Troubleshooting Tip: SIP Proxy (UDP) session shows different SD-WAN member than configured in policy

Description

This article describes the behavior of SD-WAN member selection for SIP traffic in proxy mode.

Scope

SD-WAN, SIP, Routing, proxy.

Solution

When SIP traffic operates in proxy-based mode over UDP on FortiOS v7.4.x, the session record may display a different SD-WAN member than the member configured in the matched SD-WAN policy.

The root cause identified is a VRF-related bug in the UDP send function of the Linux 4.19.13 kernel used in the FortiOS v7.4.x branch. This is not an SD-WAN policy mismatch or a SIP proxy configuration error.

The following steps explain the behavior:

• The SIP proxy session terminates and re-originates UDP packets as local-out traffic.

• The kernel's UDP send path must determine the egress interface for that local-out packet.

• In Linux v4.19.13 (v7.4.x), the VRF handling in the UDP path selection does not preserve the VRF context from the original session, causing the route to be re evaluated and might follow a different path.

• The session table is updated to reflect the actual final egress member used after the proxy stage, which overwrites the initial SD-WAN member selection in the session display.

This issue does not exist in FortiOS v7.6 and v8.0.