Hi,

You are welcome. It is always nice to hear a praise.

• "The endpoint involved are individual IP phones that register with call agent via the SBC.
  As such they are not configured as session-agents and if my understanding of your answer is correct they should go under the dynamic trusted category.
  Correct ?" > > > > Yes, correct, all the individual IP phones are moved to dynamic trusted as soon as SBC adds them into registration cache / as soon as they get 200OK response to their REGISTER

• " I do see the their IP addresses under the 'sh registration sipd by-realm/by-route command'. Unfortunately, not even the 'show registration sipd by-user xxxxxx detailed' gives any indication of an individual IP address, trusted, untrusted, etc." > > > > > Actually you can see IP address of the IP phone in output "show registration sipd by-user xxxx detailed", it is shown in "User Agent Info" section.

• Whether it is "trusted or untrusted"? > > > > under normal circumstances a registered endpoint is always trusted (dynamicaly). There are special cases, like for example, a bandwidth depletion, where SBC puts the signaling messages (including registration attempts) into queue and the process itself can last longer than usual, up to 32 seconds. In such cases a record in registration-cache does not mean, that IP address of the phone is trusted. It can be in some intermediate state when SBC awaits for its second REGISTER to complete the registration.
  
  
• "If I may,
  - As indicated, a dynamic endpoint that managed to successfully register goes under the 'Dynamic Trusted' category. If such an endpoint later crosses a threshold that should send it into untrusted or denied, will it show in the Untrusted or Denied section or will it just disappear from the Dynamic Trusted list ?" > > > > SBC will move this endpoint from "dynamic trusted" zone to "untrusted" zone at first and then to "denied" zone. Usually if some registered endpoint violates the thresholds, it will inevitably be banned after some time, so you will find it among other IPs in "show acl denied" output sooner or later. You will never find him in "show acl untrusted" output. Due to the same reason, ancient Acme Packet architects decided not to display each IP that enters untrusted allocation. Imagine what would happened to the output if someone started to attack SBC with REGISTER flood?

• " Will a dynamic endpoint that never succeded to register and crosses a threshold that should send it into denied, show in the Denied group ?" > > > > yes, absolutely. By the way, if this happens, you do not need to wait for the whole deny-period. You can manually remove him from denied zone with command "clear-deny"

Regards,

D

P.S. I apologize for my poor simplified english. I really hope my explanations are approximately understandable.