Hi,
look at the howto link at
http://iptel.org/ser.
For securing the cisco you only need to filter the sip port
(usually 5060) with an cisco access list. You dont need to
filter rtp/udp/voice streams because no one can setup a
voice stream without sending an SIP INVITE to the cisco.
This only true if you use a sip-proxy off course and dont let
the sip-UAs connect directly to your PSTN GW.
regards,
Arnd