Issue with call recording (flow_predict_convert_rtp_drop)

aalfaro — Sun, 09 Nov 2025 19:44:21 GMT

Hi Team,

We’ve been experiencing issues with the communication between a Cisco softphone and the call recorder. Below is the scenario and a description of the problem:

When users place calls from a Cisco softphone, the call is established successfully, and both parties can hear each other. However, the issue arises because the call is supposed to be recorded and stored on an AWS instance.
After taking a packet capture on the firewall, I noticed that the communication is being dropped due to the following message:

flow_predict_convert_rtp_drop 480 100 drop flow pktproc Packets matching rtp/rtcp predicts of sip are dropped due to waiting for predicts merging.

When I check the active session, I see that once the communication starts, the source appears as 0.0.0.0 (see attached image). After several minutes (sometimes seconds), the active session updates and shows the correct original source.
We ran a test where we kept the call active for about 20 minutes, and we found that the recording only starts after around 15 minutes.

We’ve already modified the NAT and Security Rules, but the issue persists. Currently, the security rules for this traffic are based on ports (not App-ID):

One rule handles signaling traffic (source/destination, port 5060).
The other rule is for the softphone traffic (source/destination, UDP ports 10000–40000).

Note: In another similar scenario using a Cisco physical phone, everything works perfectly.

As an example, the communication is

192.168.10.26 -> 200.10.245.209 puerto 5060 (signaling)

10.20.30.136(Softphone) ->200.10.245.209 puertos 10000 a 40000 (CALL)

Please, can anyone help me with this issue? I'd be very grateful

topic Issue with call recording (flow_predict_convert_rtp_drop) in Next-Generation Firewall Discussions

Issue with call recording (flow_predict_convert_rtp_drop)