{"id":11136,"date":"2020-09-04T11:24:22","date_gmt":"2020-09-04T09:24:22","guid":{"rendered":"https:\/\/www.boc.de\/watchguard-info-portal\/?p=11136"},"modified":"2020-09-18T12:59:35","modified_gmt":"2020-09-18T10:59:35","slug":"swyxit-ips-false-positive","status":"publish","type":"post","link":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/2020\/09\/swyxit-ips-false-positive\/","title":{"rendered":"Swyxit! IPS false positive"},"content":{"rendered":"<h6>Setup:<\/h6>\n<p>SwyxIt!-Softphone greift auf Swyx-TK-Anlage via BOVPN-Tunnel zu.<\/p>\n<h6>Symptom:<\/h6>\n<p>Swyxit Softphone Client zeigt keinen Status nach Login.<\/p>\n<h6>Beobachtung:<\/h6>\n<p>auf der Firewall sind folgende Log-Eintr\u00e4ge zu sehen:<\/p>\n<div id=\"post-list\">\n<div class=\"post-list-holder-by-time\">\n<div class=\"post-list__table\">\n<div id=\"postListContent\" class=\"post-list__content\">\n<div id=\"post_8dgfc6ytntf67cg7ef4yjjf5ch\" class=\"post other--root current--user\">\n<div class=\"post__content \">\n<div id=\"8dgfc6ytntf67cg7ef4yjjf5ch_message\" class=\"post__body \">\n<div class=\"post-message post-message--collapsed\">\n<div class=\"post-message__text-container\">\n<div class=\"post-message__text\">\n<pre>2020-09-07 10<span data-emoticon=\"14\">:14:<\/span>43 Deny 10.xxx.xxx.xxx 10.xxx.yyy.zzz sip\/udp 5070 5060 [...] <strong>IPS detected<\/strong> [...] proc_id=\"firewall\" rc=\"301\" msg_id=\"3000-0150\" \r\nsrc_ip_nat=\"10.xxx.xxx.xxx\" <strong>signature_name=\"SIP Digium Asterisk SIP CSeq Heap Buffer Overflow (CVE-2017-937\" \r\n<\/strong><strong>signature_cat=\"Buffer Over Flow\" signature_id=\"1133858\" severity=\"4\"<\/strong> [...]<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div id=\"post-create\" class=\"post-create__container\">\n<form id=\"create_post\" class=\"\" role=\"form\">\n<div class=\"post-create\">\n<div class=\"post-create-body\">\n<div class=\"post-body__cell\">\n<div class=\"textarea-wrapper\">\n<div>\n<p>Scheinbar triggert der Swyx-Client hier beim Verbindungsaufbau zur Swyx-TK-Anlage gelegentlich das IPS.<\/p>\n<\/div>\n<h6>Abhilfe:<\/h6>\n<\/div>\n<\/div>\n<\/div>\n<ul>\n<li data-wp-editing=\"1\">Policy-Manager<br \/>\n=&gt; Subscription-Services<br \/>\n=&gt; [Exceptions]\n=&gt; Entsprechende ID einf\u00fcgen =&gt; ADD =&gt; OK =&gt; OK<br \/>\n=&gt; Policy auf Firewall schreiben.<a href=\"https:\/\/www.boc.de\/watchguard-info-portal\/wp-content\/uploads\/2020\/09\/2020-09-07_10h52_40.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft wp-image-11137 size-medium\" src=\"https:\/\/www.boc.de\/watchguard-info-portal\/wp-content\/uploads\/2020\/09\/2020-09-07_10h52_40-262x300.png\" alt=\"\" width=\"262\" height=\"300\" srcset=\"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-content\/uploads\/2020\/09\/2020-09-07_10h52_40-262x300.png 262w, https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-content\/uploads\/2020\/09\/2020-09-07_10h52_40.png 515w\" sizes=\"auto, (max-width: 262px) 100vw, 262px\" \/><\/a><\/li>\n<\/ul>\n<\/div>\n<p><a style=\"font-size: inherit; background-color: #ffffff;\" href=\"https:\/\/www.boc.de\/watchguard-info-portal\/wp-content\/uploads\/2020\/09\/2020-09-07_10h57_01.