> Source: [sk114769](https://support.checkpoint.com/results/sk/sk114769)

# sk114769 - SIP call is dropped with "SIP Re-Invites exceeded the limit" log

| Property | Value |
|----------|-------|
| Solution ID | sk114769 |
| Date Created | 2016-12-04 |
| Last Modified | 2024-07-04 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * After being connected for some time, SIP calls are suddenly disconnected.
* SmartConsole displays drop logs for the disconnected SIP calls with the following reason:  
  `SIP Re-Invites exceeded the limit`

## Cause

The SIP protocol handshake contains messages in its header that control how long a SIP session should remain active without being refreshed (Session-Expires) and how frequently the session expiration timer should be refreshed (Min-SE).

When a host initiates a SIP session with an INVITE request, the Session-Expires parameter can be included in the SIP message header to specify the desired session duration. The host responding to the INVITE request may accept or modify the session expiration value. The agreed value is communicated back in the 200 OK response.

Before the active SIP session expiration time elapses, a session refresh request (typically a re-INVITE) must be sent to keep the session alive. This refresh mechanism ensures that both endpoints confirm the session's continuation. If no refresh request is received within the Session-Expires interval, the session is considered expired, and the resources associated with the session can be released.

The Check Point Firewall also uses these messages to track SIP call state in a dedicated kernel table (sip_state). Each SIP call in this kernel table maintains a queue of unexpired re-INVITE messages, up to a configured maximum value (sip_max_reinvite). The Firewall will periodically expire a re-INVITE from each call's re-INVITE queue at a configured interval (sip_expire).

If the sip_expire and sip_max_reinvite parameters are not tuned according to the configuration of the SIP hosts, re-INVITE messages may accumulate for calls in the sip_state table faster than they are expired. If the accumulated number of unexpired re-INVITE messages for a specific call exceeds the value of sip_max_reinvite, that call will be dropped, with the log: "SIP Re-Invites exceeded the limit".

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content