securing IPO / SIP Trunks / One-X clients

[imamod]

Hi,
read almost all docs related to security SIP trunks and One-X clients but there is no clear example topology for this:
https://ipofficekb.avaya.com/busines...e-x_portal.htm
https://ipofficekb.avaya.com/busines...e-x_portal.htm

Also, we have this: https://ipofficekb.avaya.com/busines...y/firewall.htm
but is unclear for FW should be used? Every single smb today has some kind of firewall so that is already in use.

Is there some examples of this how should be implemented?

[mlombardi1]

The SIP trunk must be terminated to an SBC located in the network DMZ. The DMZ should be flanked by two firewalls, one facing the external side and the other internal but most often there is only one firewall used for the external side. The firewall port forwards the necessary traffic for oneX (TLS, SRTP, etc) to the SBC-E external interface (B1) which then securely proxies the traffic to the internal interface (A1) facing the PBX based on configured policy.