Block incoming calls from a CLI

Sometimes calls with one caller number, or a whole range of them, must not get through, whichever customer sends them: a fraud source, a robocaller, a number a regulator asks you to stop. This tutorial catches them with an authentication rule that matches the CLI and sends the calls to a dedicated account that cannot make calls. Allow about 10 minutes.

The example blocks the CLI 92321234567 and then every CLI that starts with 9232.

Before you start

• You can add accounts under My Customers → Accounts.
• Decide whether you need a CDR for every rejected attempt. The CDRs show who tried and when, but every attempt writes a record to the database.

Method	Caller receives	CDR
Blocked account (step 2, option A)	403 Auth Failed (1)	No
Account without rates (step 2, option B)	403 No Rates Found for Account <id>	Yes, one per attempt

Step 1: Create the blocking account

1. Open My Customers → Accounts and click Add.
2. Enter Account Name: blocked-cli. No device will ever use it, so give it a long random password.
3. Select any Service Plan and Routing Group for now; option B replaces them.
4. Click Save & Close.

Result: the account blocked-cli exists.

Step 2: Make sure the account cannot call

Choose one of the two options.

Option A: no CDRs. In the Accounts list open the Actions menu of blocked-cli and click Block. Calls that authenticate to a blocked account are rejected before any rating, and nothing is written.

Option B: a CDR for every attempt.

1. Create a tariff plan without rates, No rates. See Tariffs.
2. Create a routing group No routes and set Use Connection under On-Net Routing to [ Disabled ], so that numbers of your own accounts are not reached on-net either. See Routing groups.
3. Open blocked-cli, select Service Plan No rates and Routing Group No routes, and click Save & Close.

Result: every call of blocked-cli is rejected.

Step 3: Add the CLI to the account

1. Open Actions → Authentication Rules of blocked-cli and click Add.
2. Enter Incoming CLI/ANI: 92321234567. Leave Remote IP Address empty, so the rule applies to calls from any source.
3. Click Save & Close.
4. To block a whole range, add another rule with Incoming CLI/ANI 9232*. * matches any tail, ? exactly one digit.

Result: calls with the CLI 92321234567, or any CLI starting with 9232, authenticate to blocked-cli and are rejected.

Caution

The switch picks the most specific authentication rule. A rule with a CLI beats a customer’s rule with only an IP address, so the block works for IP trunks. It does not catch calls to a DID: a rule with a matching Incoming CLD/DNIS, and the authentication rules of the DID Pool, rank higher. See Authentication.

Step 4: Test it

1. Send a test call with the CLI 92321234567 from one of your customers’ trunks, or ask a customer to.
2. Open Tools & Debugs → SIP Logs Viewer and find the call. The switch answered with the code from the table above.
3. With option B, open Reports → Call Records (CDRs) and filter by the account blocked-cli: the attempt is listed as a failed call.

What’s next

• For a long list of numbers, use the DNC CLI List under Vendors: upload a text file with one prefix per line, then enable DNCL enabled on the customer and DNCL Lookup on its accounts. Blocked calls get 470 Consent Needed. The list needs the Do-Not-Call module.
• System Management → Rules & Lists, when enabled on your environment, rejects calls whose CLI is in a list, with the SIP code of your choice.
• To reject calls by the number dialled instead, see Route and price calls by CLI or CLD.
• Translation rule examples: rules that rewrite unwanted numbers to BLOCK.