Configure Inbound Call Verification Policy

Before enabling inbound call verification feature, you need to configure inbound call verification policy on Yeastar Central Management, including signature valid time, certificate download timeout and rejection criteria.

Requirements

You have the permission to manage STIR/SHAKEN feature.
Note: If you don't have this permission, the STIR/SHAKEN tab (Path: Cloud PBX > Trunk Sharing) is not visible to you. In the case, you can still enable inbound call verification feature for a shared trunk, and the system will automatically inherit and use the inbound call verification policy configured by your service provider(if available).

Background information

When an inbound call is routed through a shared trunk, the associated PBX performs direct verification and obtains a verification status. If the status matches the pre-defined rejection criteria, the PBX will reject the call.

The following diagram (for reference only) illustrates the key steps of how a PBX verifies an inbound call.

Note: The bolded conditions in the diagram are determined by your custom inbound call verification settings.

Procedure

  1. Log in to Yeastar Central Management, go to Cloud PBX > Trunk Sharing > STIR/SHAKEN
  2. In the Verification Settings section, complete the following settings.
    Setting Description
    Signature Valid Time (s) Set the valid duration for a signature.

    If the time difference between the signing time and verifying time exceeds this value, the signature is considered invalid.

    Note: The supported value is 1 to 300.
    Certificate Download Timeout (s) Set the timeout for downloading SHAKEN certificate.
    Note: The supported value is 1 to 30.
    Drop Calls by Verification Status Select one or more verification statuses that will trigger call rejection.
    • Unsigned: The SIP Identify header is missing.
    • Invalid: The signature is invalid (e.g., a call with invalid signature or revoked certificate).
    • Attestation-C: The call comes from a legitimate gateway, but it cannot be confirmed whether the number belongs to a legitimate user and the number is authentic (e.g., a call routed through legacy PSTN or from international transfer).
  3. Click Save.

Result

The inbound call verification policy has been saved and can be applied to all shared trunks in the system.

What to do next

Enable Inbound Call Verification for a Shared Trunk