topic Re: TCP SIP traffic over IPSec VPN get dropped with log first packet not syn in Firewall and Security Management

TCP SIP traffic over IPSec VPN get dropped with log first packet not syn

FrankXie — Wed, 31 Aug 2022 22:57:43 GMT

Hello expert

Recently we noticed some SIP invite timeout to SIP client through IPsec vpn at our sip agent server logs.

While checking firewall logs we noticed there are a few drops with information first packet not syn dropped by firewall with same source as previous accept vpn encrypt log hours later(looks like always more than 1 and half hour).

That specific traffic passing through internal firewall (no drop log) and reach perimeter firewall which hosting vpn connections. It suppose get encrypted and passing through vpn tunnel.

IPsec looks fine because other traffic passing through without problem at the same time. Just wondering if there's any session timeout mismatch.

Firewall running R81.10

Regards

Frank

Re: TCP SIP traffic over IPSec VPN get dropped with log first packet not syn

Chris_Atkinson — Fri, 02 Sep 2022 07:58:40 GMT

Are both sets of Firewalls referencing the same service objects in their respective security policy for SIP?

Re: TCP SIP traffic over IPSec VPN get dropped with log first packet not syn

FrankXie — Fri, 02 Sep 2022 12:13:48 GMT

Hello Chris

Looks like there's some inconsistency about session timeout setting. Perimeter is default 3600 seconds but internal is 7500 seconds. Working on sync them and will update later.

Thanks

Frank