Firewall UDP timeouts and SIP registrations that silently expire

See also

Sources

1. 1
   Cisco Secure Firewall ASA can set an idle timeout for specific traffic by matching it with an ACL in a class map and applying 'set connection timeout idle' in a policy map attached with service-policy.

   Configure Connection Timeout for Specific Traffic on ASA with ASDM · Configure Connection Timeout > ASA CLI; Verify · Checked 2026-10-14
2. 2
   On Cisco Secure Firewall ASA the default SIP idle timeout is 30 minutes.

   Configure Connection Timeout for Specific Traffic on ASA with ASDM · Introduction > Defaults · Checked 2026-10-14
3. 3
   On Cisco Secure Firewall ASA the default SIP media idle timeout is 2 minutes.

   Configure Connection Timeout for Specific Traffic on ASA with ASDM · Introduction > Defaults · Checked 2026-10-14
4. 4
   On Cisco Secure Firewall ASA the default UDP idle timeout is 2 minutes.

   Configure Connection Timeout for Specific Traffic on ASA with ASDM · Introduction > Defaults · Checked 2026-10-14
5. 5
   On Cisco Secure Firewall ASA, entering 0:0:0 as an idle timeout makes the connection never time out.

   Configure Connection Timeout for Specific Traffic on ASA with ASDM · Introduction > Defaults · Checked 2026-10-14
6. 6
   Asterisk's res_pjsip endpoint option force_rport defaults to yes and forces use of the return port.

   res_pjsip - Asterisk Documentation · res_pjsip [endpoint] section, option force_rport · Checked 2026-10-14
7. 7
   Asterisk's res_pjsip keep_alive_interval (default 90 seconds) sends keep-alives only on active connection-oriented transports, so it does nothing for UDP bindings.

   res_pjsip - Asterisk Documentation · res_pjsip [global] section, option keep_alive_interval · Checked 2026-10-14
8. 8
   Asterisk's res_pjsip AoR option qualify_frequency defaults to 0, meaning the AoR is never qualified unless an interval in seconds is set.

   res_pjsip - Asterisk Documentation · res_pjsip [aor] section, option qualify_frequency · Checked 2026-10-14
9. 9
   Asterisk's res_pjsip endpoint option rewrite_contact (default no) rewrites the Contact header of inbound messages to the source IP address and port, which helps the server reach endpoints behind NAT.

   res_pjsip - Asterisk Documentation · res_pjsip [endpoint] section, option rewrite_contact · Checked 2026-10-14
10. 10
    Practitioners report that some consumer routers drop UDP NAT mappings after about 30 seconds, and suggest raising the router's UDP timeout to 600 seconds or more, or using a 25 to 30 second device keep-alive where that is not possible.field report

    Routers, firewalls, and the SIP ALG problem · Section on UDP NAT mapping timeouts; REGISTER interval and keepalive recommendations · Checked 2026-10-14
11. 11
    Practitioners report that when a UDP NAT mapping times out, the phone can still look registered while inbound calls fail, until the device re-registers.field report

    Routers, firewalls, and the SIP ALG problem · Section on UDP NAT mapping timeouts · Checked 2026-10-14
12. 12
    In the FortiOS 6.0.0 CLI reference, a config system session-ttl port entry timeout defaults to 300 seconds, and setting it to never is described as insecure.

    system session-ttl | FortiGate / FortiOS 6.0.0 CLI Reference · config system session-ttl > config port, variable 'timeout' · Checked 2026-10-14
13. 13
    On FortiGate, a udp-idle-timer set on a custom firewall service supersedes the global udp-idle-timer for traffic matching that service.

    Technical Tip: Session timeout settings · Technical Tip body, custom service example (UDP_1194) · Checked 2026-10-14
14. 14
    In the FortiOS 6.0.0 CLI reference, the config system session-ttl default (3600 seconds, range 300 to 604800) applies to TCP and SCTP sessions without a matching port entry, so it is not the UDP idle timer.

    system session-ttl | FortiGate / FortiOS 6.0.0 CLI Reference · config system session-ttl, variable 'default' · Checked 2026-10-14
15. 15
    A Fortinet Technical Tip states that the FortiGate global udp-idle-timer under config system global defaults to 180 seconds.

