iOS Zone Based Firewall (ZBFW) drops SIP calls after 20 minutes

[4rmorris]

Hi all,

I've got a Cisco 2811 router running 15.1.4 with an SDM configured ZBFW.  Behind it there are ATAs connecting phones to a cloud-based VoIP service provider.  So no CUCM or CME on the router, just pass-through SIP registrations to the SP and then RTP streams from the ATAs to the SP SBCs.

What happens is, every call drops after exactly 20 minutes.  Looking through the config and documentation, I couldn't find any SIP specific config or timeouts, and no absolute timeouts for UDP or TCP (lots of idle timeout config, but the calls are not idle!).

There's a SIP inspect statement in the class-maps, but I don't see this used in a policy-map and I don't see any hits in the show zone security output.

Any thoughts on options to avoid these connections being broken?

Thanks,

Ryan

[Mohammed al Baqari]

I think you need to contact your voip provider. If its exactly 20-mins, it
can be the session timeout value set in your call setup.

ZBFW has nothing to do with this. Even if ZBFW blocks SIP after call being
established, audio will be preserved and won't drop until one of the
parties disconnect.