During a VoIP call, when the phone is picked up the first few seconds of the conversation is dropped. After this period of time voice resumes and continues fine until call completion. This has been seen with Nortel as well as Avaya VoIP phones.
This is actually a problem on the VoIP device. For some reason, when the RTP stream session is started the receiving VoIP endpoint is not ready and thus sends ICMP type 3, code 2 (destination unreachable, port unreachable) message. SRX behavior upon receiving such ICMP unreachable message is to invalidate the RTP session and then close it to prevent unwanted sessions from filling up the session table. The period of time when the session is in invalid state lasts for approximately 2 seconds before the session is removed from the table. During this 2 second invalid period, no matching traffic is permitted. After this time period if RTP traffic still exists and there are no firewall restrictions, then the session can rebuild and voice would work normally thereafter.
This should be resolved by the VoIP endpoint vendor. However in some cases where the VoIP endpoint device is not able to avoid sending ICMP unreachable message, SRX can block the ICMP unreachable messages from reaching the flow module by configuring a firewall filter to block such messages. Doing so will prevent the ICMP unreachable from reaching the flow session lookup and thereby will not invalidate the session.
Below is sample configuration of such a filter. This example assumes that VoIP device that is sending ICMP unreachable message is coming from ge-0/0/0.
Configure firewall filter to block ICMP type 3, code 2 while accepting all other traffic.
set firewall filter block-icmp-ur term 1 from icmp-type unreachable set firewall filter block-icmp-ur term 1 from icmp-code port-unreachable set firewall filter block-icmp-ur term 1 then discard set firewall filter block-icmp-ur term 2 then accept
Apply the filter input direction for your interface where ICMP message is received.
set interfaces ge-0/0/0 unit 0 family inet filter input block-icmp-ur
2020-07-14: Archived.