till, generally, might offer only suboptimal capabilities to translate deeply embedded IP addresses in SIP messaging. It is therefore more secure to use a border element that is a full SIP back-to-back user agent (B2BUA) as the network demarcation offering 100 percent SIP packet inspection and address translation. The CUBE is a full SIP B2BUA and can therefore offer complete network address translation, usually referred to as topology hiding in this context to dis- tinguish this function from appliance NAT devices. Both media and signaling flow through the CUBE and the service provider and off-net endpoints see only the addresses of the border element and never the addresses internal to your enterprise network. Topology hiding is important to ensure that any attacks that might come from the service provider side can be directed only toward the border element, and the communications and call agents within your enterprise remain unaffected. Figure 7-4 illustrates how topology hiding can be accomplished by using the CUBE. 192.168.10.10 192.168.10.50 172.16.10.5 172.16.10.6 192.168.10.50 192.168.10.10 Inside Inside Outside Site A-192. 168. 10.x/24 172.16.10.x/24 Site 3-192.168.10.x/24 Figure 7-4 Topology Hiding Firewalls Many security features on both firewalls and border elements protect against attacks on SIP trunks. A certain amount of overlap occurs between the capabilities, especially true for the higher end firewalls with sophisticated SIP ALGs. Generally you should deploy a firewall to provide generic IP protection against any kind of IP traffic, and your border element as a much more focused, voice-specific session protection function. For the least capable firewall devices, you should simply open pin- holes for the traffic destined to the border element and have the border element do all the SIP inspection. For firewalls with SIP ALGs, there is some overlap in the inspection the firewall does and the inspection done by the border element. The border element always Chapter 7: Design and Implementation Conside