yed in one of two ways: Separate devices in series Integrated in a Cisco IOS device with collocated functions Figure 7-5 provides six possible deployment models of firewalls and border elements. Figure 7-5 Possible Firewall and Border Element Designs Models (a), (b), and (c) shown in Figure 7-5 are better suited to medium-to-large enterpris- es and high volume contact centers, and models (d), (e), and (f) are better suited to smaller businesses. In model (a) the firewall appliance is on the outside of the border element. This is the recommended deployment model if you use separate devices for firewall services and a border element. This deployment generally makes sense for campus and data center locations where there is already a firewall present. This model also makes sense if the firewall is managed by the security team, whereas the border element is managed by the voice team. This is a mandatory model if the physical medium coming into the en- terprise premises carries Internet traffic. In this model, the firewall provides the first line of defense on all traffic arriving from the outside, passes the voice traffic to the border element for a Layer 7 inspec- tion on the voice traffic. If the firewall has an ALG function, there is bound to be some overlap in functionality between the firewall and the border element. It is nev- ertheless recommended that you turn on both to get the fullest set of inspection and protection that you can, rather than having potential security holes between the appliances. In model (b) the border element is on the outside of the firewall. This deployment model makes sense when the physical medium bringing the SIP trunk into your Chapter 7: Design and Implementation Considerations 119 premises carries only SIP trunk traffic and nothing else. This means your data con- nections come in on a different physical path, onto different routers, and get fire- walled entirely separately from the SIP trunk traffic. This model mandates that you trust your service provider's network to offer only 