How to Adjust VOIP SIP Session Timeout Values

PAN-OS 5.0 and above

The PAN SIP (Session Initiation Protocol) application, used for controlling multimedia sessions such as VOIP, monitors the client-to-server communications to determine which ports to open for a SIP call to complete. The PAN SIP decoder acts like an ALG (Application Layer Gateway) monitoring the client-to-server exchanges to dynamically open the RTP (Real Time Protocol) and RTCP (Real Time Control Protocol) ports used to send the data.

The PAN will hold a SIP session as long as the handset used continues to send keepalives to the SIP server once it has registered. Adjusting the SIP session timeout value on the PAN will extend the time to allow the SIP handset to complete the registration and keep the established SIP session active to wait for keepalives from the handsets. If the SIP timeout is configured for 3600 seconds (1 hour), the PAN will keep the SIP connection open for 1 hour waiting for traffic or a keepalive from the SIP handset. The session in the PAN session table should be maintained if the handset is set to send keepalives every minute, for example.

As long as the SIP handset sends traffic or a keepalive within the SIP timeout, it will not have to re-register to make or receive calls. The SIP session on the PAN will be active and will open the pinhole for the data ports when a new call is initiated.

To extend the timeout value for the SIP application:

• Select Objects > Applications  > SIP > Session Timeout

Also there is the option to modify the Risk of the application as will be shown in ACC tab.

• Commit changes.

owner: ciobanu