Message with invalid format in header with username detected

[Fabien_69100]

Dear all,

I have a problem with a SIP communication between a local device and a remote SIP cloud.
My version R80.40... OK I have to upgrade my firewalls, this is on the roadmap, but can you help me please ?

Here is the IPS drop :

Interface Direction: inbound
Service ID: sip-tcp
VoIP Log Type: Security
Content Type: VoIP Session
Inspection Item: Message with invalid format in header with username detected
Inspection Information: Illegal SIP-URI format in 'From'/'To' header
Severity: High
Performance Impact: Very Low
Inspection Category: anomaly
Inspection Profile: Recommended_Protection_Parsers_Settings
Action: Drop
Service: TCP/5060
Blade: IPS, Firewall

I tried to configure an threat prevention exception : Policy/Access Control/Threat Prevention/Exception/"My Protection group"

...with source/destination and blade "IPS", service tcp-5060, etc. Don't work.

Then I tried to put service=any, and finaly blade=N/A (all).

Nothing to do, it doesn't create the good exception.

What's wrong ? How would you do it?

Thank You so much

Fabien

[PhoneBoy]

Try using SIP_ANY in the Access rule maybe?

[Lesley]

For testing purposes try this:

Edit the current TP rule.

Instead of exception edit the current rule that inspect the traffic.

On the services colum(default hidden right click blue bar). Put in the relevant port and right click and excluded it.

Make the rule so it will inspect all ports EXCEPT the problematic port.