topic Re: RTP fragment packet flowing is not allowed when fragment enabled on zone protection of PAN-OS in General Topics

RTP fragment packet flowing is not allowed when fragment enabled on zone protection of PAN-OS

Retired Member — Tue, 05 Jun 2018 09:29:36 GMT

Hi All,

I have an issue about sip/rtp traffic. Endpoints are using a calling application that used sip protocol . We have also enabled fragment feature in zone protection setting.I investigate this issue and when endpoint make calling, zone protection drops rtp packets because they are fragmented.

Could you inform me is there another solution advice without disabling fragment feature?

Thanks for ur interested

Re: RTP fragment packet flowing is not allowed when fragment enabled on zone protection of PAN-OS

reaper — Tue, 05 Jun 2018 13:45:04 GMT

hi @Retired Member

you could investigate why there is fragemting: you may need to change the MTU and/or enable and tweak TCP MSS on the interfaces to decrease the paymload and prevent fragmentation

Re: RTP fragment packet flowing is not allowed when fragment enabled on zone protection of PAN-OS

Retired Member — Tue, 05 Jun 2018 22:22:01 GMT

hi @reaper,

firstly thanks for your advice.

does changing tcp mss payload amount affect to other running thing? And also which amount I should adjust? default amount is 40 as I know.

Re: RTP fragment packet flowing is not allowed when fragment enabled on zone protection of PAN-OS

reaper — Wed, 06 Jun 2018 07:00:43 GMT

adjustiing the TCP MSS will impact all traffic (that uses mss in it's header)

there are several tools you could give a try to measure the path MTU to determine the lowest MTU along the path, and then use the mss adjust to lower the mss to match the mtu with the most optimal setting (or give the default a trry)

Re: RTP fragment packet flowing is not allowed when fragment enabled on zone protection of PAN-OS

LukeBullimore — Wed, 06 Jun 2018 13:27:43 GMT

Further to reapers suggestions. You could create subinterface on the firewall with a different zone and zone protection profile attached?

Re: RTP fragment packet flowing is not allowed when fragment enabled on zone protection of PAN-OS

Retired Member — Thu, 07 Jun 2018 14:11:25 GMT

Hi all,

As recent informs, dropping calling is not because of RTP packets. Amount of last sip communication packet exceeds interface MTU size and therefore packet will be sent by fragment by dividing. In this stage we have to increase interface MTU size instead of decreaing 🙂 But this time increasing MTU size will impact some processes. I'm trying to have communication packet decreased or create new zone for this traffic. I will let you keep posted soon 🙂