This document provides a sample configuration on how you can use Forced
Authorization Codes (FAC) in conjunction with route patterns to restrict the
access to long distance calls for certain groups of users.
Cisco recommends that you have knowledge of these topics:
The information in this document is based on Cisco CallManager 3.3 and
The information in this document was created from the devices in a
specific lab environment. All of the devices used in this document started with
a cleared (default) configuration. If your network is live, make sure that you
understand the potential impact of any command.
Refer to the
Technical Tips Conventions for more information on document
FAC and Client Matter Codes (CMC) allow you to manage call access and
accounting. CMC assists with call accounting and billing for billable clients,
while FACs regulate the types of calls that certain users can place. The FAC
feature forces the user to enter a valid authorization code before the call
connects. The FAC process is defined here:
A user dials a number that goes to a FAC-enabled route
Cisco CallManager tells the phone to play a special
The user enters the authorization code. The system then either waits
for the FAC Timer (T302/ or interdigit timer) to expire (default 15 seconds) or
for the user to press the "#" key.
Note: Since the FAC timer affects T302 timer, bear in mind that if you
adjust this timer to permit more time for FAC input, it extends the time for
normal calls as well.
If the code is correct, the call is extended to the exiting gateway
and Cisco CallManager generates a Call Detail Record (CDR) flagged with the FAC
This document illustrates how a company can restrict call routing for a
certain group of users using the FAC. For illustration purposes, consider an
organization with these two types of IP phone users:
This is the requirement:
The Employee IP phones should be granted access to long distance
calls only if the caller enters a FAC with the adequate access level.
The organization managers should be able to make long distance calls
from their IP phones without the need to enter a code.
Perform the configuration procedures in this section in order to meet
the requirements mentioned under the Background
This document uses this network setup:
Before you enable the FAC through the route patterns, you need to
define the FACs in Cisco CallManager Administration. Complete these steps in
order to accomplish this.
In Cisco CallManager Administration, choose
Feature > Forced Authorization
In the upper, right corner of the window, click Add a New
Forced Authorization Code.
Configure these parameters in the FAC Configuration window and
Authorization Code Name—Enter a unique name that
is no more than 50 characters. This name ties the authorization code to a
specific user or group of users.
Authorization Code—Enter a unique authorization
code that is no more than 16 digits. In our example, this code is configured as
12345. The user enters this code when the user places a call
through a FAC-enabled route pattern.
Authorization Level—Enter a three-digit
authorization level that exists in the range of 0 to 255; the default equals 0.
The level that you assign to the authorization code determines whether the user
can route calls through FAC-enabled route patterns. In order to successfully
route a call, the user authorization level must equal or be greater than the
authorization level that is specified for the route pattern for the call.
Complete these steps in order to enable FAC for the long distance route
In the Cisco CallManager Administration window, create two
different partitions. For example, LongDistanceEmployees and
and Using Partitions and Calling Search Spaces with Cisco CallManager
for information on how to create partitions.
Create two different Calling Search Spaces (CSSs) named
Employees and Manager.
Include the partition LongDistanceEmployees in the
Employees CSS and include the partition LongDistanceManager in
the the Manager CSS. Refer to
Search Space Configuration for more information on how to configure a
You need to create two separate long distance route patterns, one
that uses the partition LongDistanceEmployees and another that
uses the partition LongDistanceManager. Configure the route
pattern that uses the LongDistanceEmployees partition to use FAC. Complete
In the CallManager Administration window, choose Route
Plan > Route/Hunt > Route
Pattern and click Add a New Route
In the Route Pattern Configuration window, enter the long
distance route pattern and select the LongDistanceEmployees
partition for this route pattern.
Also select the correct Gateway or Route List along with any
other desired configuration. Check Require Forced Authorization
Code and enter the Authorization Level. The number that you specify in
this field determines the minimum authorization level that is needed to
successfully route a call through this route pattern. Click
Click Add a New Route Pattern in order to add
the long distance route pattern that uses the LongDistanceManager
In the Route Pattern Configuration window, enter the same long
distance route pattern (as in step 3b) and select the
LongDistanceManager partition for this route pattern. Ensure
that the correct Gateway or Route List is selected for this configuration.
Also, this route pattern should
configured to use FAC.
Under the IP Phone Configuration window, include the Employee IP
Phone Directory Number to the LongDistanceEmployees partition and to the
Employees CSS. Also, include the Manager IP Phone Directory Number to the
LongDistanceManager partition and to the Manager CSS.
Note: The CSS used by the Employee IP phones must
include the LongDistanceManager
partition, and the CSS used by the manager's IP phone must
include the LongDistanceEmployees
Complete these steps in order to restrict only one phone to use FAC to
make long distance calls.
Copy the route pattern configuration for that LD pattern and put it
in a new partition that can be only accessed by that
Create a separate Calling Search Space specific for that phone,
which also includes the LD partition.
Enable FAC for that route pattern so only the phone in question is
required to enter the code.
Complete these steps in order to verify if your configurations work
From Employee Extension 1000, call the long distance number
The system should play a tone that prompts for the authorization
code. Once the authorization code is entered, the call is connected.
Note: In order to immediately route the call after the user enters the
code, the users can press # on the phone. Otherwise the call
occurs after the interdigit timer expires, which equals 15 seconds by default.
From the Manager's Extension 1001, call the long distance number
The call should be connected without prompting for any
This section provides information you can use to troubleshoot your
When you dial the number that matches a route pattern with FAC
configured, you hear the tone to enter the FAC. But when you enter the FAC, you
receive a reorder tone and the call is released.
As a temporary workaround for this issue, go to the FAC Configuration
page and click Update.