s on your CUBE or SBC. Hackers target SIP deployments and SIP ports more SO than other VoIP network architectures. Consider changing the SIP port from the standard port 5060 for additional protec- tion against Internet sweeps for open SIP ports. Both your border element and the SP SBC must make this change to interoperate successfully. Always put ACLs on your CUBE to ensure only the SP SBC can initiate calls to it from the PSTN side, and only your enterprise call agents (CUCM or IP-PBXs) can ini- tiate calls from the internal network side. Redundancy Best practices in the area of redundancy include the following: Consider centralized and distributed trunking network designs carefully. An advantage of distributed trunking is inherent redundancy as you had with your TDM PSTN gateways. If one site's SIP trunk is down, calls from that site can temporarily be routed via the SIP trunk of a different nearby site until service returns. For SIP trunks under 500 sessions, redundant termination is generally not necessary, although you can always design it that way if you prefer. But for SIP trunks of 1000 or more sessions, redundancy becomes imperative. Generally SIP trunk SPs offer two IP addresses with a SIP trunk, which you can use to terminate onto two different devices. Either one can handle the full load of the SIP trunk 262 SIP Trunking if necessary. The SP can load balance over these two destinations. If you want to load balance across more than two destinations for either scalability or redundancy or both reasons, you might need to put in a SIP Proxy such as Cisco Unified SIP Proxy (CUSP) or another load balancer in between to help distribute the load. If the SIP trunk is down, outbound calls from the enterprise can easily be routed using traditional TDM PSTN gateways. However, inbound traffic to your DID numbers is not SO easily rerouted to traditional TDM trunks. Discuss inbound traffic alternative routing possibilities with your SIP trunk SP. Summary This chapter covers an easy-to-use, step-by-step guide to depl