Enable Inbound Call Filtering for a Shared Trunk

Requirements

Background information

Before delivering an incoming call to your shared trunk, the ITSP verifies the call and includes the signature verification result in the P-Asserted-Identity (PAI) header and the SHAKEN attestation level in a specific SIP header.

When the verification result is sent to the associated PBX, the PBX extracts the signature verification result and the SHAKEN attestation level from the result. If either of them matches the pre-defined rejection criteria, the PBX will reject the call.

The following diagram (for reference only) illustrates the key steps of how a PBX process the verification result provided by ITSP.

Prerequisites

P-Asserted-Identity: <sip:+1234567890;verstat=TN-Validation-Passed@203.0.113.45:50560>
P-Attestation-Indicator: C

Procedure

1. Log in to Yeastar Central Management, go to Cloud PBX > Trunk Sharing > Shared Trunks.
2. Click besides the desired shared trunk.

   

3. In the Advanced tab, scroll down to the STIR/SHAKEN section.
4. Turn on the switch of Upstream Verification Result Handling, and configure the following settings.

   

   1. In the Verification Status Parameter in PAI Header field, enter the parameter name defined by the ITSP to convey the signature verification result.

      In this example, enter verstat.

      Note: Both uppercase and lowercase letters are supported (case-sensitive).
   2. In the Header Field for SHAKEN Attestation Level field, enter the parameter name defined by ITSP to convey the SHAKEN attestation level.

      In this example, enter P-Attestation-Indicator.

      Note: Only hyphens (-) and letters (both uppercase and lowercase) are supported.
   3. Select the checkbox of Enable Call Filtering.
   4. In the Drop Calls by Verification Status drop-down list, select one or more verification statuses that will trigger call rejection.

      In this example, select No-TN-Validation, TN-Validation-Failed and C. If either the signature verification result or the SHAKEN attestation level matches the selected status, the inbound call will be rejected.

      Note: If your ITSP has defined custom verification statuses, click Create New to add them as needed. You can create up to 10 custom statuses.

      

      • B: The call comes from a legitimate user, but it cannot be confirmed whether the caller has the right to use the number (e.g., a call with a custom caller ID).
      • C: The call comes from a legitimate gateway, but it cannot be confirmed whether the number belongs to a legitimate user and the number is authentic (e.g., a call routed through legacy PSTN or from international transfer).
      • TN-Validation-Failed: Signature verification failed (e.g., a call with invalid signature or revoked certificate).
      • No-TN-Validation: No verification result available (e.g., a call without the Identity header).
5. Click Save.

Result

• The associated PBX uses the verification result provided by the ITSP and reject calls based on the rejection criteria.

  In this example, the PBX extracts the signature verification result TN-Validation-Failed from the verstat parameter and the SHAKEN attestation level C from the P-Attestation-Indicator parameter. Since either of them matches the rejection criteria configured in the Drop Calls by Verification Status, the inbound call is rejected.

• The inbound call filtering results can be checked on the associated PBX.
  • The SHAKEN attestation level and reject reason of each inbound call are recorded in the Call Detailed Records (CDR) (Path: Reports and Recordings > CDR).

    

  • When an inbound call is rejected, an event notification called Inbound Call Rejected due to STIR/SHAKEN Verification Failure will be triggered.