Technical information

Small Business Communications Systems
5-22 Issue 7 June 2001
WARNING:
Each extension should be assigned the appropriate FRL to match its calling
requirements. All voice mail port extensions not used for Outcalling should be
assigned to FRL 0 (the factory setting).
 Deny access to pooled facility codes by removing pool dial-out codes 70,
890 899, or any others on your system.
 Create a Disallowed List or use the pre-prepared Disallowed List number 7
to disallow dialing 0, 11, 10, 1700, 1809, 1900, and 976 or 1 (wildcard) 976.
Disallowed List number 7 does not include 800, 1800, 411, and 1411, but
Avaya recommends that you add them. Assign all voice mail port
extensions to this Disallowed List. Avaya recommends assigning
Disallowed List number 7. This is an added layer of security, in case
outward restriction is inadvertently removed. (Voice messaging ports are
assigned, by default, to Disallowed List number 7.)
If Outcalling is required by voice messaging system extensions:
 Program an ARS Facility Restriction Level (FRL) of 2 on voice mail port
extensions used for Outcalling.
 If 800 and 411 numbers are used, remove 1800, 800, 411, and 1411 from
Disallowed List number 7.
 If Outcalling is allowed to long-distance numbers, build an Allowed List for
the voice mail port extensions used for Outcalling. This list should contain
the area code and the first three digits of the local exchange telephone
numbers to be allowed.
Additional general security for voice messaging systems:
 Use a secure password for the General Mailboxes.
 The default administration mailbox, 9997, must be reassigned to the
System Manager’s mailbox/extension number and securely password
protected.
 All voice messaging system users must use secure passwords known only
to the user.
Security Risks Associated with the Automated
Attendant Feature of Voice Messaging Systems
Two areas of toll fraud risk associated with the Automated Attendant feature of
voice messaging systems are:
 Pooled facility (line/trunk) access codes are translated to a menu prompt to
allow Remote Access. If a hacker finds this prompt, the hacker has
immediate access. (Dial access to pools is initially factory-set to restrict all
extensions: to allow pool access, this restriction must be removed by the
System Manager.)