https://community.checkpoint.com/t5/Firewall-and-Security-Management/Protocol-Violation-alerts/m-p/96946#M10407 <P>Hello All,</P><P>We are getting Protocol Violation alerts with our Remote access client users that are running Jabber SIP Clients --&nbsp;Firewall - Protocol violation detected with protocol:(RTP), matched protocol sig_id:(1), violation sig_id:(9). (500). It looks to me like this is the RTP voice traffic.&nbsp;</P><P>Why is this traffic not matching the protocol signature for RTP Voice and how do we fix issues like this? I have a few other protocol violation alerts too.&nbsp;</P><P>The traffic is allowed so phone calls are working fine but we shouldn't be getting these alerts.</P><P>Thanks!</P><P>&nbsp;</P> Thu, 17 Sep 2020 12:53:00 GMT JoeSt89 2020-09-17T12:53:00Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Protocol-Violation-alerts/m-p/96946#M10407 <P>Hello All,</P><P>We are getting Protocol Violation alerts with our Remote access client users that are running Jabber SIP Clients --&nbsp;Firewall - Protocol violation detected with protocol:(RTP), matched protocol sig_id:(1), violation sig_id:(9). (500). It looks to me like this is the RTP voice traffic.&nbsp;</P><P>Why is this traffic not matching the protocol signature for RTP Voice and how do we fix issues like this? I have a few other protocol violation alerts too.&nbsp;</P><P>The traffic is allowed so phone calls are working fine but we shouldn't be getting these alerts.</P><P>Thanks!</P><P>&nbsp;</P> Thu, 17 Sep 2020 12:53:00 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Protocol-Violation-alerts/m-p/96946#M10407 JoeSt89 2020-09-17T12:53:00Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Protocol-Violation-alerts/m-p/97136#M10408 <P>To fix the underlying issue you'll probably need packet captures and a TAC case.<BR />You can also not use the relevant services in the service column, thus not activate the relevant protocol parsers, but that's a less secure option.</P> Mon, 21 Sep 2020 05:14:10 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Protocol-Violation-alerts/m-p/97136#M10408 PhoneBoy 2020-09-21T05:14:10Z