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft wp-image-11138 size-medium\" src=\"https:\/\/www.boc.de\/watchguard-info-portal\/wp-content\/uploads\/2020\/09\/2020-09-07_10h57_01-300x279.png\" alt=\"\" width=\"300\" height=\"279\" srcset=\"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-content\/uploads\/2020\/09\/2020-09-07_10h57_01-300x279.png 300w, https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-content\/uploads\/2020\/09\/2020-09-07_10h57_01.png 524w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<\/form>\n<\/div>\n<div class=\"shariff\"><ul class=\"shariff-buttons theme-default orientation-horizontal buttonsize-medium\"><li class=\"shariff-button mailto shariff-nocustomcolor\" style=\"background-color:#b32317\"><a href=\"mailto:?body=https%3A%2F%2Fwordpress.boc.de%2Fwatchguard-info-portal%2F2020%2F09%2Fswyxit-ips-false-positive%2F&subject=Swyxit%21%20IPS%20false%20positive\" title=\"Per E-Mail versenden\" aria-label=\"Per E-Mail versenden\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#999; color:#fff\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 32 32\"><path fill=\"#999\" d=\"M32 12.7v14.2q0 1.2-0.8 2t-2 0.9h-26.3q-1.2 0-2-0.9t-0.8-2v-14.2q0.8 0.9 1.8 1.6 6.5 4.4 8.9 6.1 1 0.8 1.6 1.2t1.7 0.9 2 0.4h0.1q0.9 0 2-0.4t1.7-0.9 1.6-1.2q3-2.2 8.9-6.1 1-0.7 1.8-1.6zM32 7.4q0 1.4-0.9 2.7t-2.2 2.2q-6.7 4.7-8.4 5.8-0.2 0.1-0.7 0.5t-1 0.7-0.9 0.6-1.1 0.5-0.9 0.2h-0.1q-0.4 0-0.9-0.2t-1.1-0.5-0.9-0.6-1-0.7-0.7-0.5q-1.6-1.1-4.7-3.2t-3.6-2.6q-1.1-0.7-2.1-2t-1-2.5q0-1.4 0.7-2.3t2.1-0.9h26.3q1.2 0 2 0.8t0.9 2z\"\/><\/svg><\/span><span class=\"shariff-text\">E-Mail<\/span>&nbsp;<\/a><\/li><li class=\"shariff-button linkedin shariff-nocustomcolor\" style=\"background-color:#b32317\"><a href=\"https:\/\/www.linkedin.com\/sharing\/share-offsite\/?url=https%3A%2F%2Fwordpress.boc.de%2Fwatchguard-info-portal%2F2020%2F09%2Fswyxit-ips-false-positive%2F\" title=\"Bei LinkedIn teilen\" aria-label=\"Bei LinkedIn teilen\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#0077b5; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 27 32\"><path fill=\"#0077b5\" d=\"M6.2 11.2v17.7h-5.9v-17.7h5.9zM6.6 5.7q0 1.3-0.9 2.2t-2.4 0.9h0q-1.5 0-2.4-0.9t-0.9-2.2 0.9-2.2 2.4-0.9 2.4 0.9 0.9 2.2zM27.4 18.7v10.1h-5.9v-9.5q0-1.9-0.7-2.9t-2.3-1.1q-1.1 0-1.9 0.6t-1.2 1.5q-0.2 0.5-0.2 1.4v9.9h-5.9q0-7.1 0-11.6t0-5.3l0-0.9h5.9v2.6h0q0.4-0.6 0.7-1t1-0.9 1.6-0.8 2-0.3q3 0 4.9 2t1.9 6z\"\/><\/svg><\/span><span