d border elements protect against attacks on SIP trunks. The following sections discuss these techniques in more detail. A general best practice for SIP trunk security is always to use a border element to termi- nate a SIP trunk coming into your network. This can be an appliance function (such as deploying a dedicated CUBE), or it can be an integrated function, such as an IAD or CUCM Express device that acts as a border element and a routing or IP-PBX device in your network. In addition to a border element, you can choose also to deploy a firewall. Again, this might be a separate appliance, or it might be integrated into a Cisco IOS router providing multiple functions to your business. Separate, dedicated devices tend to be the norm for larger enterprise and higher volume SIP trunks, whereas integrated devices tend to be the cost-effective solution for smaller sites or small business networks. Access Lists (ACL) Always strictly limit the devices that can access your SIP trunk, both from internal to your network and external to it. If you terminate your SIP trunk on a border element, you do not need all these security mitigation measures on every enterprise application, only on the border element. The border element itself should be set up to accept connections on the service provider side only from the provider's SBC, and on the enterprise side only from legitimate CUCM, IP-PBX, or other valid applications (for example, SIP proxies and meeting conference servers). United States federal information reports that hackers are as frequently located inside your enterprise network as on the outside, and for that reason, it is imperative to lock down your border element on both sides SO that rogue endpoints and applications inside your network cannot use the SIP trunk service for fraudulent calls. Similarly, rogue end- points on the Internet should contact your SIP trunk. This configuration is illustrated in Figure 7-3. Chapter 7: Design and Implementation Considerations 115 access-list 1 permit 192.168.10.0 0.0.0.255 ac