I am facing wearied scenario. We are having a SIP gateway in DMZ, yesterday I have observed malicious traffic hitting SIP gateway from the 212.x.x.209 IP. I immediately Banned this IP in firewall so that traffic get denied on firewall itself but it is getting passed intermediately.
Malicious traffic is coming from all banned IP's but I don't understand why it was getting allowed intermediately?
This issue is related to SIP traffic. We are having Fortigate 100D with firmware v5.6.4
PFA the banned IP list and logs so that you can understand the scenario clearly.
Kindly help me to understand this.