class=\"shariff-text\">teilen<\/span>&nbsp;<\/a><\/li><li class=\"shariff-button xing shariff-nocustomcolor\" style=\"background-color:#b32317\"><a href=\"https:\/\/www.xing.com\/spi\/shares\/new?url=https%3A%2F%2Fwordpress.boc.de%2Fwatchguard-info-portal%2F2020%2F09%2Fswyxit-ips-false-positive%2F\" title=\"Bei XING teilen\" aria-label=\"Bei XING teilen\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#126567; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 25 32\"><path fill=\"#126567\" d=\"M10.7 11.9q-0.2 0.3-4.6 8.2-0.5 0.8-1.2 0.8h-4.3q-0.4 0-0.5-0.3t0-0.6l4.5-8q0 0 0 0l-2.9-5q-0.2-0.4 0-0.7 0.2-0.3 0.5-0.3h4.3q0.7 0 1.2 0.8zM25.1 0.4q0.2 0.3 0 0.7l-9.4 16.7 6 11q0.2 0.4 0 0.6-0.2 0.3-0.6 0.3h-4.3q-0.7 0-1.2-0.8l-6-11.1q0.3-0.6 9.5-16.8 0.4-0.8 1.2-0.8h4.3q0.4 0 0.5 0.3z\"\/><\/svg><\/span><span class=\"shariff-text\">teilen<\/span>&nbsp;<\/a><\/li><li class=\"shariff-button facebook shariff-nocustomcolor\" style=\"background-color:#b32317\"><a href=\"https:\/\/www.facebook.com\/sharer\/sharer.php?u=https%3A%2F%2Fwordpress.boc.de%2Fwatchguard-info-portal%2F2020%2F09%2Fswyxit-ips-false-positive%2F\" title=\"Bei Facebook teilen\" aria-label=\"Bei Facebook teilen\" role=\"button\" rel=\"nofollow\" class=\"shariff-link\" style=\"; background-color:#3b5998; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 18 32\"><path fill=\"#3b5998\" d=\"M17.1 0.2v4.7h-2.8q-1.5 0-2.1 0.6t-0.5 1.9v3.4h5.2l-0.7 5.3h-4.5v13.6h-5.5v-13.6h-4.5v-5.3h4.5v-3.9q0-3.3 1.9-5.2t5-1.8q2.6 0 4.1 0.2z\"\/><\/svg><\/span><span class=\"shariff-text\">teilen<\/span>&nbsp;<\/a><\/li><li class=\"shariff-button twitter shariff-nocustomcolor\" style=\"background-color:#b32317\"><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fwordpress.boc.de%2Fwatchguard-info-portal%2F2020%2F09%2Fswyxit-ips-false-positive%2F&text=Swyxit%21%20IPS%20false%20positive\" title=\"Bei X teilen\" aria-label=\"Bei X teilen\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#000; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 24 24\"><path fill=\"#000\" d=\"M14.258 10.152L23.176 0h-2.113l-7.747 8.813L7.133 0H0l9.352 13.328L0 23.973h2.113l8.176-9.309 6.531 9.309h7.133zm-2.895 3.293l-.949-1.328L2.875 1.56h3.246l6.086 8.523.945 1.328 7.91 11.078h-3.246zm0 0\"\/><\/svg><\/span><span class=\"shariff-text\">teilen<\/span>&nbsp;<\/a><\/li><\/ul><\/div>","protected":false},"excerpt":{"rendered":"<p>Setup: SwyxIt!-Softphone greift auf Swyx-TK-Anlage via BOVPN-Tunnel zu. Symptom: Swyxit Softphone Client zeigt keinen Status nach Login. Beobachtung: auf der Firewall sind folgende Log-Eintr\u00e4ge zu sehen: 2020-09-07 10:14:43 Deny 10.xxx.xxx.xxx 10.xxx.yyy.zzz sip\/udp 5070 5060 [&#8230;] IPS detected [&#8230;] proc_id=&#8220;firewall&#8220; rc=&#8220;301&#8243; msg_id=&#8220;3000-0150&#8243; src_ip_nat=&#8220;10.xxx.xxx.xxx&#8220; signature_name=&#8220;SIP