How to determine whether traffic matching a specific policy will enter the ALG module for processing
Given the following configuration example, will SIP traffic that matches policy 667 be forwarded to the SIP ALG module for processing?
application TCP_5060 {
term TCP_5060 protocol tcp source-port 0-65535 destination-port 5060-5060;
from-zone trust to-zone untrust
policy 667 {
match {
source-address [ MAILIMSVA01 MAILIMSVA02 ];
destination-address [ MAILIMSVA01-180 MAILIMSVA02-181 MAILIMSVA03-180 MAILIMSVA03-208 MAILIMSVA04-181 MAILIMSVA04 WDMZAPP05C ];
application [ junos-dns-tcp junos-dns-udp TCP_10024 TCP_10026 TCP_10027 TCP_15505 TCP_5060 TCP_5432 TCP_8005 TCP_8009 TCP_8015 TCP_953 ];
}
then {
permit;
log {
session-init;
session-close;
root@jtac-SRX5800-r004# run show security alg status
ALG Status:
DNS : Enabled
FTP : Enabled
H323 : Disabled
MGCP : Disabled
MSRPC : Enabled
PPTP : Enabled
RSH : Disabled
RTSP : Disabled
SCCP : Disabled
SIP : Enabled
SQL : Disabled
SUNRPC : Enabled
TALK : Enabled
TFTP : Enabled
IKE-ESP : Disabled
TWAMP : Disabled
We can use two commands to verify whether SIP traffic matched to policy 667 will be processed by SIP ALG:
1.show security policies policy-name 667 detail
For this command outputs, please check the ALG field:
ALG: If an ALG is explicitly associated with the policy, the name of the ALG is displayed. If application-protocol ignore is configured, ignore is displayed. Otherwise, 0 is displayed.
However, even if this command shows ALG:0, ALGs might be triggered for packets destined to well-known ports on which ALGs are listening, unless ALGs are explicitly disabled or when application-protocol ignore is not configured for custom applications.
ALG 0 doesn't mean the traffic will not proceed by the ALG module. In this case, although the custom application TCP_5060 / UDP_5060 doesn't specify the " alg sip" but due to it is using the well-known port 5060 and the global SIP ALG is enabled, so now we can confirm the SIP traffic which match the policy with the application TCP_5060/UDP_5060 will proceed by the SIP ALG module.
2.show security alg sip counters
root@jtac-SRX5800-r004# run show security alg sip counters
Method T 1xx 2xx 3xx 4xx 5xx 6xx
RT RT RT RT RT RT RT
INVITE 0 0 0 0 0 0 0
0 0 0 0 0 0 0
CANCEL 0 0 0 0 0 0 0
ACK 0 0 0 0 0 0 0
BYE 0 0 0 0 0 0 0
REGISTER 0 0 0 0 0 0 0
OPTIONS 2 0 0 0 0 0 0
INFO 0 0 0 0 0 0 0
MESSAGE 0 0 0 0 0 0 0
NOTIFY 0 0 0 0 0 0 0
PRACK 0 0 0 0 0 0 0
PUBLISH 0 0 0 0 0 0 0
REFER 0 0 0 0 0 0 0
SUBSCRIBE 0 0 0 0 0 0 0
UPDATE 0 0 0 0 0 0 0
BENOTIFY 0 0 0 0 0 0 0
SERVICE 0 0 0 0 0 0 0
OTHER 0 0 0 0 0 0 0
SIP Error Counters:
Total Pkt-in : 2
Total Pkt dropped on error : 0
Call error : 0
IP resolve error : 0
NAT error : 0
Resource manager error : 0
RR header exceeded max : 0
Contact header exceeded max : 0
Call Dropped due to limit : 0
SIP stack error : 0
SIP decode error : 0
SIP unknown method error : 0
SIP dscp marked : 0
SIP dscp marked error : 0
RTO message sent : 0
RTO message received : 0
RTO buffer allocation failure : 0
RTO buffer transmit failure : 0
RTO send processing error : 0
RTO receive processing error : 0
RTO receive invalid length : 0
RTO receive call process error : 0
RTO receive call allocation error : 0
RTO receive call register error : 0
RTO receive invalid status error : 0
Total Pkt-in : 2 and OPTIONS 2 in this outputs means there are SIP packets proceed by the SIP ALG module.