Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 1 reply
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 733 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Stuck SIP NAT since 19.0.0

jamesharper

Since upgrading to 19.0.0 we have a recurring issue where SIP connections get stuck without NAT. As best as I can tell:

  1. Firewall starts up, WAN connection(s) are not up yet
  2. PBX sends SIP packet to ISP
  3. Sophos XG records connection without any NAT
  4. WAN connections come up
  5. NAT is not re-evaluated, meaning SIP packets are leaving the network with internal LAN source IP instead of external WAN source IP (a security issue of its own, but not the topic of this post)
  6. SIP packets are sent every 30 seconds which keeps the un-NAT'd connection alive forever until the PBX is turned off for 60-3600 seconds (depending on SIP ALG on XG), or until I manually delete the connection from the conntrack tables

This never happened with 18.x.x or older.

For sites with a single static WAN I can hardcode the NAT rule to always be the WAN IP, and that works, but for sites with dynamic WAN IP, or multiple WAN connections (Fibre + 4G backup) this doesn't work.

The best possible solution I can come up with is to create a low priority dummy backup connection that is always up, and use the "Force connections back to primary WAN" setting. I haven't tested this, as testing is difficult with this fault.

Is anyone else seeing this? Any suggestions?

Thanks

James



This thread was automatically locked due to age.
  • 0

    I've not and we've a large number of v19+ XGS out there passing SIP trunks (both before and after moving to v19), though none have SIP ALG enabled as it just breaks everything SIP - which always makes me wonder why it's enabled by default (or even its existence for that matter).

    If I recall the XG will read the SIP call setup information and allow all the respective packet flows without extra firewall rules, though if you are using different internal IP's for SIP and + RTP you still need the NAT's.

    Regards

Unfiltered HTML