Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Replies 1 reply
  • Subscribers 40 subscribers
  • Views 742 views
  • Users 0 members are here
Options
Suggested

FreePBX triggers Network attacks - protocol-voip

148Points

Hi, all of a sudden we see that our FreePBX installations triggers Network-attacks in our XGS. 

"Attacker" is our FreePBX, 192.168.1.22 - "Victim" is the IP of our SIP-Trunk Provider. Attack : PROTOCOL-VOIP Contact header format string attempt. This is getting dropped which results in our FreePBX not being able to initiate the SIP Trunk.

Any ideas why this all of a sudden happens and how i can tell the FW to stop dropping these "Attacks"

Thank you!



Added TAGs
[edited by: Raphael Alganes at 12:40 PM (GMT -7) on 31 Oct 2024]
Parents
  • 0

    Hi  Thank you for reaching out to the Sophos community team. It looks like traffic initiated from FreePBX towards your trunk provider has a matching traffic pattern with the IPS signature of "PROTOCOL-VOIP Contact header format string attempt". This may require Support case investigation, so support may collect the required logs and PCAP file to have validation on it and to confirm if it is false positive detection or any other reasons! Once the case is logged please share the support case ID with us here to review its progress or to add the required notes over it.

    Regards,

    Vishal Ranpariya
    Technical Account Manager | Sophos Technical Support
    Sophos Support Videos | Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts |
    If a post solves your question use the 'Verify Answer' link.

Reply
  • 0

    Hi  Thank you for reaching out to the Sophos community team. It looks like traffic initiated from FreePBX towards your trunk provider has a matching traffic pattern with the IPS signature of "PROTOCOL-VOIP Contact header format string attempt". This may require Support case investigation, so support may collect the required logs and PCAP file to have validation on it and to confirm if it is false positive detection or any other reasons! Once the case is logged please share the support case ID with us here to review its progress or to add the required notes over it.

    Regards,

    Vishal Ranpariya
    Technical Account Manager | Sophos Technical Support
    Sophos Support Videos | Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts |
    If a post solves your question use the 'Verify Answer' link.

Children
No Data
Unfiltered HTML