unfortunately the meet me feature and CCM do not have a way to limit inbound calling based on the calling number

the only way i could think of doing this is using an H323 gateway since it's the only one with the ability to match dial-peers based on the calling number using the answer address option

HTH

one option that i got asked yesterday by a peer would be on how to do this with Unity and this could be helpful for you also

on CCM you need to create a CTI Route Point which will CFA to VM

on Unity create a routing rule for forwarded call coming from that CTI RP and have it use the attempt transfer to option, we'll need a dummy call handler which should already be configured

for the call handler under the transfer options use Yes, ring subscriber at this extension and type in the meet me. for security purposes i used the supervised transfer with hold and also asked for the name, announce and the option to accept or decline

this way when someone dials that number it will be routed to unity, unity will ask for their name, they will be on hold and unity will dial into the meet me announcing the new participant and giving you the option to accept or decline the transfer

i know this is not really the best security you could have but might be an option for you

HTH

Attached is an application note for a working config that uses a TCL script to authenticate PSTN callers before allowing them to dial extensions. This would prevent callers from directly dialing the meet me number from the PSTN.

We use an inbuilt TCL script that is supplied in the IOS image called 'clid_authen_collect'. This script authenticates the call with the ANI (Calling number) and DNIS (Called number) of the incoming call, or if this fails, it then prompts the user to enter an account number and then a PIN number. Since the call is coming in on an FXO (or FXS) port, there is no associated ANI and DNIS, so the script immediately prompts the user for the account number and PIN.

We do the AAA authentication by a local 'username XXX password YYY' command in the router config. The user keys in the account code and PIN (can use the # as a string terminator to speed the process up and if the values entered match a local username and password, it then prompts for the user to enter the actual destination telephone number.

I have also enabled syslog accounting for call detail records, so when the call completes you get a basic record of the called number and durations. If they wanted to use a full blown AAA server, they could run the authentication from this and this way keep a full log of all users calling in, and it would also log the CDR's for billing etc ...

The router needs the following files on the flash memory :

Test#sh flash

System flash directory:

File Length Name/status

1 14097360 c2600-is-mz.122-11.T.bin

2 14150 enter_account.au

3 14869 auth_fail_retry.au

4 11510 enter_pin.au

5 52644 enter_destination.au

[14190860 bytes used, 2062068 available, 16252928 total]

16384K bytes of processor board System flash (Read/Write)

Test#

(obviously needs the IOS image but the important files are the audio prompts)

The *.au files are the audio prompts that the IVR plays. These are in standard G711ulaw Sun/Next audio format.

When a call comes in, the caller will hear a prompt to enter the account code. Key in the account number, followed by a #, then key in the PIN , followed by #. They are prompted to enter the destination phone number, and this is matched on any subsequent voip or pots dial peers. In this case, it would be the meet me conference number.

In this example there is a username and password of 1000/1000 and 1001/1001.

Config and CDR log is in attached file (authenticated_IVR.txt)