topic Fragmented SIP traffic gets silently dropped in Next-Generation Firewall Discussions

Fragmented SIP traffic gets silently dropped

MykyUk — Thu, 02 Mar 2023 08:02:29 GMT

Hi guys,

PA-5250, 9.1.14

Can you help me with this one, please?

PA does not like fragmented SIP INVITE packets, and we can see them in the drop queue:

No traffic, threat or URL filtering logs were created (expected, I believe).
Why is it doing that?

Thanks,
myky

Re: Fragmented SIP tarffic gets silently dropped

Raido_Rattameister — Wed, 01 Mar 2023 17:52:08 GMT

Do you have Zone Protection applied to zone this traffic comes from?

If you add filter to "Monitor > Packet Capture" to capture traffic from 10.125.3.23 and then run following command in cli what is output? Can you identify based on couters what caused packet drops?

> show counter global filter delta yes packet-filter yes

Re: Fragmented SIP tarffic gets silently dropped

MykyUk — Thu, 02 Mar 2023 08:13:07 GMT

Hey @Raido_Rattameister .
Long time!

At one point, I thought that my PA skills completely got rusty, as I believe I have checked that earlier.
There is no ZPP applied; we got only a basic one on the untrusted zone:

thanks,

myky

Re: Fragmented SIP traffic gets silently dropped

Raido_Rattameister — Thu, 02 Mar 2023 13:14:26 GMT

Hey @MykyUk

In this case "show counter global filter delta yes packet-filter yes" is best next step figuring out why they are dropped.

Re: Fragmented SIP traffic gets silently dropped

MykyUk — Thu, 02 Mar 2023 14:12:06 GMT

Got yah, yes will arrange testing today and update this thread. Thanks! myky

Re: Fragmented SIP traffic gets silently dropped

MykyUk — Thu, 02 Mar 2023 15:15:53 GMT

@Raido_Rattameister have you seen this before:

I have a feeling it might be a TAC case.

thanks,
myky

Re: Fragmented SIP traffic gets silently dropped

MykyUk — Thu, 02 Mar 2023 16:59:51 GMT

re-run it again; PA is clearly not happy:

Re: Fragmented SIP traffic gets silently dropped

MykyUk — Thu, 16 Mar 2023 18:12:44 GMT

@Raido_Rattameister correction:
SSD was replaced, and when we failback traffic, the issue returned.
Eventually, TAC confirmed that we hit the following bug:

PAN-194395
Fixed an issue where the firewall dropped all decrypted outbound (SSL Forward Proxy) HTTP/2 traffic after you upgraded to PAN-OS 9.1.14, which caused websites that used HTTP/2 to become inaccessible.

Same issue, old discussion:
https://www.reddit.com/r/paloaltonetworks/comments/vzrann/panos_9114_software_buffer_depletion/

The bug description is way off.

thanks, myky