# Configure Ingress Trunk

Class 4 provides built-in functionalities to verify stir/shaken identity header and sign call using stir/shaken certificate. 

By default, class 4 automatically pass the stir/shaken identity header from ingress trunk to egress trunk.  Class 4 can also be provisioned to sign calls that don't have stir/shaken header.  To enable Class 4 to sign call, you will need to configure Stir/Shaken in both ingress trunk and egress trunk. 

Stir/Shaken setting in the ingress trunk defines what attestation is to be used to sign call.  Stir/Shaken setting in the egress trunk defines whether a call should be signed when it is being passed to the egress trunk. 

## Stir/Shaken setting in Ingress Trunk

The ingress trunk setting for Stir/Shaken is shown as follows:

![](https://4102392624-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MXPCJcszvw7MAuHjiRr%2Fuploads%2FHc0yHMltH5slf49c7ndJ%2Fimage.png?alt=media\&token=9a858310-c6d8-4cd9-8cc7-fec2f18707e0)

Under Signing Policy, you can see the following options:

![](https://4102392624-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MXPCJcszvw7MAuHjiRr%2Fuploads%2Ftl2deXuxUj9vZqD0xE3y%2Fimage.png?alt=media\&token=68d60937-1996-46c5-86ee-a720d60c9807)

| Signing Policy                                   | Description                                                                                                                                                        |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Do not sign calls                                | This option means the switch should not sign any calls from this ingress trunk.                                                                                    |
| Sign only US numbers                             | This option means that the switch should only sign calls with valid US numbers as the ANI.                                                                         |
| Sign any phone numbers                           | This option means that the switch should sign all calls.                                                                                                           |
| Sign only numbers from the Stir/Shaken ANI group | This options means that the switch should sign calls with ANI defined in the Stir/Shaken ANI Group.  You can create Stir/Shaken ANI Group from Configuration menu. |

### Re-sign calls on ANI/DNIS replacement

In the next option, you can turn on / off "Re-sign calls on ANI/DNIS replacement."  

![](https://4102392624-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MXPCJcszvw7MAuHjiRr%2Fuploads%2F89GULnlGaUwN1qjsADZa%2Fimage.png?alt=media\&token=979d2d25-2f48-4c43-b5f4-da07b9eb30cf)

When turned on, Class 4 will regenerate a new Identity header if the ANI or DNIS is modified using Digit Manipulation or Digit Replacement. 

### Attestation  Setting

This section defines what attestation level to use according to the ANI of the call. 

![](https://4102392624-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MXPCJcszvw7MAuHjiRr%2Fuploads%2FxZKNt3DJSTcYw5aloRsK%2Fimage.png?alt=media\&token=4706a43d-a0a4-4418-8f97-c2aebca6406f)

You must set a default Attestation if you want to turn on signing of calls. 

### Stir/Shaken ANI Group

To create new Stir/Shaken ANI Group, you can select Stir/Shaken under Configuration menu:

![](https://4102392624-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MXPCJcszvw7MAuHjiRr%2Fuploads%2FOuwExkX1IdNxps9izaFt%2Fimage.png?alt=media\&token=0aa48bdf-7053-43d8-89a9-abf723d926aa)

After you create a Stir/Shaken ANI Group, you can click into the ANI Group and then you can upload numbers into the ANI Group.

### Un-sign Call Handling

This option let you define how to handle a call from ingress trunk if there is no Stir/Shaken identity header included in it. 

![](https://4102392624-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MXPCJcszvw7MAuHjiRr%2Fuploads%2FiWiCeGOn7FLt91EDc1Gx%2Fimage.png?alt=media\&token=fb36fd7b-0697-4e7f-be39-a4ccf6f40f9c)

If you select Pass Through, it means you want to let the calls to go through and use the other options to define whether to sign and how to sign a call. 

You can also choose to reject a call if the Stir/Shaken identity header is missing from the ingress side.  

In some cases, the Stir/Shaken may exist but it is invalid, then you can also choose to reject calls that has invalid Stir/Shaken Identity header.