    Technical Tip: Session timeout settings · Technical Tip body, udp-idle-timer section · Checked 2026-10-14
16. 16
    To prevent silent expiry, some traffic from the phone side (REGISTER refresh, NAT keep-alive or STUN) has to cross the binding more often than the firewall's UDP idle timer, or the timer has to be raised above the refresh interval.inferred

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 4.3 REQ-5 and REQ-6, with RFC 5626 Section 4.4.2 · Checked 2026-10-14
17. 17
    On Cisco 7800 and 8800 Series multiplatform phones (firmware 11.0), NAT keep-alive messages are turned on per extension with NAT Keep Alive Enable under Voice > Ext, alongside NAT Mapping Enable.

    Configure Network Address Translation (NAT) Settings on the Cisco IP Phone 7800 or 8800 Series Multiplatform Phone · Steps 2 to 4 · Checked 2026-10-14
18. 18
    On Cisco 7800 and 8800 Series multiplatform phones (firmware 11.0), NAT Keep Alive Msg defaults to $NOTIFY, and setting it to $REGISTER sends a REGISTER without a Contact to keep the NAT mapping active.

    Configure Network Address Translation (NAT) Settings on the Cisco IP Phone 7800 or 8800 Series Multiplatform Phone · Step 5 (Voice > Ext1 > NAT Settings) · Checked 2026-10-14
19. 19
    PAN-OS 11.1's 30-second global UDP default is shorter than the two-minute floor RFC 4787 sets for NAT UDP mappings, so a SIP phone behind it that relies on hourly or even two-minute REGISTER refreshes is exposed unless an application-specific timeout or keep-alive covers the gap.inferred

    Session Timeouts (PAN-OS 11.1 Next-Generation Firewall Help) · Session Timeouts table, field 'UDP', compared with RFC 4787 Section 4.3 REQ-5 · Checked 2026-10-14
20. 20
    In PAN-OS 11.1 the established TCP session timeout defaults to 3,600 seconds.

    Session Timeouts (PAN-OS 11.1 Next-Generation Firewall Help) · Session Timeouts table, field 'TCP' · Checked 2026-10-14
21. 21
    In PAN-OS 11.1 the global UDP session timeout defaults to 30 seconds, with a configurable range of 1 to 1,599,999 seconds.

    Session Timeouts (PAN-OS 11.1 Next-Generation Firewall Help) · Session Timeouts table, field 'UDP' · Checked 2026-10-14
22. 22
    PAN-OS 11.1 defines its UDP timeout as the maximum time a UDP session stays open without a UDP response.

    Session Timeouts (PAN-OS 11.1 Next-Generation Firewall Help) · Session Timeouts table, field 'UDP', description column · Checked 2026-10-14
23. 23
    Because SIP's default port 5060 lies outside the 0-1023 range, the RFC 4787 REQ-5a exception does not license a NAT to give SIP signalling a UDP mapping timer shorter than two minutes.inferred

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 4.3, REQ-5 and REQ-5a, read together with the SIP default port of 5060 · Checked 2026-10-14
24. 24
    An RFC 3261 registrar may reject a requested expiry that is above zero, under one hour and below its configured minimum with 423 Interval Too Brief and a Min-Expires header, which limits how far a phone can shorten its registration interval.

    RFC 3261 — SIP: Session Initiation Protocol · Section 10.3, step 7; Section 10.2.8 · Checked 2026-10-14
25. 25
    Under RFC 3261, a REGISTER that carries neither an Expires header nor a Contact expires parameter leaves the registrar to choose the expiration interval.

    RFC 3261 — SIP: Session Initiation Protocol · Section 10.2.1.1 (Setting the Expiration Interval of Contact Addresses) · Checked 2026-10-14
26. 26
    RFC 3261 makes the user agent responsible for refreshing its own registration bindings by sending a new REGISTER before they expire, and says it should not refresh bindings set up by other user agents.

    RFC 3261 — SIP: Session Initiation Protocol · Section 10.2.4 (Refreshing Bindings) · Checked 2026-10-14
27. 27
    RFC 3581 reports that most UDP NAT bindings appeared to time out after about one minute, and advises a client to retransmit its INVITE every 20 seconds or so to keep the binding fresh during a transaction.

    RFC 3581: An Extension to the Session Initiation Protocol (SIP) for Symmetric Response Routing · Section 3 (Client Behavior) · Checked 2026-10-14
28. 28
    RFC 3581 warns that keeping UDP NAT bindings fresh through registration can require re-registering much more often than the normal refresh interval, which adds load on servers.

