TCP SIP traffic over IPSec VPN get dropped with log first packet not syn

[FrankXie]

Hello expert

Recently we noticed some SIP invite timeout to SIP client through IPsec vpn at our sip agent server logs.

While checking firewall logs we noticed there are a few drops with information first packet not syn dropped by firewall with same source as previous accept vpn encrypt log hours later(looks like always more than 1 and half hour).

That specific traffic passing through internal firewall (no drop log) and reach perimeter firewall which hosting vpn connections. It suppose get encrypted and passing through vpn tunnel. 

IPsec looks fine because other traffic passing through without problem at the same time. Just wondering if there's any session timeout mismatch.

Firewall running R81.10

Regards

Frank

[Chris_Atkinson]

Are both sets of Firewalls referencing the same service objects in their respective security policy for SIP?

[FrankXie]

Hello Chris

Looks like there's some inconsistency about session timeout setting. Perimeter is default 3600 seconds but internal is 7500 seconds.  Working on sync them and will update later.

Thanks

Frank