Hi,
look at the howto link at http://iptel.org/ser.
For securing the cisco you only need to filter the sip port (usually 5060) with an cisco access list. You dont need to filter rtp/udp/voice streams because no one can setup a voice stream without sending an SIP INVITE to the cisco.
This only true if you use a sip-proxy off course and dont let the sip-UAs connect directly to your PSTN GW.
regards,
Arnd