How to Create A SIP Application Override Policy

• Under certain circumstances, the SIP application doesn't want firewall to perform any NAT or ALG. This can be accomplished by disabling SIP ALG or application-override policy.
• In addition to ALG bypass, application-override policy will also bypass application identification and any layer7 (Content and Threat) inspection.
• In this article, we will see how to create SIP application override policy.

• All PanOS Firewalls

Steps:
 

1. Create a new Custom Application for SIP.  From the WebGUI, go to Objects  > Applications, then click Add in the lower left.

Note: The new Custom Application name should be different than Pre-defined. 

The example uses SIP_Override as the name.




2. Select values for Category, Subcategory, and Technology. This can be copied from the pre-defined application object.

3. Optional Step: This just adds another layer ot detail that is not always needed.
Go to Advanced > Defaults, and select Port to list the ports in the application.
This may vary depending on VoIP vendor used so check with customer (or check in traffic logs).

In this example, we are adding tcp/5060-5061.
Timeout values may be copied from pre-defined or check with customer.


 

4. To create an Application Override policy, go to Policies > Application Override, then click Add. 
Under the General tab, enter a name for the policy.

The example uses Application_Override_SIP.

5. Go to Source tab, click Add to add the source zone where the SIP servers/endpoints are present..
Specify Source Address if IPs of SIP servers/endpoints are known, otherwise leave as Any.

6.  Under the Destination tab, click Add to add both the destination zone and destination address of the SIP servers/endpoints. 



7. Under the Protocol/Application tab, select TCP or UDP and add Port depending on VoIP vendor used.

In this example, we are overriding TCP 5060-5061 traffic.
For Application, use custom application object we created .i.e. SIP-Override.



8. Click OK. Here you can see what the Application Override rule looks like.

Apart from creating an application override policy for SIP applications, we would also need to check:

• Security policies for both inbound and outbound traffic to and from the internal SIP server.
• Source and Destination NAT for the SIP servers.
• If ALG is disabled. If not, follow the article link below to disable it.