> Source: [sk176286](https://support.checkpoint.com/results/sk/sk176286)

# sk176286 - VoIP SIP issues after upgrading Security Gateway to version R80.40 or higher with Hide NAT configured

| Property | Value |
|----------|-------|
| Solution ID | sk176286 |
| Date Created | 2021-11-21 |
| Last Modified | 2026-07-29 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * In ElasticXL in the VSNext mode (with 2 or more Security Appliances on one ElasticXL Site), VoIP UDP traffic is not supported between networks in this topology:  

  Network 1 - Virtual System 1 - Virtual Switch - Virtual System 2 - Network 2
* SIP features fail after upgrading a Security Gateway
* Packet capture on the Security Gateway shows that the SIP peer sends traffic to the original source port and not to the Hide NAT source port.

## Cause

**Inspection Settings** \> **SIP - General Settings** \> the setting **"Hide NAT changes source port for SIP over UDP"** is disabled by default.  

When SIP traffic matches a Hide NAT rule, the IP layer changes the source port based on the Hide NAT rule. The source port in the SIP payload changes based on the "**Hide NAT changes source port for SIP over UDP** " setting.  

* In Security Gateways R80.30 and lower, the source port in the SIP payload changes regardless of this setting.
* In Security Gateways R80.40 and higher, the source port in the SIP payload changes only based on this setting.

SIP devices use the IP and Port inside the SIP payload to send traffic to SIP peers. This can cause one-way communication, such as one-way audio, or only being able to establish a call in one direction.

In Security Gateways R80.30 and lower, SIP appears to work because the Security Gateway changes the source port in the SIP payload, and the SIP peer uses the correct source port after Hide NAT.

In Security Gateways R80.40 and higher, SIP breaks because the setting "**Hide NAT changes source port for SIP over UDP**" is disabled by default. As a result, the Security Gateway does not change the source port in the SIP payload. The SIP peers begin to send traffic to the source port before NAT. The Security Gateway does not accept this traffic.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content