For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Seckin_149390's avatar
Seckin_149390
Icon for Nimbostratus rankNimbostratus
Dec 06, 2016

F5 does return back to client SIP 200 OK message

Hi all,

 

I have configured F5 device V12.1.0 Hotfix 2 with HA mode. Configuration looks ok, but SIP service that i configured is not working as expected. F5 device does not return SIP 200 OK message to the client, and f5 device is working routed mode and SNAT is not open. Backend servers has static route to the client side to prevent asymetric routing. You can find unsuccessful packet trace as follows;

 

No. Time Source Destination Protocol Length Info 6 2.220695 10.10.100.4 10.10.105.50 SIP 457 Request: OPTIONS sip:10.10.105.50 |

 

Frame 6: 457 bytes on wire (3656 bits), 457 bytes captured (3656 bits) Ethernet II, Src: CiscoInc_18:88:00 (00:23:04:18:88:00), Dst: F5Networ_25:58:04 (f4:15:63:25:58:04) 802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 4092 Internet Protocol Version 4, Src: 10.10.100.4, Dst: 10.10.105.50 User Datagram Protocol, Src Port: 5061, Dst Port: 5060 Session Initiation Protocol (OPTIONS)

 

No. Time Source Destination Protocol Length Info 7 2.220765 10.10.100.4 10.10.104.49 SIP 457 Request: OPTIONS sip:10.10.105.50 |

 

Frame 7: 457 bytes on wire (3656 bits), 457 bytes captured (3656 bits) Ethernet II, Src: F5Networ_25:58:03 (f4:15:63:25:58:03), Dst: Dell_51:68:9b (18:66:da:51:68:9b) 802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 170 Internet Protocol Version 4, Src: 10.10.100.4, Dst: 10.10.104.49 User Datagram Protocol, Src Port: 35365, Dst Port: 50001 Session Initiation Protocol (OPTIONS)

 

No. Time Source Destination Protocol Length Info 8 2.221214 10.10.104.49 10.10.100.4 SIP 403 Status: 200 OK |

 

Frame 8: 403 bytes on wire (3224 bits), 403 bytes captured (3224 bits) Ethernet II, Src: Dell_51:68:9b (18:66:da:51:68:9b), Dst: F5Networ_25:58:03 (f4:15:63:25:58:03) 802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 170 Internet Protocol Version 4, Src: 10.10.104.49, Dst: 10.10.100.4 User Datagram Protocol, Src Port: 50001, Dst Port: 5061 Session Initiation Protocol (200)

 

Could please confirm that F5 device can manage SIP traffic successfully ?

 

Regards,

 

application delivery
LTM

6 Replies

  • Nazir_52641's avatar
    Nazir_52641
    Icon for Cirrus rankCirrus
    Dec 06, 2016

    Hi Seckin, 

    Please share what kind of configuration you had made in F5 for SIP.

From the packet trace below is the message from F5 and Backend SIP server
F5 (10.10.100.4:35365 ) ==> SIP OPTIONS ==>SIP server (10.10.104.49:50001)
SIP server (10.10.104.49:50001) ==> 200 ==> F5(10.10.100.4:5061)

The backend server is not sending the response back on the same port from 
where it has received the request.

Solution: 
1) Either backend server has to send the respond back on the same port as 
received in request
2) Add iRule in F5 to add Via header with correct port number.
    • Mulham_171271's avatar
      Mulham_171271
      Icon for Nimbostratus rankNimbostratus
      Apr 16, 2017

      Any update regarding this ? I have the exact same problem except I'm using SNAT pool (as instructed by SIP deployment guide)

       

    • Nazir_52641's avatar
      Nazir_52641
      Icon for Cirrus rankCirrus
      May 05, 2017

      Hi Mulham,

      Can you elaborate the problem so that I can give some solution.
    • Mulham_171271's avatar
      Mulham_171271
      Icon for Nimbostratus rankNimbostratus
      May 07, 2017

      the problem is exactly similar to Seckin problem, which is: "The backend server is not sending the response back on the same port from where it has received the request.".

       

      The only difference is that I'm using SNAT pool to ensure traffic is returned through F5.

       

      Much appreciated.

       

  • Nazir_52641's avatar
    Nazir_52641
    Icon for Cirrus rankCirrus
    May 19, 2017

    Hi Mulham,

     

    For the issue to get resolved backend server should always send response on the same port from where it received the request. There are 2 options

     

    1) Backend sending response to the correct port 2) Add Via header in F5 using iRule when sending REQUEST to back end in SIP_REQUEST_SEND event in server context(clientside == 0) and delete the Via header on receiving response from backend in SIP_RESPONSE event in server context

     

    Please share the SIP request and response if the issue still persists along with the IP headers.

     

    Thanks

     

    Syed Nazir

     

  • Seckin_149390's avatar
    Seckin_149390
    Icon for Nimbostratus rankNimbostratus
    May 22, 2017

    Hi Mulham,

     

    Only recommendation that i gave you regarding this issue, do not use any SNAT. Use route mode for this, if it is possible.