How to Stop Ghost Ringing
Ghost ringing or phantom calls typically, but not always, appear on remote phones. They sometimes appear on local phones or a group of local phones as well.
Most of the time these calls will show up from a 3, 4 or 5 digit number and when the user answers the phone it will be completely silent.
It likely will happen again within a minute or two, and will generally continue to repeat.
Remote Phone
When a remote phone exhibits the behavior it is usually due to the 'pin-holes' created by the remote phone reaching out from inside the LAN to register with the PBX. A modern firewall will recognize the return traffic as 'ESTABLISHED, RELATED' and allow it to pass back into the LAN. Because of this pin-hole, a port (typically 5060) will remain open for some duration on the firewall.
With the port open to the internet, port scanner and spoofed call attempts (Invites) may be noted on the phone(s). This activity results in the phone appearing to be receiving a call when one is not present.
The Fix: Lock down Port 5060 and/or SIP traffic to the WAN IP of the PBX. Alternatively a VPN can be setup for remote phones; a VPN has the advantage of not only negating an open port in the firewall but all traffic to and from your remote device will be encrypted.
With either of these options implemented, unwanted traffic should be prevented from reaching the inside of your LAN, and hence, your phone.
Local Phones
When a local phone or phones start exhibiting ghost call behavior it is likely that the undesired call attempts are making it to the PBX and, as a result, being passed along to the phone(s). The most likely cause for this behavior is the SIP ports on the firewall opened to the PBX, but not restricted to any specific IP(s).
The Fix: Lock down Port 5060 to the IP of your SIP Carrier(s) and Remote Phone(s)
This has the affect of preventing the unwanted traffic from reaching the PBX, which increases security, as well as prevents your system from receiving and responding to undesired traffic.