Network objects seem to be ignored by firewall and NAT rules.

are you able to see the connection with conntrack?

conntrack -E | grep "port=5060"

What do you mean exactly with "triggered"? no logs? Byte count of that rule not increasing?

The byte count never increases.

The log viewer never shows traffic.

I have to use tcpdump or pcap to see any traffic at all from the internal host.

I won't be able to get any further info for a while as the customer has removed it from the network and gone back to the original SG.

Strangely, if I add ICMP to the rule, I can ping external resources no problem and the byte count increases and log viewer shows the traffic processed by the correct rule.

Hi Neil_Evolve,

By any chance, if you've web admin access then please share firewall rule/NAT rule config snapshots here or in PM, or maybe you can share it next time when the customer connects XG back to the network.

Also, please restart a phone and see if you will see something in the logs for that phone when it restarts.

If these are existing connections, you will not see a new line in the logviewer.

But you can verify with the conntrack as mentioned. You will see a fwid with the ID of the Rule there.

The byte count will not increase if the networks are not routed by XG, e.g. by an other firewall or L3 core switch.

The phones themselves don't go external, they are routed via an on-prem IP phone system. Only the single controller goes external.

I should be able to gather more data in a couple of weeks, but for now the XG is offline.

As I said previously, even creating an Any/Any/Any rule fails to allow traffic for port 5060. All other traffic from all internal hosts works. It is only UDP/TCP 5060 that is not going external.

This is a migration using the migration tool to export and import the SG/XG config, perhaps something got screwed-up along the way? Strange that only port 5060 should be affected.

OK, I got your point. I believed until now the traffic was working but you didn't see the rule getting hit that allowed it.

So the controller will not go outside to PBX or is it the phones not reaching their internal phone controller?

Maybe that the SIP support was enabled on the console and the packets beeing consumed by the XG but AFAIK this is disabled per default. Other thing is, the traffic was denied due some Violation but this can be easily seen on packet capture on the web admin.

Hope you will figure it out the next time you work on that project.

Thanks to everyone for their input.

It turned out to be a static route on the switch that routed all outbound SIP traffic to the internal address of the old firewall. I hadn't noticed, but we were seeing inbound traffic only.