Abstract: A method for securing a communication network is provided. A communication session established between a local media endpoint located in a communication network and a remote media endpoint is detected. The communication session is assigned a session identifier. Packets communicated to the communication network are monitored. During a predetermined time period, only packets that identify the session identifier, a network address of the local media endpoint, a port of the local media endpoint, a network address of the remote media endpoint, and any port of the remote media endpoint are passed. After the predetermined time period, only packets that identify the session identifier, the network address of the local media endpoint, the port of the local media endpoint, the network address of the remote media endpoint, and a specific one of the ports of the remote media endpoint identified in packets passed during the predetermined time period are passed.