Legacy and custom setups
Legacy and custom phone setups
Texwan has worked on business phones since 2007, back in the ISDN and Nortel/Mitel days. That history means we can work with the system you already have instead of telling you to throw it out.
Keep your Nortel, add SIP
We can keep an existing Nortel system, and other legacy PBX systems, running and connect it to modern SIP trunks or a hosted system through gateways. No rip and replace required.
Move off 3CX and other platforms
We migrate businesses off 3CX and other platforms to a hosted system, with numbers, extensions and call flows planned before cutover.
Odd and custom configurations
Unusual call routing, mixed old and new hardware, multi-site setups. If it is unusual, we have probably seen something like it.
Hardware supplied and pre-configured
Phones and systems from Yealink, Yeastar, Grandstream and Sangoma, supplied and configured before they arrive so they work on day one.
Business Phone Systems / VoIP
Phone systems that ring, route 911 correctly and do not run up fraud bills.
Texwan has installed and supported IP phone systems since the early 3CX era. We design hosted and on-premises VoIP, number porting, SIP trunking, desk and mobile clients, paging and call center features, with security and federal 911 rules built in.
01 / Threat Briefing
Threat Briefing
The Communications Fraud Control Association estimated $38.95 billion in global telecom fraud losses in 2023, 2.5% of telecom revenue, and lists PBX fraud among the top fraud methods. (CFCA 2023 Global Fraud Loss Survey)
Federal rules apply to the phone system itself. Kari’s Law requires multi-line telephone systems to allow direct 911 dialing without a prefix and to notify a central location when 911 is called. Section 506 of RAY BAUM’S Act requires a dispatchable location to be sent with 911 calls. Kari’s Law is named for Kari Hunt, killed in a motel room in Marshall, Texas in 2013 after her daughter’s 911 calls failed because the phone system required dialing 9 first. (FCC)
The phone system is also software supply chain. In March 2023 CISA warned that the 3CXDesktopApp client had been trojanized in a supply chain attack. (CISA alert) Verizon reports that mobile-centric social engineering using texts and voice calls now succeeds 40% more often than email phishing. (Verizon 2026 DBIR)
02 / Risk and Compliance Matrix
Risk and Compliance Matrix
| Risk | Control or compliance mapping | Business impact |
|---|---|---|
| PBX or SIP account takeover used for international toll fraud | NIST SP 800-58 VoIP security (NIST); NIST CSF 2.0 PR.AA | Carrier bills in the thousands of dollars within a weekend |
| Phones that require a prefix for 911, or send the wrong location | Kari’s Law and RAY BAUM’S Act Section 506 (FCC MLTS 911 rules) | Delayed emergency response; FCC enforcement exposure |
| Outbound calls not signed, or caller ID spoofed in your name | FCC STIR/SHAKEN caller ID authentication (FCC) | Calls flagged as spam; customers stop answering |
| Voice on a flat, unprioritized network with SIP ALG enabled | NIST SP 800-58 network design for voice; NIST SP 800-207 segmentation (NIST) | Choppy audio, one-way audio and dropped calls |
| Unpatched phone system software and desktop clients | CISA 3CXDesktopApp advisory (CISA); CISA KEV (catalog) | Malware delivered through a trusted app on every desk |
03 / Architecture and Remediation Directives
Architecture and Remediation Directives
- Block international and premium-rate destinations by default; allow countries only on request. Set per-trunk spending and concurrent-call limits with the carrier.
- Restrict SIP registration and admin access to known IP ranges or a session border controller. Use long random SIP credentials and disable unused extensions immediately.
- Configure direct 911 dialing with no prefix, on-site notification to reception or security, and a dispatchable location (building, floor, suite) for every fixed and remote device.
- Confirm with your carrier that outbound calls are signed under STIR/SHAKEN with the right attestation, and register your numbers with the major analytics engines to reduce spam labeling.
- Put phones on a dedicated voice VLAN with QoS (DSCP EF for media) end to end; disable SIP ALG on firewalls and let the SBC or phone system handle NAT.
- Patch the phone system, phone firmware and softphone clients on a schedule and track vendor security advisories.
- Plan for circuit failure: route calls to mobile apps or a secondary site automatically when the primary internet circuit is down.
04 / Vendor-Neutral Verification Checklist
Vendor-Neutral Verification Checklist
Three checks you can run yourself, with or without us.
- 911 test. Contact your local PSAP (911 dispatch) through its non-emergency line to arrange a test call, then dial 911 from a desk phone without a prefix. Confirm reception receives the notification and that the dispatcher sees the correct floor or suite.
- Fraud exposure. Ask your provider in writing: which countries can we call right now, what is our per-day spending cap, and who is alerted when it is hit. If the answers are “all of them”, “none” and “nobody”, fix it before anything else.
- Call quality and attestation. Place calls to a mobile phone from several desk phones during a busy hour and listen for gaps. Ask your carrier which STIR/SHAKEN attestation level your outbound calls receive.
Moving from an older system
Guides for the system you have now
Nortel phone system support
Keep a Nortel or Mitel system running, or connect it to SIP.
Copper line replacement
Replace retiring copper lines, alarms and elevators included.
Switching
Questions people ask before they switch
Do we keep our phone numbers?
In most cases, yes. Numbers move by porting, which the losing carrier processes on a date we schedule with you. The FCC and other regulators set the porting rules; some number types, such as certain toll-free or non-geographic numbers outside the US, have their own processes. We check every number on your bill before quoting.
Will the phones go down during the switch?
The cutover is planned for a window you choose. Old and new systems run side by side until the port completes, and we test inbound, outbound and emergency calling before the old service is cancelled.
Can we reuse our existing desk phones?
Often. Many SIP desk phones from mainstream makers can be reprovisioned. Proprietary digital handsets from older systems such as Nortel or Mitel usually cannot be used with hosted voice, but they can stay in service behind a SIP gateway while you plan.
What happens to our current contract?
Send us the contract or the last bill. We note the end date and any early termination terms so you can choose a cutover date that avoids overlap or penalties where possible.
Do you handle emergency calling?
Yes. We set up direct dialing of the local emergency number and register a validated address and location detail for each site or phone, as the rules in that country require. In the US that means Kari’s Law and RAY BAUM’S Act for multi-line systems.
Who do we call after the switch?
Us. Requests come in through the client portal, email or phone and are answered within one business day.
Next step
Request a phone system review
Send the basics: number of users and sites, current provider and contract end date. We reply within one business day.
Sources
- CFCA: Telecommunications fraud increased 12% in 2023
- FCC: Multi-line Telephone Systems, Kari’s Law and RAY BAUM’S Act 911 requirements
- FCC: Combating Spoofed Robocalls with Caller ID Authentication (STIR/SHAKEN)
- CISA: Supply Chain Attack Against 3CXDesktopApp
- NIST SP 800-58, Security Considerations for VoIP Systems
- Verizon 2026 DBIR: key findings
- NIST SP 800-207, Zero Trust Architecture
- CISA Known Exploited Vulnerabilities Catalog