    RFC 3581: An Extension to the Session Initiation Protocol (SIP) for Symmetric Response Routing · Section 9.3 (Brittleness Introduced by this Specification) · Checked 2026-10-14
29. 29
    The RFC 3581 rport Via parameter asks the server to send the response to the source IP address and port the request came from, and the response must be sent from the address and port it was received on.

    RFC 3581: An Extension to the Session Initiation Protocol (SIP) for Symmetric Response Routing · Section 3 (Client Behavior) and Section 4 (Server Behavior) · Checked 2026-10-14
30. 30
    Under RFC 4787 REQ-6a, inbound packets refreshing a UDP mapping is optional, so packets arriving from the registrar cannot be relied on to keep a phone's binding open.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 4.3, REQ-6 item (a) · Checked 2026-10-14
31. 31
    RFC 4787 REQ-6 requires that outbound packets refresh a NAT UDP mapping, so a client can keep its mapping alive by sending traffic outward.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 4.3, REQ-6 and its justification · Checked 2026-10-14
32. 32
    RFC 4787 REQ-5c recommends a default NAT UDP mapping timer of five minutes or more.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 4.3, REQ-5 item (c) · Checked 2026-10-14
33. 33
    RFC 4787 REQ-5 states that a NAT UDP mapping timer must not expire in less than two minutes unless the REQ-5a well-known-port exception applies.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 4.3, REQ-5 (repeated in Section 12) · Checked 2026-10-14
34. 34
    RFC 4787 REQ-5a permits shorter UDP mapping timers only for specific destination ports in the well-known range 0-1023, tied to the IANA-registered application on that port.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 4.3, REQ-5 item (a) · Checked 2026-10-14
35. 35
    RFC 5382 REQ-5 states that a NAT's established TCP connection idle-timeout must not be less than 2 hours 4 minutes.

    RFC 5382: NAT Behavioral Requirements for TCP (BCP 142) · Section 5 (NAT Session Refresh), REQ-5; repeated in Section 8 · Checked 2026-10-14
36. 36
    Under RFC 5626 a registering user agent begins sending keep-alives only after an appropriate outbound registration response, not unconditionally.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4 and Section 4.2.1 · Checked 2026-10-14
37. 37
    RFC 5626 says that over connection-oriented transports with no Flow-Timer and no battery concern, CRLF keep-alives should be sent every 120 seconds with 95 seconds as the lower bound, or every 672 to 840 seconds where battery power matters.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4.1 · Checked 2026-10-14
38. 38
    RFC 5626 says that if a STUN keep-alive gets no Binding Response after its retransmissions, the user agent treats the flow as failed and forms a new flow using the Section 4.2 registration procedures.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4.2 (flow failure) and Section 4.4 (replacement flow) · Checked 2026-10-14
39. 39
    In RFC 5626 the Flow-Timer header gives the number of seconds the server will wait without seeing keep-alives, and a user agent that receives it must send keep-alives at least that often.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4; registrar permission in Section 6 and edge-proxy permission in Section 5.4 · Checked 2026-10-14
40. 40
    RFC 5626 states that its keep-alive mechanism must keep NAT bindings refreshed, and that a client which gets no pong to its ping declares the flow dead and opens a new one.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 3.5 · Checked 2026-10-14
41. 41
    RFC 5626 justifies its 29-second upper bound for UDP keep-alives by noting that many NATs have UDP timeouts as low as 30 seconds.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4.2, note on time values · Checked 2026-10-14
42. 42
    RFC 5626 names a NAT or firewall between the SIP user agent and the proxy as the most likely reason a server cannot open a connection to the user agent, since many such devices allow only outgoing connections.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 1 (Introduction) · Checked 2026-10-14
43. 43
    RFC 5626 limits STUN keep-alives to connectionless transports such as UDP, and limits double-CRLF keep-alives to connection-oriented transports such as TCP or SCTP.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Sections 4.4.1 (CRLF) and 4.4.2 (STUN) · Checked 2026-10-14
44. 44
    RFC 5626 says the interval between STUN keep-alives over UDP should be a random number between 24 and 29 seconds.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4.2 · Checked 2026-10-14
45. 45
    RFC 6223 defines a 'keep' Via header parameter that lets adjacent SIP entities explicitly negotiate the RFC 5626 keep-alive mechanisms, including where full SIP Outbound is not used.

