UC500.com

You only allow 5060 for specific IP addresses or host names. Look at the other options which allows 5060 to remain open on the firewall but prevents calls with specific patterns from hairpinning back. Here is a new note posted on the website:

http://www.cisco.com/en/US/products/sw/voicesw/ps4625/products_tech_note...

Hi
have heard about sporadic "toll fraud" issues on using SIP on the trunk side. Common ways of mitigating this would be:

a. Securing the WAN interface using the IOS firewall on UC520:
This implies allowing only known SIP or H.323 traffic to come in on the WAN interface – all other SIP or H.323 traffic will be blocked. This also requires that the administrator knows the IP addresses that the SIP VOIP SP uses for signaling on the SIP Trunk. Note that the below lines would need to be added in addition to any ACL entries already present on the WAN interface.

interface serial 0/0
ip access-group 100 in
!
access-list 100 permit udp host 1.1.1.254 eq 5060 any <1.1.1.254 is SP SIP proxy>
access-list 100 permit udp host 1.1.1.254 any eq 5060
access-list 100 permit udp any any range 16384 32767

b. Ensuring calls coming in on the SIP trunk do hairpin back out:
This implies that the configuration will only allow SIP – SIP hairpin of calls to a specific known PSTN number range, all other calls will be blocked. The administrator should configure specific inbound dial-peers for the PSTN numbers coming in on the SIP trunk that are mapped to extensions or auto attendant(s) or voicemail on UC520. All other calls to numbers that are not part of the UC520 PSTN number range will be blocked. Note, this will not affect call forwards / transfers to voicemail (CUE) and call forward all to PSTN numbers from IP phones as the initial call is still targeted towards an extension on UC520.
dial-peer voice 1000 voip
description ** Incoming call to 4085551000 from SIP trunk **
voice-class codec 1
voice-class sip dtmf-relay force rtp-nte
session protocol sipv2
incoming called-number 4085551000
dtmf-relay rtp-nte
no vad
!
dial-peer voice 1001 voip
permission term < Prevent hairpinning calls back over SIP Trunk
description ** Incoming call from SIP trunk **
voice-class codec 1
voice-class sip dtmf-relay force rtp-nte
session protocol sipv2
incoming called-number .T <

Not really, unless you've SIP phones registering off the WAN port.
Most UC/CME installations use SCCP, and do not have an internet exposed interface