topic Re: sip invite method request flood attempt in General Topics

sip invite method request flood attempt

jdprovine — Wed, 26 Jun 2019 16:19:38 GMT

I have recently been dealing with sip invite method request flood attempt show up not only in my threatsm but also making it impossible to make calls external or external to internal calls because its trying to call a number every 4 seconds and taking all my SIP connections available. Besides blocking it on the firewall and having the ISP deadroute the called or called number is there anything else I should do?

Re: sip invite method request flood attempt

OtakarKlier — Wed, 26 Jun 2019 17:12:43 GMT

Hello,

I would setup Zone and DoS protection profiles.

https://docs.paloaltonetworks.com/best-practices/8-1/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices.html

Regards,

Re: sip invite method request flood attempt

BPry — Wed, 26 Jun 2019 18:26:09 GMT

@jdprovine,

A DoS Protection Policy as mentioned by @OtakarKlier is probably the best solution to go for something like this, but will involve a fair bit of tuning to get everything to play nice.

Re: sip invite method request flood attempt

jdprovine — Thu, 27 Jun 2019 18:04:47 GMT

@BPry @OtakarKlier

At the least I can block it through the threat prevention, but I don't know how it works, and it appears to started back when they put in the sip trunks last June. Shouldn't it be causing issues all the time with the phones?

Re: sip invite method request flood attempt

OtakarKlier — Thu, 27 Jun 2019 18:09:57 GMT

Hello @jdprovine ,

Its hard to say what it would have dne in the past. Threat prevent may catch it, but its further into the inspection process so it uses more CPU. Zone and DoS protection are your best options here, I think.

Regards,

Re: sip invite method request flood attempt

BPry — Thu, 27 Jun 2019 21:27:27 GMT

@jdprovine,

It probably has simply got to a point where the additonal load caused by this flood, and actual line of business calls, have forced you to cross your CCP limit imposed on the trunk. As long as you didn't cross your CCP limit you likely would have never thought to look at the logs to notice the issue in the first place.