istration se- quence enabling the enterprise edge to register explicitly with the provider's SIP softswitch. Some SIP applications are capable of this; if not you can have your CUBE do the registration on behalf of the endpoints behind it in the enterprise network. Digest Authentication (RFC-2617): A SIP softswitch can challenge the INVITES, and the originator must respond with credentials that are then authenticated by the SIP softswitch. Unlike a SIP registration sequence that happens once, the Digest Chapter 7: Design and Implementation Considerations 123 Authentication happens on every SIP INVITE. The CUBE can respond to Digest Authentication challenges with configured credentials. Example 7-6 shows sample commands to configure the CUBE to do a SIP registration with credentials, and Example 7-7 shows the configuration for SIP Digest Authentication. Example 7-6 SIP Registration (config)#sip-ua #credentials username 1001 password cisco realm cisco.com sip-ua registrar ipv4:172.16.193.97 expires 3600 credentials username 1001 password 0822455D0A16 realm cisco.com Example 7-7 SIP Digest Authentication sip-ua authentication username XXX password yyy Toll Fraud Toll fraud has existed for as long as telephone networks have been in operation. This con- stitutes making unauthorized calls that someone else pays for. The perpetrator can be inside your network (for example, an employee making personal international calls) or an external hacker using your SIP trunk to make calls that your company pays for. Ensure that whatever measures you took to combat toll fraud in your TDM PSTN access network are also implemented on your SIP trunk PSTN access network. Some of the common CUBE tools that enable you to mitigate toll fraud attacks include Use ACLs to enable explicit sources of calls and deny all other traffic. Apply explicit incoming and outgoing dial-peers to both Border Element interfaces to control the types and parameters of calls allowed through the network border. If an incoming dial-peer is not found for a call, th