Configure Ingress Trunk

Class 4 provides built-in functionalities to verify stir/shaken identity header and sign call using stir/shaken certificate.

By default, class 4 automatically pass the stir/shaken identity header from ingress trunk to egress trunk. Class 4 can also be provisioned to sign calls that don't have stir/shaken header. To enable Class 4 to sign call, you will need to configure Stir/Shaken in both ingress trunk and egress trunk.

Stir/Shaken setting in the ingress trunk defines what attestation is to be used to sign call. Stir/Shaken setting in the egress trunk defines whether a call should be signed when it is being passed to the egress trunk.

Stir/Shaken setting in Ingress Trunk

The ingress trunk setting for Stir/Shaken is shown as follows:

Under Signing Policy, you can see the following options:

Signing Policy	Description
Do not sign calls	This option means the switch should not sign any calls from this ingress trunk.
Sign only US numbers	This option means that the switch should only sign calls with valid US numbers as the ANI.
Sign any phone numbers	This option means that the switch should sign all calls.
Sign only numbers from the Stir/Shaken ANI group	This options means that the switch should sign calls with ANI defined in the Stir/Shaken ANI Group. You can create Stir/Shaken ANI Group from Configuration menu.

Re-sign calls on ANI/DNIS replacement

In the next option, you can turn on / off "Re-sign calls on ANI/DNIS replacement."

When turned on, Class 4 will regenerate a new Identity header if the ANI or DNIS is modified using Digit Manipulation or Digit Replacement.

Attestation Setting

This section defines what attestation level to use according to the ANI of the call.

You must set a default Attestation if you want to turn on signing of calls.

Stir/Shaken ANI Group

To create new Stir/Shaken ANI Group, you can select Stir/Shaken under Configuration menu:

After you create a Stir/Shaken ANI Group, you can click into the ANI Group and then you can upload numbers into the ANI Group.

Un-sign Call Handling

This option let you define how to handle a call from ingress trunk if there is no Stir/Shaken identity header included in it.

If you select Pass Through, it means you want to let the calls to go through and use the other options to define whether to sign and how to sign a call.

You can also choose to reject a call if the Stir/Shaken identity header is missing from the ingress side.

In some cases, the Stir/Shaken may exist but it is invalid, then you can also choose to reject calls that has invalid Stir/Shaken Identity header.