SIP traffic being dropped in drop.pcap on the PA with PAN OS version 10.2.4-h2

Didar_Bajwa — Thu, 27 Jul 2023 23:41:05 GMT

SIP traffic is not working properly, we recently upgraded to PAN OS version 10.2.4-h2 and seeing issues with multiline calls

Steps taken:

ALG is disabled, we have already created SIP-override and RTP override but no luck.

@Param_Upadhyay @UtkarshKumar

We then did a packet capture and found that SIP traffic flow completes fine and call works fine but when user tries to add any other user, we see a Re-invite from CUCM IP to the device IP generating the call and that traffic is being dropped in the firewall drop.pcap.

Now, as per the wireshark logs, we suspect this to be a MTU issue as payload is around 1511. As a workaround, we have removed information from the SIP profile to reduce it's size and as expected that has resolved the issue. The info I removed is display/party information so effectively I've disabled caller ID.While technically leaving it disabled is not a solution

But this was working fine without any issues on the previous version , so why it is being dropped in drop.pcap now on a higher version.

So, looking for some suggestions or insights if anyone else is facing the same issue.

Re: SIP traffic being dropped in drop.pcap on the PA with PAN OS version 10.2.4-h2

aleksandar.astardzhiev — Fri, 28 Jul 2023 12:49:09 GMT

Hi @Didar_Bajwa ,

The best way to understand what could be the reason for the dropped packets is to check the global counters - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloNCAS

What is the output of the global counters?

Re: SIP traffic being dropped in drop.pcap on the PA with PAN OS version 10.2.4-h2

Didar_Bajwa — Fri, 28 Jul 2023 14:18:09 GMT

nothing in the global counters

topic Re: SIP traffic being dropped in drop.pcap on the PA with PAN OS version 10.2.4-h2 in General Topics

SIP traffic being dropped in drop.pcap on the PA with PAN OS version 10.2.4-h2

Re: SIP traffic being dropped in drop.pcap on the PA with PAN OS version 10.2.4-h2

Re: SIP traffic being dropped in drop.pcap on the PA with PAN OS version 10.2.4-h2