected to the phone line such as fax machines, Sky Box, Red Care alarm, Credit Card terminal/Paying Device, telephone extension leads, etc. to avoid any possible interferences coming from these devices.
6.  Swap the router out for a replacement.
7. Noises on the telephone line can cause disconnections in the broadband signal. In order to identify if this is the case please try a Quiet Line Test.
8. Connect only a phone, preferably a corded one, directly to the phone socket and dial 17070. It is recommended that you disconnect all devices from the line, such as ADSL routers, phones, faxes, credit card terminals, Sky Boxes and alarm systems.
   Once prompted, select option 2, and then observe the line for any cracklings, noises, interferences or clicks.
   If you do hear noises on the line, please contact the line provider and inform them that your line is experiencing high noise on the line and this is affecting your broadband signal.
   If you are still experiencing disconnects after carrying out the above checks please contact the support department to carry out further fault diagnostics on the line.

NOTE: It may require an engineer visit to resolve the issue, therefore it is important to carry out the above checks to rule out any equipment faults on site. Any engineer visits that do not find a fault within the provider network are chargeable.

System Preparation

Before configuring the SIP trunk it is required to go through the following checklist and make changes where necessary:

• NAT (when used) created to 3CX
  ( https://www.3cx.com/docs/ports/ )
• Firewall Checker passed
  ( https://www.3cx.com/docs/troubleshooting-firewall-checker/ )
• Firewall SIP ALG checked and if present disabled
  ( https://www.3cx.com/docs/manual/firewall-router-configuration/ )

Further setup information can be found in our Academy:  3CX Academy Basic Course

3CX Version

Some providers gained support and compatibility with 3CX on a specific product version. It is advisable to always run the latest version of 3CX to ensure ongoing compatibility.

Minimum 3CX Version: 3CX Phone System 16.0

Provider Capabilities

Below is a short overview of the provider's capabilities and services and whether they’re supported or not:

• CLNS (Clip No Screening): No
• Catch All Routing: Yes
• Fax in T38: Yes
• CLIR (Number Suppression): Yes
• DTMF via RFC 2833: Yes
• Outbound Codec Order: G711A, G711U, G722, GSM, Opus
• NAT Support: Yes

Configuring the Trunk with 3CX

The general instructions outlining how to add a new SIP Trunk to your 3CX installation can be found  here .

Adding the Trunk

Go to  “SIP Trunks”  and select  “Add SIP Trunk”

• Select Country: UK
• Select Provider in your Country: VoiceHost
• Main trunk number: This will have been provided to you by VoiceHost. You must enter the number in the E164 number format (e.g. +44123456789)
• Press OK

Under the  “General”  tab in the  “Authentication”  section, enter your Authentication ID and Password as well as the registrar address (these will be supplied to you by VoiceHost).

Adding Additional DIDs

To associate all other DIDs/Numbers you have in your VoiceHost account with 3CX, go to the Management Console → SIP Trunks, double-click on your VoiceHost Trunk and go to the  “DIDs”  tab

Here you should already see 1 entry; that is the Main Trunk number you have set. Add all other DIDs/Numbers you have to the list in the E164 number format (e.g. +44123456789) and press OK.

Creating Inbound Rules

Now that you have associated all your DIDs/Numbers with your SIP Trunk in 3CX, you can create Inbound Rules to set where calls will be routed when those numbers are called. Instructions on how to create Inbound Rules can be found  here .

Number Format

General

When configuring VoiceHost SIP Trunks in 3CX, all numbers should be entered in the E.164 number format (e.g. +44123456789), otherwise, call routing will fail.

Outbound Caller ID

VoiceHost trunks do not support Clip No Screening which means you can only present numbers that are associated with your account as Outbound Caller ID.

Outbound Rules

When configuring your Outbound Rules, numbers can be dialled in all valid number formats. More information about how to create Outbound Rules and how they work can be found here

Enabling TLS and SRTP

Under the 'General' tab please update the host to the one shown in the VoiceHost portal. This changes for TLS and SRTP so it will only be changed once enabled.
Under Options, please also upload the linked PEM under the option for the trunks 'TLS Root'.
Ensure SRTP is enabled.
Ensure TLS is set and the transport.
Ensure that host port is set to 'Auto-Detect'

Root Certificate: download here (You will need to rename to .pem)