> For the complete documentation index, see [llms.txt](https://cookbook.denovolab.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cookbook.denovolab.com/stir-shaken/configure-ingress-trunk.md).

# Configure Ingress Trunk

Class 4 provides built-in functionalities to verify stir/shaken identity header and sign call using stir/shaken certificate. 

By default, class 4 automatically pass the stir/shaken identity header from ingress trunk to egress trunk.  Class 4 can also be provisioned to sign calls that don't have stir/shaken header.  To enable Class 4 to sign call, you will need to configure Stir/Shaken in both ingress trunk and egress trunk. 

Stir/Shaken setting in the ingress trunk defines what attestation is to be used to sign call.  Stir/Shaken setting in the egress trunk defines whether a call should be signed when it is being passed to the egress trunk. 

## Stir/Shaken setting in Ingress Trunk

The ingress trunk setting for Stir/Shaken is shown as follows:

![](/files/ErSA3sVwyphuwOijyNyq)

Under Signing Policy, you can see the following options:

![](/files/lgwyGf50FIY4jqfhbWbg)

| Signing Policy                                   | Description                                                                                                                                                        |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Do not sign calls                                | This option means the switch should not sign any calls from this ingress trunk.                                                                                    |
| Sign only US numbers                             | This option means that the switch should only sign calls with valid US numbers as the ANI.                                                                         |
| Sign any phone numbers                           | This option means that the switch should sign all calls.                                                                                                           |
| Sign only numbers from the Stir/Shaken ANI group | This options means that the switch should sign calls with ANI defined in the Stir/Shaken ANI Group.  You can create Stir/Shaken ANI Group from Configuration menu. |

### Re-sign calls on ANI/DNIS replacement

In the next option, you can turn on / off "Re-sign calls on ANI/DNIS replacement."  

![](/files/RKp6q6Iz04cqPNOwAYxN)

When turned on, Class 4 will regenerate a new Identity header if the ANI or DNIS is modified using Digit Manipulation or Digit Replacement. 

### Attestation  Setting

This section defines what attestation level to use according to the ANI of the call. 

![](/files/C6Vb9yZdVXuQ8f74VBMh)

You must set a default Attestation if you want to turn on signing of calls. 

### Stir/Shaken ANI Group

To create new Stir/Shaken ANI Group, you can select Stir/Shaken under Configuration menu:

![](/files/oC5DuFC61mwy7HyZQjiF)

After you create a Stir/Shaken ANI Group, you can click into the ANI Group and then you can upload numbers into the ANI Group.

### Un-sign Call Handling

This option let you define how to handle a call from ingress trunk if there is no Stir/Shaken identity header included in it. 

![](/files/DnOWgcYDuzpGPgwGJqZH)

If you select Pass Through, it means you want to let the calls to go through and use the other options to define whether to sign and how to sign a call. 

You can also choose to reject a call if the Stir/Shaken identity header is missing from the ingress side.  

In some cases, the Stir/Shaken may exist but it is invalid, then you can also choose to reject calls that has invalid Stir/Shaken Identity header.