Not a great option as that could also influence legitimate traffic, however SIP is the signaling protocol for setting up voip connections, so in nature it should not be very chatty. You can read the packet captures, check for the Sent-by address and if values are set to 0.0.0.0 and previous methods of mitigation are not valid for your environment then you can proceed and implement this change That is not typical behavior for a valid SIP communication, the attack can also be confirmed by doing a packet capture and noticing the amount of packets arriving from a SIP address you are not expecting. Most observed attacks use an SIP attribute of Sent-by Address that is set to 0.0.0.0. Other option is the old shun command that blocks all traffic from certain source IPģ. You need also to clear the existing connection issuing clear conn address You can always actively block (by ACL) the offending IP address that you are seeing via the show conn port 5060. Actively block IP address(es) of the attackers Note: This command is issued from the FTD CLI.Ģ. To disable SIP inspection, configure the following: SIP providers would ask you just to open specific port ranges and not rely on this inspection due to multiple reasons. Even if SIP is in use, most SIP providers would actively ask you to disable the SIP inspection as Cisco is slow on updating it comparing to how fast SIP protocol changes. Our experience with SIP inspection is that usually it is not required (not all customers are doing SIP trunks from inside the organization to a IP Telephony provider in the cloud). Have SIP inspection only if you are actively using it.

There are several options, all limiting the allowance of these SIP packets to reach or overwhelm the device

Pix to asa migration tool 8.4