Description

WhatsApp voice calls may fail or experience one-way/no audio on an SRX when the security policy allows only the junos:WHATSAPP-SSL dynamic application.


During WhatsApp voice call establishment, the client performs STUN negotiation using UDP/3478. The STUN traffic does not match the WhatsApp-SSL App-ID signature. As a result, the traffic is not matched by a security policy that permits only the WhatsApp-SSL dynamic application, and the voice traffic are dropped.

Symptoms

When the issue occurs, WhatsApp voice traffic may fail to establish or voice traffic may be dropped after the STUN negotiation begins.

 

The following message can be observed in the SRX packet-drop monitoring output:

 

flow drop discarded by jsf plugin junos-dynapp

Solution

Add the STUN dynamic application to the security policy that allows WhatsApp voice traffic.

 

set security policies from-zone trust to-zone untrust policy Whatsapp-voice-traffic match dynamic-application junos:WHATSAPP-SSL

set security policies from-zone trust to-zone untrust policy Whatsapp-voice-traffic match dynamic-application junos:STUN

Modification History

2026-09-22 : Article Created