Fence the dial plan
Security and compliance
- Toll fraud. Auto-registration that can reach the PSTN, or a short translation that grows into an international pattern, is a class-of-service hole. Close the CSS. Do not start by rebooting.
- TLS is not SRTP. 5061 protects signaling. SRTP, RFC 3711, protects audio. Require both only on hops that can answer both.
- Recording. Gateway recording HTTP is 8090/TCP in the port chapter. SIPREC is RFC 7866. Whether you may record, and what you must tell the caller, is local law. This page is not legal advice.
- Emergency. Kari's Law and RAY BAUM'S Act are United States MLTS duties. Other countries have their own rules. A lab ladder is not your filing.
- Identity. LDAP on 389, 636, 3268, or 3269. Certificates from CAPF on 3804. A public DNS name for an internal service is a publish decision, not a convenience.
- This repository. No customer captures, no live credentials, no dial plans from a real company. Examples use documentation addresses already allowed in the campus checker.