vity method of your SIP trunk: SIP Trunk SIP SP SIP Trunk SIP + VPN SP WAN Data SIP Trunk SIP SP + Internet Internet Data Internet Voice Internet Internet Data Figure 7-2 Increasing Levels of Security Exposure In model (a) the SIP trunk connects from a Tier 1 service provider with strong secu- rity over a dedicated physical connection into your network. No data traffic traverses this connection. With this model, your security exposure is low, and you can con- sider not having a firewall in addition to a border element on such a connection. In model (b) the SIP trunk connects from a Tier 1 service provider with strong securi- ty over a physical connection that carries both your voice and your VPN WAN data connection, such as an MPLS service. No Internet data traffic traverses this connec- tion. With this model, your security exposure is still fairly low, and you might not need a firewall in addition to a border element on such a connection. 114 SIP Trunking In model (c) the SIP trunk connects from a service provider that offers both SIP trunking and Internet access on the same physical connection. This is often a cost- effective model for smaller businesses with no WAN data service between sites or that have only a single site. Regardless of the strength of security measures in the service provider's network, you are exposed to Internet attacks on this kind of con- nection, and you have to firewall in addition to deploying a border element to secure this type of connection. In model (d) there is no SIP trunk service offering, and you use plain Internet con- sumer voice access and Internet data from a general Internet service provider. This model is strongly discouraged for business-class voice access because there is no quality control on such a connection, and it is extremely exposed to all kinds of voice and data Internet attacks. Firewalling and border controlling alone are still not suffi- cient to make this model capable of providing business-quality voice services. Many security features on both firewalls an