Supposed to be. I've always been leary of putting all my eggs in one basket, especially with some past issues with reliability (i.e, base function tray). Makes maintenance kind of a pain in the rear if something needs to be done to the BCM - instead of just being out of phone service, you're out of darn near everything.
We've had customers approach us saying they wanted the VPN keycode in the BCM, wanted to enable the firewall, NAT, etc. Once we mention that a Contivity 1010 will do that stuff for not much more money than the IPSEC keycode, and do it more reliably, it's an easy sale.
Reminds me of a few years back when I bought a cisco router off ebay for lab work. Cracked the password, found the config, telnetted to the external IP that was on the router, and presto - I was talking to their "new" router with the same password that was on the old one that was sold on ebay. Had I felt malicious, I could have whacked the config, reloaded their router and left someone in a world of hurt. Instead I emailed the domain that belonged to the IP and informed them that they need to review their security practices. Never did hear back.
I'll let my phone system be my phone system, and let my firewall be my firewall - just my opinion.
