This Guide explains and describes what permissions and limitations fro PBX users and administrators can be set to limit access to certain PBX services and features.
Updated: July 2018
Permalink: https://confluence.wildix.com/x/eQaIAQ
Introduction
ACL (Access Control List) is a number of permissions and limitations for PBX users and PBX administrators.
Via ACL for PBX users it is possible to forbid certain groups of users external calls to certain call classes, limit access to certain PBX services and UC features.
Via ACL for PBX administrators it is possible to limit access to certain WMS menus and forbid certain operations related to PBX management to groups of PBX admins.
Admin and Default ACL groups and permissions
ACL groups can be managed and created in WMS -> Users -> Groups.
By default there are two ACL groups on PBX:
- Admin (no limitations, assigned to “admin” user)
- Default (see Default ACL settings; assigned to new users by default)
ACL groups can be assigned to users in WMS -> Users -> select user / users -> “Group”:
All PBX users with admin permissions can:
- Edit permissions of ACL groups (click Edit permissions button to manage)
“admin” user in addition can:
- Create and delete ACL groups
- Set up inheritance
- Manage admin permissions for PBX administrators (click Edit admin permissions button to manage)
Note: ACL groups are shared via WMS Network. Detailed information about WMS Network can be found here: WMS Network.
Inheritance
Set up Inheritance: Select an ACL group: “Inherits from” (select the group)
Important: Wildix ACL groups support only single level inheritance.
Example: group B inherits from A; group C can't inherit from B because B already inherits from another ACL group A.
Note: “Cannot” rule has priority over “can”.
Example: group B inherits from A “Can” – “Intercom”, but inside group B we add “Cannot” – “Intercom”, as a result, use of Intercom is prohibited for this group of users.
ACL for outgoing calls – Supported countries for call classes
To forbid/ allow calls, use ACL "Can call / Cannot call".
Wildix PBX supports call classes for following countries:
- Austria
- Belgium
- Canada
- France
- Germany
- Italy
- Luxembourg
- Netherlands
- Spain
- Switzerland
- Portugal
- Ukraine
- United Kingdom
- USA
Call class detection for processing external calls
PBX differentiates national from foreign calls based on International Prefix in Dialplan -> General settings.
Country code in trunk settings is used for number normalization (number is not normalized if country code is empty)
Available classes for processing of calls inside configured country:
- National
- Mobile
- Emergency
- Free
- Premium1
- Premium2 (Germany, Austria)
Available classes for processing of calls to/ from other countries (see Call classes explanation):
- North America
- Africa
- Europe1
- Europe2
- South America
- Oceania
- Russia
- Asia1
- Asia2
Call class for unknown countries is 0 and call will not be blocked by ACL.
Recommendations to avoid calls to illegal destinations:
(as in Default ACL settings)
- First add the rule “cannot call All”
- Then add a number of “can call” rules
Setting up call classes in Dialplan
“Dial the trunk” and “Trunk group” Dialplan procedures allow you to define call classes and associate them to prefixes.
Example: assign calls to destination numbers which start with “03” to “Mobile” call class, remove the first digit (0) from the called number and route calls via the selected trunk (test5)
In case you do not set up call classes via Dialplan procedures, PBX evaluates the call prefix and assigns the call class to it, based on the logic described in the chapter Call classes explanation.
Call classes explanation
- Internal – internal calls
- Local - local calls
- National – recognized based on the National Prefix in Dialplan General Settings
- Mobile – recognized based on the Country Code in Dialplan General Settings
- Emergency – recognized based on the Country Code in Dialplan General Settings
- Free – recognized based on the Country Code in Dialplan General Settings
- Premium1 – recognized based on the Country Code in Dialplan General Settings
- Premium2 – recognized based on the Country Code in Dialplan General Settings
- Premium3 – not defined
- Premium4 – not defined
- North America – calls to numbers starting with 001 or +1
- Africa – calls to numbers starting with 002 or +2
- Europe1 – calls to numbers starting with 003 or +3
- Europe2 – calls to numbers starting with 004 or +4
- South America – calls to numbers starting with 005 or +5
- Oceania – calls to numbers starting with 006 or +6
- Russia – calls to numbers starting with 007 or +7
- Asia1 – calls to numbers starting with 008 or +8
- Asia2 – calls to numbers starting with 009 or +9
Prefixes per country for call class detection:
Notes
Difference between ALCs “Can / cannot” – Modify public phonebook” and “Can set / cannot set” “Phonebook”:
- Can / cannot Modify public phonebook: user in this group cannot modify any contact from public WMS phonebook
- Can set / cannot set Phonebook: user in this group can access only phonebooks located in “Selected” section in WMS -> Users (select user) -> Edit preferences -> Phonebooks
Note: at least one phonebook must be present in “Available” section (it can even be an empty phonebook).
APPENDIX 1. Default ACL permissions
The list of default ACL permissions of Default (users) and Admin (users with admin permissions) ACL groups:
| Group | Ability and access |
|---|---|
| Users |
|
| PBX admins |
|
APPENDIX 2. Full list of ACL permissions
| Ability | Access | Description |
|---|---|---|
| Can/ Cannot |
|
|
| Can set/ Cannot set |
|
|
| Can use/ Cannot use |
|
|
| Can call/ Cannot call |
| The description of call classes can be found in Call classes explanation Chapter |
APPENDIX 3. List of ACL admin permissions
| Ability | Access |
|---|---|
| Can/ Cannot manage PBX | Allow/ forbid managing Server and Client PBXes |
| Can/ Cannot manage group | Allow/ forbid managing any specific group |
| Can/ Cannot access menu |
|
| Can/ Cannot | Add and remove users |