> Source: [sk89320](https://support.checkpoint.com/results/sk/sk89320) # sk89320 - SIP calls (RTP) traffic work in one direction through Security Gateway with ISP Redundancy | Property | Value | |----------|-------| | Solution ID | sk89320 | | Date Created | 2012-12-03 | | Last Modified | 2025-08-21 | | Technical Level | General | | Products | Security Gateway | | Versions | R82, R81.20, R81.10 (EOS) | ## Symptoms - * SIP traffic passes successfully only in one direction through Security Gateway with ISP Redundancy (the returning RTP packets are blocked when ISP Redundancy enabled). * Kernel debug and traffic captures show that: * RTP packets from a host on the other side enter the FireWall * RTP packets pass through the Pre-Inbound chains and Post-Inbound chains * RTP packets pass through the Pre-Outbound chains on the correct interface, through which the packets should be routed out * In Post-Outbound chains, the packets are routed out the wrong interface ## Cause 1. The SIP connection is recognized as Client-2-Server in both directions, while ISP Redundancy should be applied on Server-2-Client direction - as a result, ISP Redundancy is not applied on the traffic in the opposite direction. 2. The RTP connection is opened in the opposite direction to SIP and the Server-2-Client of RTP does not match the Server-2-Client of the original SIP - as a result, ISP Redundancy is applied on the traffic of the wrong direction. ## Solution This problem was fixed. The fix is included in: * [Check Point R70.50](http://supportcontent.checkpoint.com/solutions?id=sk65068) * [Check Point R71.50](http://supportcontent.checkpoint.com/solutions?id=sk69720) * [Check Point R75.30](http://supportcontent.checkpoint.com/solutions?id=sk66283) * [Check Point R75.40](http://supportcontent.checkpoint.com/solutions?id=sk67581) * [Check Point R75.40VS](http://supportcontent.checkpoint.com/solutions?id=sk76540) Check Point recommends to always upgrade to the most recent version **Code was improved:** * Administrator will be able to disable ISP Redundancy for specific Protocol and Port for the incoming connections. *** ** * ** *** **Table of Contents:** * Procedure * Location of the "`user_early.def`" files on the Management side ### Procedure {#Procedure} 1. Install the hotfix onto involved Security Gateways / all members of the involved clusters. 2. Reboot the involved machines. 3. The relevant "**`user_early.def`** " file has to be modified on the Management Side. **Note:** In Management HA environment, this procedure must be performed only on the Primary Management Server (changes will be automatically synchronized to the Secondary Management Server). Exact location of this file depends on the version of the managed Security Gateway. Refer to the summary table with locations below this procedure. Note: In all the commands below, as an example, we modify the `$FWDIR/lib/user_early.def` file on the Security Management Server. 4. Connect to the command line of Security Management Server / Provider-1 Server / Multi-Domain Security Management Server that manages this Security Gateway / Cluster (over SSH, or console). Log in to Expert mode. On Provider-1 Server / Multi-Domain Security Management Server, switch to the context of the involved CMA / Domain Management Server: **`[Expert@HostName]# mdsenv `** 5. Back up the current "`user_early.def`" file: **`[Expert@HostName]# cp $FWDIR/lib/user_early.def $FWDIR/lib/user_early.def_BKP`** 6. Open the current "`user_early.def`" file in a plain-text editor: **`[Expert@HostName]# vi $FWDIR/lib/user_early.def`** 7. Modify the file in the following way (to disable ISP Redundancy for SIP protocol - UDP port 5060): ``` #ifndef __user_def__ #define __user_def__ // // User defined INSPECT code // no_misp_incoming_services_ports = { <5060, 17> }; #endif /* __user_def__ */ ``` 8. Save the changes in the file and exit the plain-text editor. 9. Install the Security Policy onto onto involved Security Gateways / involved clusters.

**Note:** During upgrade of Security Management / Multi-Domain Security Management Server, the changes in all "`user_early.def`" files will be over-written (since these files will be created from the scratch). *Therefore, these files should be backed up before the upgrade* . The syntax/content of the new "`user_early.def`" files that will be created during the upgrade might differ from the files in previous version. *Therefore, after the upgrade is complete, the relevant "`user_early.def`" files should be **edited again** and should NOT be replaced by the old files.* ### Location of the "`user_early.def`" files on the Management side {#Summary table with locations} |------------------------------------|-----------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Management Server | Managed Security Gateway | File Location | | **R80.10** | R77 R77.10 R77.20 R77.30 | * Security Management Server on Gaia OS: **`/opt/CPR77CMP-R80/lib/user_early.def`** * Domain Management Server on Gaia OS: **`$MDSDIR/customers/<`*Name_of_Domain*`>/CPR77CMP-R80/lib/user_early.def`** | | **R80.10** | R80.10 | * Security Management Server on Gaia OS: **`$FWDIR/lib/user_early.def`** * Domain Management Server on Gaia OS: **`$MDSDIR/customers/<`*Name_of_Domain*`>/CPsuite-R80/fw1/lib/user_early.def`** | | **R80.10** | 1100 running R75.20.X firmware | * Security Management Server on Gaia OS: **`/opt/CPSG80R75CMP-R80/lib/user_early.def`** * Domain Management Server on Gaia OS: **`$MDSDIR/customers/<`*Name_of_Domain*`>/CPSG80R75CMP-R80/lib/user_early.def`** | | **R80.10** | 1100 / 1200R / 1400 running R77.20.X firmware | * Security Management Server on Gaia OS: **`/opt/CPSFWR77CMP-R80/lib/user_early.def`** * Domain Management Server on Gaia OS: **`$MDSDIR/customers/<`*Name_of_Domain*`>/CPSFWR77CMP-R80/lib/user_early.def`** | | Management Server | Managed Security Gateway | File Location | | **R80** | R77 R77.10 R77.20 R77.30 | * Security Management Server on Gaia OS: **`/opt/CPR77CMP-R80/lib/user_early.def`** * Domain Management Server on Gaia OS: **`$MDSDIR/customers/<`*Name_of_Domain*`>/CPR77CMP-R80/lib/user_early.def`** | | **R80** | 1100 / 1200R / 1400 running R77.20.X firmware | * Security Management Server on Gaia OS: **`/opt/CPSFWR77CMP-R80/lib/user_early.def`** * Domain Management Server on Gaia OS: **`$MDSDIR/customers/<`*Name_of_Domain*`>/CPSFWR77CMP-R80/lib/user_early.def`** | | Management Server | Managed Security Gateway | File Location | | **R77 / R77.10 / R77.20 / R77.30** | R77 R77.10 R77.20 R77.30 | * Security Management Server on Gaia OS: **`$FWDIR/lib/user_early.def`** * Domain Management Server on Gaia OS: **`$MDSDIR/customers/<`*Name_of_Domain*`>/CPsuite-R77/fw1/lib/user_early.def`** | | **R77 / R77.10 / R77.20 / R77.30** | 1100 / 1200R / 1400 running R77.20.X firmware | * Security Management Server on Gaia: **`/opt/CPSFWR77CMP-R77/lib/user_early.def`** * Domain Management Server on Gaia OS: **`$MDSDIR/customers/<`*Name_of_Domain*`>/CPSFWR77CMP-R77/lib/user_early.def`** | --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content