I was able to block offnet to offnet call transfers in my CUCM 7. environment thanks to the "Block OffNet to OffNet Transfer Service Parameter". But I have discovered one scénario that allows call fraud though:
We have to internal callers A and B and the External Callers C and D.
C calls A (the call is marked as offnet by the gateway so A won't be able to transfer to D for exemple)
A transfers to B (the call looses its offnet classification and becomes onnet)
B transfers to D
Is there any configuration that can be done to block this scénario
Very good question
To drop a conference call when no one is there as OnNET party in the call, we use a service parameter "Drop Ad Hoc Conference" set to "after all OnNet parties hang up".
I am not sure that this parameter is applied for this transfer scenario also, could you please change it once if there is no challenge in that and you can check.
Then, this seems to be a loophole in cucm. I was eagerly trying to find out something which blocks it or do trick, so firstly I came with below service parameter. I am not sure this really will do something here or not because I dont have a cucm in lab for testing so can't test it out.
Can please give your comments on it, will it effect ?
Use Original Call Classification for Transferred Calls:
Description: This parameter determines whether Unified CM classifies a call as internal or external during and after a call transfer based on the classification of the original call that was transferred. Call classification affects call treatment such as ring tone, forward destinations, and caller ID display. Valid values specify True (Unified CM classifies the call based on the original call classification) or False (Unified CM classifies the call as internal because transfers originate from an IP phone which is always internal). For example, when this parameter is set to True and an external (OffNet) call is received and transferred by an internal phone, Unified CM classifies the transferred call as external even during the consultation call. The ring tone that is used for the consultation call is the external ring tone and during the consultation call (including blind transfers), the selection in the Ignore Presentation Indicators (internal calls only) checkbox on the transfer destination's Phone Configuration window ceases to apply because the call is now considered external.
This is a required field.
Going by definition
For example, when this parameter is set to True and an external (OffNet) call is received and transferred by an internal phone, Unified CM classifies the transferred call as external...
After enabling this parameter call transfer from A to B will be tagged as OffNet because the original call classification ( C to A) is OffNet. So in that case internal call transfer (A->B) will be barred as OffNet to OffNet transfer is blocked.
Good question and very clever way to get around offnet to offnet transfer restriction. Unfortunately there is nothing in CUCM natively to prevent this, because as far as cucm is concerned this is an onnet to offnet call before the call is connected to C..