topic Re: Disable Inspection for Sip ? in General Topics

Disable Inspection for Sip ?

jhickey — Wed, 01 Feb 2012 13:18:39 GMT

In the ASA you can disable SIP Policy Inspection. In the Junipers I think you disable the ALG. How do I do this in the Palo Alto ?

Firewalls often try to apply rules around the way protocols work which can cause them to break. I dont want SIP to be inspected or held against some EEE Group Standard. This might be breaking some video conference traffic for us.

Anyone know how to disable this ?

Thanks,

Justin

Re: Disable Inspection for Sip ?

mikand — Wed, 01 Feb 2012 16:14:48 GMT

That is because both Cisco and Juniper have some sort of "proxy lite" feature regarding SIP in order to replace the contents of the packets (so not a true proxy) which often f**k things up rather than fix stuff (the main purpose is to aid use of SIP etc through NAT because SIP will use the data within the payload of where to connect instead of looking at the ip-header).

PaloAlto (as far as I know) doesnt do this so you can either setup your rules such as:

srczone: voipclients

srcip: somerange

srcport: >1023

dstzone: voipservers

dstip: someotherrange

dstport: tcp5060, udp5060 (or whatever you use)

appid: sip

action: allow

or just set the appid to "any" if you doesnt care of which traffic will flow for the particular ports.

Re: Disable Inspection for Sip ?

Retired Member — Thu, 02 Feb 2012 04:47:51 GMT

Palo Alto can translate IP in SDP header. Basically to avoid any "ALG" type functionality, you can create an app-override rule for your SIP traffic. That will avoid any layer2 inspection of the SIP traffic. Just be sure that you do have security rules for all the necessary protocols and ports to allow the traffic.

-Richard

Re: Disable Inspection for Sip ?

PAkeeper — Tue, 24 Apr 2012 14:19:15 GMT

I have exact the same problem as discribed in https://live.paloaltonetworks.com/message/7760 (but that treat is locked for posting).

Our VoIP provider insists that we disable all "SIP-ALG, SIP-Helper or the like".

I understand that application override can be use to work around this, but can you be more specific on how to accomplish this?

Thanks, Johannes.

Re: Disable Inspection for Sip ?

lildeniz — Mon, 25 Jun 2012 00:51:36 GMT

di u resolve your problem if you resolved

how can you do that

thanks alot

Re: Disable Inspection for Sip ?

gchandrasekaran — Wed, 23 Apr 2014 08:09:31 GMT

PAN-OS 6.0.x has a feature to disable SIP-ALG. Please refer How to Disable SIP ALG.

Re: Disable Inspection for Sip ?

gchandrasekaran — Wed, 23 Apr 2014 08:14:55 GMT

PAN-OS 6.0.x has a feature to disable SIP-ALG. Please refer How to Disable SIP ALG.

For prior PAN-OS versions, SIP-ALG can be disabled by configuring an application override policy which will prevent the PA firewall from doing any Layer 7 inspection. So, PA firewall would not open any pinholes. For App override setup, refer How to Create an Application Override Policy