> Source: [sk182667](https://support.checkpoint.com/results/sk/sk182667)

# sk182667 - SIP reply packets drops on the cleanup rule

| Property | Value |
|----------|-------|
| Solution ID | sk182667 |
| Date Created | 2024-10-14 |
| Last Modified | 2024-10-22 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- SIP reply traffic drops on the cleanup rule when one-direction SIP over UDP rule is configured in the rule base, and SIP-multicore is enabled.

## Cause

When a SIP request arrives at the Security Gateway, it automatically allows a return traffic connection on the same Firewall instance as the request. If the reply that arrives at the dispatcher is dispatched to a different Firewall instance, it is dropped by the cleanup rule as an unknown connection.  

An example of a one-direction SIP over UDP rule:

|------------|-----------------|-------------|------------|----------------|
| **Source** | **Destination** | **Service** | **Action** | **Install on** |
| **Net_A**  | **Net_B**       | sip         | Accept     | Gateway        |

Net_A and Net_B are IP phone network objects (Nodes or networks).  
This rule only allows IP Phones from Net_A to start calls to IP Phones on Net_B.

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point R82](https://support.checkpoint.com/results/sk/sk181127)
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 79
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 158
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 106

If you choose not to upgrade, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for your version.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

The kernel global parameter **sip_forward_if_needed** was added. When this parameter is enabled, the Security Gateway saves the connection's instance number and forwards the response back to the correct instance when it arrives.  

To enable the global parameter on the fly, run the command:  
`fw ctl set int sip_forward_if_needed 1`  

To enable the global parameter so it survives a Security Gateway reboot, add this line to the *$FWDIR/boot/modules/fwkern.conf* file:   
`sip_forward_if_needed=1`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content