topic A very weird Behavior on SIP traffic traffic reversing back to the same egress interface in General Topics

A very weird Behavior on SIP traffic traffic reversing back to the same egress interface

Esameldin — Wed, 01 Jan 2025 12:50:42 GMT

Hello everyone , im seeing a very strange behaviour in my pa-445 version 11.1.4-h7 firewall , where i have an interface on the firewall which is a gateway to my voip devices , the same firewall connects to the voice server through an ipsec tunnel interface , so the traffic flow is like this , voice subnet to firewall and then from firewall to voice server through the tunnel , however on logs i see that the same voice subnet is entering the tunnel interface as "source" & with the "source zone" since its hitting this tunnel interface and ofcourse its denied since the allowed rule is from branch "voice zone" to "hq zone" , however im only seeing this for voice subnet and only on SIP application .

i would really appreciate any help & thanks

Re: A very weird Behavior on SIP traffic traffic reversing back to the same egress interface

JayGolf — Thu, 02 Jan 2025 23:22:25 GMT

Hi @Esameldin ,

Just to confirm, are you saying that the SIP traffic from your voice subnet is being incorrectly processed as originating from an unintended zone, rather than the local voice zone? If possible, could you please share screenshots (with IPs blurred out) to help us further investigate the issue?

Re: A very weird Behavior on SIP traffic traffic reversing back to the same egress interface

Esameldin — Fri, 03 Jan 2025 04:37:24 GMT

Hello @JayGolf ,

yes the traffic is actually generating from the supposed egress interface , its like sent packets are just coming back to the same interface it left , and on the HQ (destination) firewall i have no such logs so traffic is not being generated from HQ, please refer to the below screenshot

On the below screenshots you will find the ingress and egress interfaces , and also normal legal traffic , & the unusual traffic (as per the routing table when traffic is hitting the HQ interface its redirected back to HQ ) & so its denied by zone policy

Direct;y Connected Voice interfacesip-legal-trafficsip-illegal-traffic