cess-list 2 permit 172.16.10.0 0.0.0.255 access-list 100 deny (everything else) access-list 200 deny (everything else) SP VolP 192.168.10.10 172.16.10.6 Figure 7-3 Locking Down a SIP Trunk with ACLs Additionally, voice Source IP Groups can be used with the ACLs, as shown in Figure 7-3, to provide further restrictions on the devices that might originate SIP traffic to your bor- der element. On devices in your network that should not run SIP traffic at all, the Control Plane Policing (CoPP) feature can be used to deny all SIP traffic. CUCM has (by default) a feature that restricts traffic on a SIP trunk to be accepted only from the IP address configured on the SIP trunk. Hostname Validation You can use the hostname validation feature of the CUBE to restrict the valid hostnames that are accepted in the host portion of the SIP URI of an incoming SIP INVITE. Example 7-1 illustrates the commands used by this feature to enable calls only from the four hostnames listed. Example 7-1 Hostname Validation sip-ua permit hostname dns:example1.sip.com permit hostname dns:example2.sip.com permit hostname dns:example3.sip.com permit hostname dns:example4.sip.com Security features often overlap to some extent, and it is a good practice to deploy these overlapping features because they provide layered security protection. Every layer might protect you against one particular attack that might have skirted around a single layer protection to exploit a weakness in a particular appliance, device, feature operation, or configuration. 116 SIP Trunking NAT and Topology Hiding Hiding the IP addresses of enterprise voice endpoints (such as those belonging to IP phones, call agents, and TDM voice gateways) from external view can in some cases be achieved with traditional NAT features. NAT adjusts the IP addressing of IP packet head- ers and some of the IP addresses appearing elsewhere in SIP packets, but generic NAT devices are Layer 3-capable only. Those that have Application Layer Gateways (ALG) have more sophisticated SIP awareness, but s