topic Re: Assistance Required: Issue with UDP Port 5060 Packet Drop in Firewall and Security Management

Assistance Required: Issue with UDP Port 5060 Packet Drop

yourshamim — Mon, 30 Dec 2024 10:16:59 GMT

Dear Checkpoint Experts,

I am encountering a unique issue while connecting to one of the voice servers on UDP port 5060. The behavior observed in the logs is inconsistent:

The zdebug logs indicate the reason for the packet drop as "fw_record_data_conn_module."
However, the Tracker shows the reason as "SIP Re-invite exceeds the limit."

I have attached a screenshot below for your reference.

Could you please guide me on how to resolve this issue? Your assistance would be greatly appreciated.

Best regards,

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

AkosBakos — Mon, 30 Dec 2024 10:29:57 GMT

Hi,

Have you checked this sk already?

https://support.checkpoint.com/results/sk/sk114769

---------------------

Solution

Use this formula to tune the parameter that controls the interval at which re-INVITE messages (sip_expire):

Session-Expires * sip_expire / 100 < Min-SE

Where:

Session-Expires = SIP session expiration lifetime, as agreed by the SIP hosts
sip_expire = Interval at which the Check Point Firewall will expire a re-INVITE from the call queue
Min-SE = Interval at which the SIP hosts will send re-INVITE messages to refresh the SIP session

To determine the "Session-Expires" value in the SIP header, capture the SIP INVITE request and response:

Expert# cppcap -c 0 -f 'port 5060 and ((udp[20:4] = 0x52454749) or (udp[20:4] = 0x494e5649))' -o /var/log/sip-invite.pcap

Open the capture in Wireshark and filter for INVITE requests that contain a Min-SE value and INVITE responses that contain a Session-Expires value:

Filter= (sip.Request-Line ~ "INVITE" && sip.Min-SE) || (sip.Status-Code == 200 && sip.Session-Expires)

Review the data pane of the filtered packets for the value in the relevant fields:

Min-SE value from INVITE request:

Session Initiation Protocol (INVITE) → Message Header → Min-SE

Session-Expires value from INVITE response:

Session Initiation Protocol (200) → Message Header → Av-Global-Session-ID → Session-Expires

For example, if analysis of the SIP handshake determines that Session-Expires=120 and Min-SE=60, sane values for sip_expire can be determined by solving for x in this inequality:

120 * x / 100 < 60
120 * x < 60 * 100
120 * x < 6000
x < 6000 / 120
x < 50

Therefore, a sane value for the sip_expire kernel parameter in this example would be 45.

To check the current values of the kernel parameters on the Check Point Firewall:

Expert# fw ctl get int sip_max_reinvite
Expert# fw ctl get int sip_expire

Should modification of these kernel parameters prove necessary, refer to sk26202, or the Quantum Security Gateway Administration Guide for your version.

If, after tuning the sip_expire parameter according to the configuration of your SIP implementation, you still observe intermittent drops of this nature, consider also tuning up the sip_max_reinvite parameter to allow for calls to be held longer.

Akos

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

yourshamim — Tue, 31 Dec 2024 02:37:23 GMT

I tried, but no packets were captured in the pcap file (zero packets). Traffic is continuously coming on port 5060.

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

the_rock — Tue, 31 Dec 2024 15:05:48 GMT

I know in the old days of CP, people would use below method, though back then, it would say NONE (that exact word), now its bit different, but sort of same principle.

Andy

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

AkosBakos — Tue, 31 Dec 2024 19:44:51 GMT

🖕True Story!

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

the_rock — Tue, 31 Dec 2024 20:09:13 GMT

Fixed LOTS of issues that way back in R77 lol

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

PhoneBoy — Thu, 02 Jan 2025 18:55:08 GMT

sip-tcp already has the protocol signature disabled (at least in R82).

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

PhoneBoy — Thu, 02 Jan 2025 18:55:47 GMT

How precisely are you capturing packets?

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

the_rock — Fri, 03 Jan 2025 17:28:40 GMT

Does not seem to be the case in R81.20 (sip-tcp-proto), but in R82, I checked demo and its exact same thing.

Andy

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

the_rock — Fri, 03 Jan 2025 17:29:32 GMT

Hey @yourshamim , were you able to make any progress?

Andy

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

yourshamim — Sun, 05 Jan 2025 11:51:09 GMT

Not yet. I have raised a TAC case, and the TAC engineer is currently looking into it.

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

the_rock — Sun, 05 Jan 2025 13:15:57 GMT

Please let us know the outcome.

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

the_rock — Mon, 06 Jan 2025 01:28:44 GMT

Hey @yourshamim ...just wondering, are you able to try what was suggested with protocol none in the service and see if it makes any difference?

Andy

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

yourshamim — Tue, 07 Jan 2025 03:33:21 GMT

Hi guys,

On the user's side, they restarted the server during troubleshooting. FW is getting a Virt Defrag Timeout error in the tracker and Zdebug. The tracker is receiving traffic on UDP port 0.

surprisingly TCPdump capture showing UDP port 5060. we have another round of troubleshooting call today with CP TAC and Avaya team.

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

the_rock — Tue, 07 Jan 2025 18:03:15 GMT

Hey,

How is sip-tcp service configured atm? What does protocol option show?

Andy

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

PhoneBoy — Tue, 07 Jan 2025 19:09:09 GMT

You can allow traffic on port 0, FYI.
See: https://support.checkpoint.com/results/sk/sk27109

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

the_rock — Tue, 07 Jan 2025 20:37:02 GMT

Never seen that sk before, thanks for sending it @PhoneBoy

👍

Andy

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

yourshamim — Wed, 08 Jan 2025 02:30:50 GMT

Thanks, @PhoneBoy . I will change the value and share the status update.

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

yourshamim — Wed, 08 Jan 2025 03:16:09 GMT

I changed the value to 1 through the set command but not Luck. same drop reason " Virt Defrag Timeout" and service UDP/0.

Re: Assistance Required: Issue with UDP Port 5060 Packet Drop

yourshamim — Wed, 08 Jan 2025 03:18:21 GMT

I allowed service any at this moment for testing purposes.