    RFC 6223: Indication of Support for Keep-Alive · Abstract and Section 1 · Checked 2026-10-14
46. 46
    RFC 6223 says keep-alives negotiated in a registration apply only from the registering entity toward the registrar and must be renegotiated on each registration refresh or stop.

    RFC 6223: Indication of Support for Keep-Alive · Sections 4.2.2 and 7.2 · Checked 2026-10-14
47. 47
    RFC 7857 updates RFC 4787 but does not change the RFC 4787 UDP mapping timer requirement; its REQ-5 changes concern the RFC 5382 TCP transitory idle-timeout.

    RFC 7857: Updates to Network Address Translation (NAT) Behavioral Requirements · Header (Updates: 4787, 5382, 5508) and Section 2.1 · Checked 2026-10-14
48. 48
    When a phone's UDP registration refresh interval is longer than the firewall's UDP idle timer and nothing else crosses the binding, the binding expires while the registrar still holds the contact, so inbound INVITEs are dropped at the firewall and the phone shows no error until its next REGISTER.inferred

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Sections 1 and 3.5, combined with RFC 4787 Section 4.3 REQ-5 and REQ-6 and RFC 3261 Section 10.2.4 · Checked 2026-10-14
49. 49
    SonicWall recommends enabling Consistent NAT for VoIP, which hashes each internal address and port pair to the same public address and UDP port pair, at the cost of a slight decrease in overall security.

    How to configure VoIP to use any VoIP phone system (best practices) · Step 16 (Enable Consistent NAT), both SonicOS versions · Checked 2026-10-14
50. 50
    SonicWall says SIP Transformations should be disabled in most deployments where the PBX sits behind the SonicWall, and usually enabled where the PBX is on the public internet.

    How to configure VoIP to use any VoIP phone system (best practices) · Step 17 (Enable SIP Transformations), both SonicOS versions · Checked 2026-10-14
51. 51
    SonicWall's VoIP best-practice article for SonicOS 7.X suggests optionally raising the UDP timeout on the VoIP-zone-to-WAN access rule to 120 to 300 seconds to reduce call disruption.

    How to configure VoIP to use any VoIP phone system (best practices) · SonicOS 7.X, Step 12 (User & TCP/UDP); SonicOS 6.5, Step 13 (Advanced) · Checked 2026-10-14
52. 52
    On a NAT that follows both BCPs, moving SIP registration from UDP to TCP or TLS widens the idle window from a two-minute floor to a floor of over two hours, though stateful firewalls may apply shorter TCP timers of their own.inferred

    RFC 5382: NAT Behavioral Requirements for TCP (BCP 142) · Section 5 REQ-5, compared with RFC 4787 Section 4.3 REQ-5 · Checked 2026-10-14
53. 53
    Cisco's Webex Calling port reference tells customers to define reasonable NAT binding periods and configure a minimum NAT timeout so devices operate properly.

    Port Reference Information for Webex Calling · Section 'Network Address Translation (NAT)' · Checked 2026-10-14
54. 54
    Cisco's Webex Calling port reference says that if a network implements NAT or SPI, the connection timeout should be set to at least 30 minutes.

    Port Reference Information for Webex Calling · Section 'Network Address Translation (NAT)' · Checked 2026-10-14
55. 55
    Cisco's Webex Calling port reference warns that strict source-port preservation on the NAT device can cause device registration failures, because devices may use the same SIP source port in the 5060-5280 range.

    Port Reference Information for Webex Calling · Section 'Network Address Translation (NAT)' · Checked 2026-10-14
56. 56
    Cisco's Webex Calling port reference gives as an example that Cisco phones send a follow-up REGISTER refresh every 1 to 2 minutes.

    Port Reference Information for Webex Calling · Section 'Network Address Translation (NAT)' · Checked 2026-10-14
57. 57
    Cisco recommends turning off SIP ALG on routers and firewalls in front of Webex Calling, noting it can cause traversal problems even though the traffic is encrypted.

    Port Reference Information for Webex Calling · Section 'SIP Application Layer Gateway' · Checked 2026-10-14

Documents

Cite this page

WarmTransfer. (2026, October 14). Firewall UDP timeouts and SIP registrations that silently expire. WarmTransfer. https://warmtransfer.net/knowledge/firewall-udp-timeout-sip

@misc{warmtransfer-firewall-udp-timeout-sip,
  title  = {Firewall UDP timeouts and SIP registrations that silently expire},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/firewall-udp-timeout-sip},
  note   = {Verified 2026-10-14}
}