Digium Asterisk SIP CSeq Heap Buffer Overflow (CVE-2017-937&#8243; signature_cat=&#8220;Buffer Over Flow&#8220; signature_id=&#8220;1133858&#8243; severity=&#8220;4&#8243; [&#8230;] Scheinbar triggert der Swyx-Client hier beim Verbindungsaufbau zur &hellip; <a href=\"https:\/\/wordpress.boc.de\/watchguard-info-portal\/2020\/09\/swyxit-ips-false-positive\/\" class=\"more-link\">Weiterlesen <span class=\"screen-reader-text\">Swyxit! IPS false positive<\/span> <span class=\"meta-nav\">&raquo;<\/span><\/a><\/p>\n<div class=\"shariff\"><ul class=\"shariff-buttons theme-default orientation-horizontal buttonsize-medium\"><li class=\"shariff-button mailto shariff-nocustomcolor\" style=\"background-color:#b32317\"><a href=\"mailto:?body=https%3A%2F%2Fwordpress.boc.de%2Fwatchguard-info-portal%2F2020%2F09%2Fswyxit-ips-false-positive%2F&subject=Swyxit%21%20IPS%20false%20positive\" title=\"Per E-Mail versenden\" aria-label=\"Per E-Mail versenden\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#999; color:#fff\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 32 32\"><path fill=\"#999\" d=\"M32 12.7v14.2q0 1.2-0.8 2t-2 0.9h-26.3q-1.2 0-2-0.9t-0.8-2v-14.2q0.8 0.9 1.8 1.6 6.5 4.4 8.9 6.1 1 0.8 1.6 1.2t1.7 0.9 2 0.4h0.1q0.9 0 2-0.4t1.7-0.9 1.6-1.2q3-2.2 8.9-6.1 1-0.7 1.8-1.6zM32 7.4q0 1.4-0.9 2.7t-2.2 2.2q-6.7 4.7-8.4 5.8-0.2 0.1-0.7 0.5t-1 0.7-0.9 0.6-1.1 0.5-0.9 0.2h-0.1q-0.4 0-0.9-0.2t-1.1-0.5-0.9-0.6-1-0.7-0.7-0.5q-1.6-1.1-4.7-3.2t-3.6-2.6q-1.1-0.7-2.1-2t-1-2.5q0-1.4 0.7-2.3t2.1-0.9h26.3q1.2 0 2 0.8t0.9 2z\"\/><\/svg><\/span><span class=\"shariff-text\">E-Mail<\/span>&nbsp;<\/a><\/li><li class=\"shariff-button linkedin shariff-nocustomcolor\" style=\"background-color:#b32317\"><a href=\"https:\/\/www.linkedin.com\/sharing\/share-offsite\/?url=https%3A%2F%2Fwordpress.boc.de%2Fwatchguard-info-portal%2F2020%2F09%2Fswyxit-ips-false-positive%2F\" title=\"Bei LinkedIn teilen\" aria-label=\"Bei LinkedIn teilen\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#0077b5; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 27 32\"><path fill=\"#0077b5\" d=\"M6.2 11.2v17.7h-5.9v-17.7h5.9zM6.6 5.7q0 1.3-0.9 2.2t-2.4 0.9h0q-1.5 0-2.4-0.9t-0.9-2.2 0.9-2.2 2.4-0.9 2.4 0.9 0.9 2.2zM27.4 18.7v10.1h-5.9v-9.5q0-1.9-0.7-2.9t-2.3-1.1q-1.1 0-1.9 0.6t-1.2 1.5q-0.2 0.5-0.2 1.4v9.9h-5.9q0-7.1 0-11.6t0-5.3l0-0.9h5.9v2.6h0q0.4-0.6 0.7-1t1-0.9 1.6-0.8 2-0.3q3 0 4.9 2t1.9 6z\"\/><\/svg><\/span><span class=\"shariff-text\">teilen<\/span>&nbsp;<\/a><\/li><li class=\"shariff-button xing shariff-nocustomcolor\" style=\"background-color:#b32317\"><a href=\"https:\/\/www.xing.com\/spi\/shares\/new?url=https%3A%2F%2Fwordpress.boc.de%2Fwatchguard-info-portal%2F2020%2F09%2Fswyxit-ips-false-positive%2F\" title=\"Bei XING teilen\" aria-label=\"Bei XING