Blocking SIP request messages
You may want to block different types of SIP requests:
- to prevent SIP attacks using these messages.
- If your SIP server cannot process some SIP messages because of a temporary issue (for example a bug that crashes or compromises the server when it receives a message of a certain type).
- Your SIP implementation does not use certain message types.
When you enable message blocking for a message type in a VoIP profile, whenever a security policy containing the VoIP profile accepts a SIP message of this type, the SIP ALG silently discards the message and records a log message about the action.
Use the following command to configure a VoIP profile to block SIP CANCEL and Update request messages:
config voip profile edit VoIP_Pro_Name
config sip
set block-cancel enable set block-update enable
end end
SIP uses a variety of text-based messages or requests to communicate information about SIP clients and servers to the various components of the SIP network. Since SIP requests are simple text messages and since the requests or their replies can contain information about network components on either side of the FortiGate unit, it may be a security risk to allow these messages to pass through.
The following table lists all of the VoIP profile SIP request message blocking options. All of these options are disabled by default.
Blocking SIP OPTIONS messages may prevent a redundant configuration from oper- ating correctly. See Supporting geographic redundancy when blocking OPTIONS mes- sages on page 2822 for information about resolving this problem.
Options for blocking SIP request messages
SIP request mes- sage
SIP message blocking CLI Option
ACK block-ack
BYE block-bye
Cancel block-cancel
INFO block-info
INVITE block-invite
Message block-message
Notify block-notify
SIP request mes- sage
SIP message blocking CLI Option
Options block-options
PRACK block-prack
Publish block-publish
Refer block-refer
Register block-register
Subscribe block-subscribe
Update block-update