How to prevent "Toll Fraud through FXO lines"

To prevent toll fraud please follow below steps


Access-List
ip access-list extended 110
access-list 101 deny udp any any eq 2427 log
access-list 101 deny tcp any any eq 2428 log
access-list 101 deny tcp any any range 1718 1720 log
access-list 101 deny tcp any any eq 1731 log
access-list 101 deny tcp any any eq 2000 log
access-list 101 deny tcp any any eq 5060 log
access-list 101 deny udp any any eq 5060 log
access-list 101 permit ip any any

Next apply this access-list on the internet interface. It can be dialer in case of PPPoE internet and  FE in case of fixed IP broadband

ip access-group 110 in

Log is enabled to monitor the number of hits against each line. But if these logs increase CPU utilization then apply the access-list without log command in the end.

Port 5060 will be targeted more due SIP port.

UDP 2427 (MGCP)
TCP 2428 l (MGCP)
TCP 1718 1720 (H323)
TCP 1731 (MSICCP)
TCP 2000 (SCCP) SKiNNY  Cisco
TCP 5060 (SIP)
UDP 5060 (SIP)