teilen\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#126567; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 25 32\"><path fill=\"#126567\" d=\"M10.7 11.9q-0.2 0.3-4.6 8.2-0.5 0.8-1.2 0.8h-4.3q-0.4 0-0.5-0.3t0-0.6l4.5-8q0 0 0 0l-2.9-5q-0.2-0.4 0-0.7 0.2-0.3 0.5-0.3h4.3q0.7 0 1.2 0.8zM25.1 0.4q0.2 0.3 0 0.7l-9.4 16.7 6 11q0.2 0.4 0 0.6-0.2 0.3-0.6 0.3h-4.3q-0.7 0-1.2-0.8l-6-11.1q0.3-0.6 9.5-16.8 0.4-0.8 1.2-0.8h4.3q0.4 0 0.5 0.3z\"\/><\/svg><\/span><span class=\"shariff-text\">teilen<\/span>&nbsp;<\/a><\/li><li class=\"shariff-button facebook shariff-nocustomcolor\" style=\"background-color:#b32317\"><a href=\"https:\/\/www.facebook.com\/sharer\/sharer.php?u=https%3A%2F%2Fwordpress.boc.de%2Fwatchguard-info-portal%2F2020%2F09%2Fswyxit-ips-false-positive%2F\" title=\"Bei Facebook teilen\" aria-label=\"Bei Facebook teilen\" role=\"button\" rel=\"nofollow\" class=\"shariff-link\" style=\"; background-color:#3b5998; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 18 32\"><path fill=\"#3b5998\" d=\"M17.1 0.2v4.7h-2.8q-1.5 0-2.1 0.6t-0.5 1.9v3.4h5.2l-0.7 5.3h-4.5v13.6h-5.5v-13.6h-4.5v-5.3h4.5v-3.9q0-3.3 1.9-5.2t5-1.8q2.6 0 4.1 0.2z\"\/><\/svg><\/span><span class=\"shariff-text\">teilen<\/span>&nbsp;<\/a><\/li><li class=\"shariff-button twitter shariff-nocustomcolor\" style=\"background-color:#b32317\"><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fwordpress.boc.de%2Fwatchguard-info-portal%2F2020%2F09%2Fswyxit-ips-false-positive%2F&text=Swyxit%21%20IPS%20false%20positive\" title=\"Bei X teilen\" aria-label=\"Bei X teilen\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#000; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 24 24\"><path fill=\"#000\" d=\"M14.258 10.152L23.176 0h-2.113l-7.747 8.813L7.133 0H0l9.352 13.328L0 23.973h2.113l8.176-9.309 6.531 9.309h7.133zm-2.895 3.293l-.949-1.328L2.875 1.56h3.246l6.086 8.523.945 1.328 7.91 11.078h-3.246zm0 0\"\/><\/svg><\/span><span class=\"shariff-text\">teilen<\/span>&nbsp;<\/a><\/li><\/ul><\/div>","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[400,683],"class_list":["post-11136","post","type-post","status-publish","format-standard","hentry","category-watchguard-technischer-blog","tag-ips","tag-swyx"],"_links":{"self":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts\/11136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/comments?post=11136"}],"version-history":[{"count":4,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts\/11136\/revisions"}],"predecessor-version":[{"id":11142,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts\/11136\/revisions\/11142"}],"wp:attachment":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/media?parent=11136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/categories?post=11136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/tags?post=11136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}