Support Center > Search Results > SecureKnowledge Details
VoIP traffic, or traffic that uses reserved VoIP ports is dropped after enabling CoreXL Dynamic Dispatcher
Symptoms
  • VoIP traffic (or traffic that uses reserved VoIP ports) is interrupted / stops passing after enabling CoreXL Dynamic Dispatcher per sk105261.

  • Kernel debug ('fw ctl debug -m fw + drop') shows that the traffic is dropped:

    • When SecureXL is enabled:
      fw_log_drop_ex: Packet proto= ... dropped by fwmultik_dispatch_inbound Reason: Instance mismatch (inbound);

    • When SecureXL is disabled:
      fw_log_drop_ex: Packet proto= ... dropped by fw_first_packet_state_checks Reason: First packet isn't SYN.
Cause

The Client-to-Server traffic is correctly assigned to a CoreXL FW Instance for processing.
However, CoreXL selects incorrect CoreXL FW Instance for processing of the return Server-to-Client traffic.

Example from kernel debug ('fw ctl debug -m multik + conn packet'):

;[cpu_1];[fw4_2];voip_multik_forward_needed: VOIP packet <172.30.7.154:51285 -> 192.168.9.33:2000 IPP 6>, forwarding to VOIP instance (is_voip 2);
... ... ...
;[cpu_3];[fw4_0];insert_global_conn: gconn <192.168.9.33(2000) -> 172.30.7.154(51285) IPP 6> exists for fw_0, not fw_1;
;[cpu_3];[fw4_0];fwmultik_dispatch_inbound: instance mismatch (on connection 192.168.9.33(2000) -> 172.30.7.154(51285) IPP 6): predefined says 1 lookup says 0);
;[cpu_3];[fw4_0];fw_log_drop_ex: Packet proto=6 192.168.9.33:2000 -> 172.30.7.154:51285 dropped by fwmultik_dispatch_inbound Reason: Instance mismatch (inbound);


Solution
Note: To view this solution you need to Sign In .