sip invite method request flood attempt

[jdprovine]

I have recently been dealing with sip invite method request flood attempt show up not only in my threatsm but also making it impossible to make calls external or external to internal calls because its trying to call a number every 4 seconds and taking all my SIP connections available. Besides blocking it on the firewall and having the ISP deadroute the called or called number is there anything else I should do?

[OtakarKlier]

Hello,

I would setup Zone and DoS protection profiles.

https://docs.paloaltonetworks.com/best-practices/8-1/dos-and-zone-protection-best-practices/dos-and-...

Regards,

[BPry]

@jdprovine,

A DoS Protection Policy as mentioned by @OtakarKlier is probably the best solution to go for something like this, but will involve a fair bit of tuning to get everything to play nice. 

[jdprovine]

@BPry @OtakarKlier 

At the least I can block it through the threat prevention, but I don't know how it works, and it appears to started back when they put in the sip trunks last June. Shouldn't it be causing issues all the time with the phones?

[OtakarKlier]

Hello @jdprovine ,

Its hard to say what it would have dne in the past. Threat prevent may catch it, but its further into the inspection process so it uses more CPU. Zone and DoS protection are your best options here, I think.

Regards,

[BPry]

@jdprovine,

It probably has simply got to a point where the additonal load caused by this flood, and actual line of business calls, have forced you to cross your CCP limit imposed on the trunk. As long as you didn't cross your CCP limit you likely would have never thought to look at the logs to notice the issue in the first place.