Some traffic not showing up in the logs

[P_M]

Hello,

We have a Security Gateway with version R81.10 and SecureXL enabled on the "Secure" Interfaces (DMZ interfaces).

We are troubleshooting SIP traffic issues with traffic going through one of the DMZ interfaces.

When we generate traffic, most specifically UDP traffic, some of the traffic, but not all of the traffic appears in the logs?

 I am wondering if this is due to the SecureXL being enabled therefore not all allowed traffic is inspected (logged).

Or could there be a problem somewhere else that causes not all traffic to be visible in the logs.

Thanks and Kind regards

[the_rock]

You could disable sxl to make sure, but that should not cause traffic not being visible in the logs, at least I had never seen that.

[Chris_Atkinson]

One known occurrence would be if the same traffic was being seen by the gateway twice unexpectedly (sk172204) but that's not specific to VoIP rather a topology or routing issue. 

[PhoneBoy]

Just because something is accelerated with SecureXL doesn't mean it won't get logged.
It could also be logged differently than you expect as well.

How precisely did you determine some UDP traffic wasn't logged?
Is the traffic that you're seeing as "not logged" related to SIP?
What precise Access Policy rules are allowing the traffic?

[Chris_Atkinson]

Which JHF take is installed?

T75 or higher fixes an issue with VOIP (MGCP) traffic PRJ-40930,PRJ-40928

Additionally sk177365 is also going to be addressed in an upcoming take refer PRJ-28732, PRHF-11703.

To verify if either is relevant please consult TAC to debug further.