После настройки роутера Cisco 3725 регулярно проходят несанкционированные исходящие звонки на украинский мобильный телефонный номер (он жалуется, видимо номер где-то совпадает).
Звонки идут с calling number 2000 и 1000, но у нас нет таких номеров в dial-peer (внутренние номера 100-109).
Возможно это взлом VoIP роутера? Проверил CCO MD5 образа IOS - все совпадает с сайтом Cisco.

Звонок регистрируется на sh isdn history (деталей нет, номер видимо не полный, второй номер мой для проверки).

                                ISDN CALL HISTORY
--------------------------------------------------------------------------------
Call History contains all active calls, and a maximum of 100 inactive calls.
Inactive call data will be retained for a maximum of 15 minutes.
--------------------------------------------------------------------------------
Call    Calling      Called       Remote  Seconds Seconds Seconds Charges
Type    Number       Number       Name    Used    Left    Idle    Units/Currency
D-DSL   DSL          Int-id       B-chan  Callid  Conn    Disc    Call Type
                                                          Updated
--------------------------------------------------------------------------------
Out        2000 +2599244732                     6                      0

In    ---N/A---      248986                   100

sh run   P.S. настройки SIPа пока не работают (пока не удалось поднять линк), а также тормозит интернет на компьютерах за NATом.

