rations 117 provides the most sophisticated layer of protection because it is a B2BUA whereas the firewall essentially inspects and passes through traffic but does not terminate it. Functions that firewalls are particularly well suited to mitigate are Layers 2 and 3 inspec- tion functions including: General IP DOS attacks Black hole routing TCP window control and dropping UDP packets Access lists, specifying what traffic is correct and allowed Optional SIP ALG for cursory SIP rogue and malformed packet inspection Optional SIP ALG protection against spikes of SIP calls (SIP-specific DOS) More sophisticated SIP capabilities that some firewalls can have include Whitelist/blacklist filtering of SIP calls based on calling and called numbers Rate limiting of specific SIP methods to mitigate against SIP-specific DOS attacks Firewalls are not as well suited to protecting against attacks launched from inside your network or doing session management at the level of deciding whether packets are arriv- ing for valid sessions only, in valid sequences (or SIP dialogs), and for valid codecs or other negotiated parameters of the session. Some of the more sophisticated firewalls, such as the Cisco ASA product series or the Cisco IOS Firewall, have SIP ALGs that offer some protection services at protocol layers higher than Layer 3. Specific functions a border element is well suited for include Layers 5 to 7 SIP inspection actions such as: Rejecting nonallowed calls and generating CDRs of call attempts for tracking Call limiting (only accept a certain number of calls) Codec limiting (only accept certain codecs) Call admission control to provide bandwidth protection Access lists specifying valid source and destination call agents Complete rogue and malformed SIP packet protection Digest authentication and hostname validation to ensure sessions are set up only between valid endpoints SIP registration to authenticate session originations SIP listening port configuration 118 SIP Trunking Broadly, firewalls and border elements are deplo