Advice re. access-control entries in an access-SBC envrionment

Hi!

We have an access-SBC environment up and running for MANY years, it is configured with Dynamic HNT etc., and the "access-control-trust-level" for the Internet-facing realm is configured to "low". Registered end-points are promoted to a higher trust level with the built-in functionality in the SBC after successful registration in the registrar. So far so good, the DoS protection kicks in now and then and dynamically blocks IP addresses temporarily etc.

The internet-facing realm has no access-control entries in the configuration (=the trust is inherited from/set in the realm config?). However, now I want to permanently block some spammer's IP that is sending tons of registration attempts with unique src_ip/src_port (untrusted-signal-threshold doesn't catch them correctly) by adding the black-listed IP to an access-control entry specifying this realm, source-address, destination-address, application protocol, and access=deny + trust-level=none.