Building configuration...
Current configuration : 7660 bytes
!
! Last configuration change at 13:14:41 Ukraine Fri Oct 12 2012 by tavrid
! NVRAM config last updated at 10:49:58 Ukraine Thu Oct 11 2012 by admin
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
!
hostname Cisco3725
!
boot-start-marker
boot system flash:c3725-adventerprisek9_ivs-mz.124-15.T14.bin
boot-end-marker
!
no logging console
enable secret 5 $1$2G*******
!
aaa new-model
!
!
aaa authentication login default local
!
!
aaa session-id common
clock timezone Ukraine 2
clock summer-time Ukraine recurring last Sun Mar 2:00 last Sun Oct 2:00
no network-clock-participate slot 2
!
!
no ip source-route
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.1 192.168.1.125
!
ip dhcp pool LAN
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.1
   dns-server 212.109.32.5 212.109.32.9
   option 150 ip 192.168.1.1
!
!
no ip bootp server
ip domain name aquatour.local
ip name-server 212.109.32.5
ip name-server 212.109.32.9
!
multilink bundle-name authenticated
!
isdn switch-type basic-net3
!
!
!
voice service voip
 notify redirect ip2pots
 allow-connections h323 to h323
 allow-connections h323 to sip
 allow-connections sip to h323
 allow-connections sip to sip
 no supplementary-service h450.2
 no supplementary-service h450.3
 supplementary-service h450.12
 no supplementary-service sip moved-temporarily
 no supplementary-service sip refer
 redirect ip2ip
 fax protocol t38 ls-redundancy 0 hs-redundancy 0 fallback none
 h323
 sip
  bind control source-interface FastEthernet0/0
  bind media source-interface FastEthernet0/0
  registrar server
!
!
!
voice class codec 1
 codec preference 1 g711ulaw
 codec preference 2 g711alaw
 codec preference 3 g729r8
 codec preference 4 g729br8
 codec preference 5 g723r53
 codec preference 6 g723ar53
 codec preference 7 g723ar63
!
!
!
!
!
!
!
!
!
!
!
voice cause-code
!
!
!
!
!
username ***** privilege 15 password 7 00031******************
!
!
!
!
ip ssh time-out 60
ip ssh version 2
!
class-map match-any AutoQoS-VoIP-Remark
 match ip dscp ef
 match ip dscp cs3
 match ip dscp af31
class-map match-any AutoQoS-VoIP-Control-UnTrust
 match access-group name AutoQoS-VoIP-Control
class-map match-any AutoQoS-VoIP-RTP-UnTrust
 match protocol rtp audio
 match access-group name AutoQoS-VoIP-RTCP
!
!
policy-map AutoQoS-Policy-UnTrust
 class AutoQoS-VoIP-RTP-UnTrust
  priority percent 70
  set dscp ef
 class AutoQoS-VoIP-Control-UnTrust
  bandwidth percent 5
  set dscp af31
 class AutoQoS-VoIP-Remark
  set dscp default
 class class-default
  fair-queue
!
!
!
!
!
interface FastEthernet0/0
 description === INTERNET:GT ===
 bandwidth 12500
 bandwidth receive 5000
 ip address 89.162.***.*** 255.255.255.252
 no ip redirects
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 auto qos voip
 no cdp enable
 service-policy output AutoQoS-Policy-UnTrust
!
interface FastEthernet0/1
 description === LAN ===
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface BRI1/0
 no ip address
 isdn switch-type basic-net3
 isdn overlap-receiving
 isdn point-to-point-setup
 isdn incoming-voice voice
 isdn sending-complete
 isdn static-tei 0
!
interface FastEthernet2/0
 description === LAN2 ===
 ip address 192.168.2.1 255.255.255.0
 duplex auto
 speed auto
 vlan-id dot1q 102
  description LAN2
  exit-vlan-config
 !
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 89.162.***.***
!
!
no ip http server
ip http authentication local
no ip http secure-server
ip http max-connections 2
ip http timeout-policy idle 180 life 300 requests 50
ip nat inside source list NAT interface FastEthernet0/0 overload
!
ip access-list extended AutoQoS-VoIP-Control
 permit tcp any any eq 1720
 permit tcp any any range 11000 11999
 permit udp any any eq 2427
 permit tcp any any eq 2428
 permit tcp any any range 2000 2002
 permit udp any any eq 1719
 permit udp any any eq 5060
ip access-list extended AutoQoS-VoIP-RTCP
 permit udp any any range 16384 32767
ip access-list extended NAT
 permit ip any any
!
!
!
!
!
!
tftp-server flash:apps41.8-4-1-23.sbn
tftp-server flash:cvm41sccp.8-4-1-23.sbn
tftp-server flash:jar41sccp.8-4-1-23.sbn
tftp-server flash:SCCP41.8-4-2S.loads
tftp-server flash:cnu41.8-4-1-23.sbn
tftp-server flash:dsp41.8-4-1-23.sbn
tftp-server flash:term41.default.loads
tftp-server flash:P00308010200.bin
tftp-server flash:P00308010200.sb2
tftp-server flash:P00308010200.loads
tftp-server flash:P00308010200.snb
tftp-server flash:P00308010200.sbn
!
control-plane
!
rmon event 33333 log trap AutoQoS description "AutoQoS SNMP traps for Voice Drop
s" owner AutoQoS
rmon alarm 33333 cbQosCMDropBitRate.34.14175073 30 absolute rising-threshold 1 3
3333 falling-threshold 0 owner AutoQoS
!
!
voice-port 1/0/0
 cptone RU
 caller-id enable
!
voice-port 1/0/1
 cptone RU
!
voice-port 1/1/0
 compand-type a-law
 cptone RU
 connection plar 500
 description Ukrtelecom-ISDN BRI
!
ccm-manager music-on-hold
ccm-manager sccp local FastEthernet0/0
!
!
sccp local FastEthernet0/1
sccp
!
!
dial-peer voice 24 pots
 incoming called-number 24898.
 direct-inward-dial
 port 1/1/0
!
dial-peer voice 2 pots
 destination-pattern 81T
 port 1/1/0
!
dial-peer voice 2222 voip
 description KIEV
 destination-pattern 44**
 voice-class codec 1
 session protocol sipv2
 session target sip-server
 incoming called-number 44***
 dtmf-relay rtp-nte
 no vad
!
!
sip-ua
 no remote-party-id
 max-forwards 10
 retry invite 3
 retry response 3
 retry bye 3
 retry cancel 3
 timers trying 1000
 registrar ipv4:62.*** expires 3600
 sip-server ipv4:62.***
 no suspend-resume
!
!
!
gatekeeper
 shutdown
!
!
telephony-service
 load 7960-7940 P00308010200
 load 7941 SCCP41.8-4-2S
 max-ephones 10
 max-dn 10
 ip source-address 192.168.1.1 port 2000
 auto assign 1 to 10
 user-locale RU
 network-locale RU
 time-format 24
 date-format dd-mm-yy
 max-conferences 8 gain -6
 moh moh.au
 multicast moh 239.0.0.1 port 2000 route 192.168.1.1
 transfer-system full-consult
 create cnf-files version-stamp 7960 Oct 10 2012 09:40:21
!
!
ephone-dn  1  dual-line
 number 100
!
!
ephone-dn  2  dual-line
 number 101
!
!
ephone-dn  3  dual-line
 number 102
!
!
ephone-dn  4  dual-line
 number 103
!
!
ephone-dn  5  dual-line
 number 104
!
!
ephone-dn  6  dual-line
 number 105
!
!
ephone-dn  7  dual-line
 number 106
!
!
ephone-dn  8  dual-line
 number 107
!
!
ephone-dn  9  dual-line
 number 108
!
!
ephone-dn  10  dual-line
 number 500
!
!
ephone  1
 device-security-mode none
 mac-address *
 type 7941
 button  1:4 2:10
!
!
!
ephone  2
 device-security-mode none
 mac-address *
 type 7941
 button  1:3
!
!
!
ephone  3
 device-security-mode none
 mac-address *
 type 7960
 button  1:1 2:10
!
!
!
ephone  4
 device-security-mode none
 mac-address *
 type 7960
 button  1:2 2:10
!
!
ephone  10
 device-security-mode none
!
!
!
line con 0
 transport output all
line aux 0
 transport output all
line vty 0 4
 privilege level 15
 transport input telnet ssh
 transport output all
!
ntp clock-period 17180696
ntp server 31.28.161.71
ntp server 62.149.0.30
!
end