> Source: [sk135114](https://support.checkpoint.com/results/sk/sk135114)

# sk135114 - UA_PHONE traffic is dropped

| Property | Value |
|----------|-------|
| Solution ID | sk135114 |
| Date Created | 2018-08-28 |
| Last Modified | 2020-07-05 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * UA_PHONE traffic is dropped when packet contains more then 9 UA's or has more then one START_RTP in a packet verification.  

* More then one START_RTP in a packet verification:

  ```
  
  [DATE TIME];...;fw_ua_stateless_verify: more than one START_RTP in one packet;
  [DATE TIME];...;fwconn_handle_field_in_values: operation = get, field = opaque, op_info = 9;
  [DATE TIME];...;fw_ua_handler: fw_ua_stateless_verify failed;
  [DATE TIME];...;fw_ua_manager: fw_ua_handler failed;
  [DATE TIME];...;fw_ua_manager: <== rc=-1;
  [DATE TIME];...;fw_conn_post_inspect: handler function returned action DROP;
  ```

* packet contains more then 9 UA's:

  ```
  
  [DATE TIME];...;fwua_parse: DATA;
  [DATE TIME];...;fwua_parse: ua_num 0 length 3 opcode 13;
  [DATE TIME];...;fwua_parse: ua_num 1 length 3 opcode 13;
  [DATE TIME];...;fwua_parse: ua_num 2 length 3 opcode 13;
  [DATE TIME];...;fwua_parse: ua_num 3 length 3 opcode 13;
  [DATE TIME];...;fwua_parse: ua_num 4 length 3 opcode 13;
  [DATE TIME];...;fwua_parse: ua_num 5 length 3 opcode 13;
  [DATE TIME];...;fwua_parse: ua_num 6 length 3 opcode 13;
  [DATE TIME];...;fwua_parse: ua_num 7 length 3 opcode 13;
  [DATE TIME];...;fwua_parse: ua_num 8 length 3 opcode 13;
  [DATE TIME];...;fwua_parse: ua_num 9 length 3 opcode 13;
  [DATE TIME];...;fwua_parse: too many UAs;
  [DATE TIME];...;fw_ua_handler: fwua_parse failed;
  ```

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content