Fragmented SIP traffic gets silently dropped

[MykyUk]

Hi guys,

PA-5250, 9.1.14

Can you help me with this one, please?

PA does not like fragmented SIP INVITE packets, and we can see them in the drop queue:

No traffic, threat or URL filtering logs were created (expected, I believe). 
Why is it doing that?

Thanks,
myky

[Raido_Rattameister]

Do you have Zone Protection applied to zone this traffic comes from?

If you add filter to "Monitor > Packet Capture" to capture traffic from 10.125.3.23 and then run following command in cli what is output? Can you identify based on couters what caused packet drops?

> show counter global filter delta yes packet-filter yes

[MykyUk]

Hey @Raido_Rattameister .
Long time! 

At one point, I thought that my PA skills completely got rusty, as I believe I have checked that earlier. 
There is no ZPP applied; we got only a basic one on the untrusted zone:

thanks,

myky

[Raido_Rattameister]

Hey @MykyUk 

In this case "show counter global filter delta yes packet-filter yes" is best next step figuring out why they are dropped.

[MykyUk]

Got yah, yes will arrange testing today and update this thread. Thanks! myky

[MykyUk]

@Raido_Rattameister have you seen this before:


I have a feeling it might be a TAC case.

thanks,
myky

[MykyUk]

re-run it again; PA is clearly not happy:

[MykyUk · Accepted solution]

@Raido_Rattameister correction:
SSD was replaced, and when we failback traffic, the issue returned.
Eventually, TAC confirmed that we hit the following bug:

PAN-194395
Fixed an issue where the firewall dropped all decrypted outbound (SSL Forward Proxy) HTTP/2 traffic after you upgraded to PAN-OS 9.1.14, which caused websites that used HTTP/2 to become inaccessible.

Same issue, old discussion:
https://www.reddit.com/r/paloaltonetworks/comments/vzrann/panos_9114_software_buffer_depletion/

The bug description is way off.

thanks, myky