1

I am facing wearied scenario. We are having a SIP gateway in DMZ, yesterday I have observed malicious traffic hitting SIP gateway from the 212.x.x.209 IP. I immediately Banned this IP in firewall so that traffic get denied on firewall itself but it is getting passed intermediately.

Malicious traffic is coming from all banned IP's but I don't understand why it was getting allowed intermediately?

This issue is related to SIP traffic. We are having Fortigate 100D with firmware v5.6.4

PFA the banned IP list and logs so that you can understand the scenario clearly.

Banned IP list

Firewall logs

Kindly help me to understand this.

  • 2
    It would definitely help to see how your policies are set up in order to really give you an answer. Is your Banned IP Deny policy at the top? Do you have any allow policies before it? Is it possible this traffic is originating from a different zone? If you can provide a sanitized copy of your policies it would greatly help. – A-A-Ron Jul 3 '18 at 14:08
  • deny policy is above allowed policy, there is no way here to go in. I have specifically denied 8-10 malicious IP's but somehow they are going through firewall. – Nishad Morey Jul 4 '18 at 17:17
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:57
0

You need to check the Forward Traffic log for which policy is applied for the accepted connections. If you don't see the policy column you need to add it to the display.

Policies are applied in strict order, first match from top to bottom is applied. Likely, you need to resort your policies or refine a previous ACCEPT policy that's too wide.

For a SIP gateway connection I'd accept only the single defined IP address or subnet that it's located on.

  • It is located on top but still it is getting allowed intermittently. That is what I am not able to understand, when i checked with the forward logs it is showing me action as denied due to policy violation POLICY ID : 10 and in accept logs also with policy ID 10. Policy ID 10 is the actual inbound policy for SIP traffic where in source as All and destination is SIP gateway IP.. – Nishad Morey Jul 4 '18 at 17:14
  • You'll need to post details on this policy. Usually, it's good practice to use a policy only to allow a connection under specific circumstances (source IP, destination port, ...) and let it fall through otherwise. The implicit `deny any´ policy at the end will take care of the unwanted conenctions. I suspect you use a rule with mixed allow and deny elements without realizing it. – Zac67 Jul 4 '18 at 18:06
  • yes I have placed the deny policy for the malicious IP's and observing the traffic. It was getting allowed intermediately. – Nishad Morey Jul 17 '18 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.