Description

The following excerpt is from Juniper's technical document on ​ Understanding the SIP ALG ​.

​"Junos OS supports SIP as a service, allowing and denying it based on a policy that you configure. SIP is a predefined service in Junos OS and uses port 5060 as the destination port.

One of SIP’s function is to distribute session-description information, and during the session, to negotiate and modify the parameters of the session. SIP is also used to terminate a multimedia session, signal a call establishment, provide failure indication, and provide methods for endpoint registration."

SIP has signaling session and media session.
 
Video RTP/RTCP(9078/9079)
Voice RTP/RTCP(7078/7079)
SIP   5060

 

Symptoms

The following was collected when making a call (In a ringing state. The call was not yet established.).
In this state, media sessions are not yet created, so there are 4 media gates in the command and one signaling gate.

root@SRX220H2A> show security flow gate node 1
node1:
--------------------------------------------------------------------------

Hole: 0.0.0.0-0.0.0.0/0-0->192.168.60.50-192.168.60.50/9078-9078
  Translated: 0.0.0.0/0->0.0.0.0/0
  Protocol: udp
  Application: SIP ALG/63
  Age: 114 seconds
  Flags: 0x0080
  Zone: untrust
  Reference count: 1
  Resource: 9-3-3

Hole: 0.0.0.0-0.0.0.0/0-0->192.168.60.50-192.168.60.50/9079-9079
  Translated: 0.0.0.0/0->0.0.0.0/0
  Protocol: udp
  Application: SIP ALG/63
  Age: 114 seconds
  Flags: 0x0080
  Zone: untrust
  Reference count: 1
  Resource: 9-3-35

Hole: 0.0.0.0-0.0.0.0/0-0->192.168.60.50-192.168.60.50/7078-7078
  Translated: 0.0.0.0/0->0.0.0.0/0
  Protocol: udp
  Application: SIP ALG/63
  Age: 114 seconds
  Flags: 0x0080
  Zone: untrust
  Reference count: 1
  Resource: 9-3-10

Hole: 0.0.0.0-0.0.0.0/0-0->192.168.60.50-192.168.60.50/7079-7079
  Translated: 0.0.0.0/0->0.0.0.0/0
  Protocol: udp
  Application: SIP ALG/63
  Age: 114 seconds
  Flags: 0x0080
  Zone: untrust
  Reference count: 1
  Resource: 9-3-2

Hole: 0.0.0.0-0.0.0.0/0-0->192.168.60.50-192.168.60.50/5060-5060
  Translated: 0.0.0.0/0->0.0.0.0/0
  Protocol: udp
  Application: SIP ALG/63
  Age: 65534 seconds
  Flags: 0x0020
  Zone: untrust
  Reference count: 1
  Resource: 9-3-39

 
Once the call was established, the media session was installed and media gate was deleted.
Signaling gate for opposite direction was installed. 
 
root@SRX220H2A> show security flow gate node 1
node1:
--------------------------------------------------------------------------
 
Hole: 0.0.0.0-0.0.0.0/0-0->192.168.60.50-192.168.60.50/5060-5060
  Translated: 0.0.0.0/0->0.0.0.0/0
  Protocol: udp
  Application: SIP ALG/63
  Age: 65534 seconds
  Flags: 0x0020
  Zone: untrust
  Reference count: 1
  Resource: 9-3-39
 
Hole: 0.0.0.0-0.0.0.0/0-0->192.168.50.4-192.168.50.4/5060-5060
  Translated: 0.0.0.0/0->0.0.0.0/0
  Protocol: udp
  Application: SIP ALG/63
  Age: 65534 seconds
  Flags: 0x0020
  Zone: trust
  Reference count: 1
  Resource: 9-3-40

 

Solution

This is by design. The SIP media gate will be deleted once session is installed. The SIP signaling gate will remain and never time out.

 

Related Information