Secure Firewall FTD - Zoom Phone Audio Blocklist Due to Older VDB

Issue

Users experience audio issues with Zoom Phone calls where calls connect but audio is missing. The FTD is dropping UDP media packets from Zoom IP ranges, showing them as blocklisted by Snort in packet captures and ASP drop counters.

Specific symptoms included:

• The firewall is running Cisco Vulnerability Database (VDB) version 427 or older.

• The firewall contains an access rule that must permit Zoom traffic based on the default Zoom/RTP application IDs provided by the Firepower database. The rule must permit all these ports through the Zoom AppIDs, according to appid.cisco.com:

  • UserZoom (6243): 80,443/tcp

  • Zoom Download (4628): 80,443/tcp

  • Zoom Upload (4627): 80,443/tcp

  • Zoom Meeting (4629): 80/tcp

  • RTP Audio (2475): 5004/udp

  • SIP (426): 5060/udp

• However, packet-tracer output shows that the traffic is dropped by blocklist reason "Blocked or blacklisted by the firewall preprocessor".

  Phase: 17
  Type: SNORT
  Subtype: firewall
  Result: DROP
  Elapsed time: 345716 ns
  Config:
  Network 0, Inspection 0, Detection 4, Rule ID 268434438
  Additional Information:
  Starting rule matching, zone 3 -> 3, geo 840 -> 840, vlan 0, src sgt: 0, src sgt type: unknown, dst sgt: 0, dst sgt type: unknown, user 9999997, no url or host, no xff
  Matched rule ids 268434438 - Block
  
  Result:
  input-interface: Outside(vrfid:0)
  input-status: up
  input-line-status: up
  output-interface: Outside(vrfid:0)
  output-status: up
  output-line-status: up
  Action: drop
  Time Taken: 640578 ns
  Drop-reason: (firewall) Blocked or blacklisted by the firewall preprocessor, Drop-location: frame inspect_dp_snort_snp_drop_frame_wcaller:61 flow (NA)/NA

• Packet captures show drops with reason: "snort-blacklist".

  40:  22:52:36.383692       206.247.118.57.60030 > 10.X.X.1.9178:  udp 103 Drop-reason: (snort-blacklist) Packet is blacklisted by snort, Drop-location: frame inspect_dp_snort_snp_drop_frame_wcaller:61 flow (NA)/NA
  141: 22:52:36.383723       206.247.118.57.60030 > 10.X.X.1.9178:  udp 103 Drop-reason: (snort-blacklist) Packet is blacklisted by snort, Drop-location: frame inspect_dp_snort_snp_drop_frame_wcaller:61 flow (NA)/NA
  142: 22:52:36.385188       206.247.118.57.60030 > 10.X.X.1.9178:  udp 44 Drop-reason: (snort-blacklist) Packet is blacklisted by snort, Drop-location: frame inspect_dp_snort_snp_drop_frame_wcaller:61 flow (NA)/NA

• In system support trace outputs, traffic is deferred during rule matching due to pending Application identification. However, the traffic is misidentified and blocklisted. IP address is a Zoom public IP requiring access according to Zoom article Zoom network firewall or proxy server settings.

  10.X.X.1 9476 -> 206.247.118.12 24794 17 AS=0 ID=1 GR=1-1 pending rule order 12, 'allow-outbound', AppID
  10.X.X.1 9476 -> 206.247.118.12 24794 17 AS=0 ID=1 GR=1-1 Deferring trust until a rule is matched
  ---
  10.X.X.1 9476 -> 206.247.118.12 24794 17 AS=0 ID=1 GR=1-1 match rule order 28, 'Default Block', action Block
  10.X.X.1 9476 -> 206.247.118.12 24794 17 AS=0 ID=1 GR=1-1 MidRecovery data sent for rule id: 268434438, rule_action:4, rev id:712564073, rule_match flag:0x1
  10.X.X.1 9476 -> 206.247.118.12 24794 17 AS=0 ID=1 GR=1-1 Matched a rule, stop deferring trust
  10.X.X.1 9476 -> 206.247.118.12 24794 17 AS=0 ID=1 GR=1-1 Generating an SOF event with rule_id = 268434438 ruleAction = 4 ruleReason = None
  10.X.X.1 9476 -> 206.247.118.12 24794 17 AS=0 ID=1 GR=1-1 deny action
  10.X.X.1 9476 -> 206.247.118.12 24794 17 AS=0 ID=1 GR=1-1 Deleting Firewall session flags=0x20, logFlags=0x5001
  206.247.118.12 24794 -> 10.X.X.1 9476 17 AS=0 ID=1 GR=1-1 Packet 17168248: UDP, 04/14-14:44:53.110391
  206.247.118.12 24794 -> 10.X.X.1 9476 17 AS=0 ID=1 GR=1-1 Firewall: starting rule matching, zone 1 -> 3, geo 0(0) -> 840, vlan 0, src sgt: 0, src sgt type: unknown, dst sgt: 0, dst sgt type: unknown, user 9999997, no url, no xff
  206.247.118.12 24794 -> 10.X.X.1 9476 17 AS=0 ID=1 GR=1-1 Firewall: block rule, 'Default Block', force_block
  206.247.118.12 24794 -> 10.X.X.1 9476 17 AS=0 ID=1 GR=1-1 AppID: service: (-1), client: (0), payload: (0), misc: (0)
  206.247.118.12 24794 -> 10.X.X.1 9476 17 AS=0 ID=1 GR=1-1 Stream: pending block, drop
  206.247.118.12 24794 -> 10.X.X.1 9476 17 AS=0 ID=1 GR=1-1 Policies: Network 0, Inspection 0, Detection 4
  206.247.118.12 24794 -> 10.X.X.1 9476 17 AS=0 ID=1 GR=1-1 Verdict: blacklist

• System support traces indicate "RTP client candidate returned error-invalid (-11)" and "3rd party returned unknown (0)" messages when Zoom IPs attempt to respond.

  206.247.118.55 54808 -> 10.X.X.1 9824 17 AS=0 ID=2 GR=1-1 New AppId session
  206.247.118.55 54808 -> 10.X.X.1 9824 17 AS=0 ID=2 GR=1-1 3rd party returned unknown (0)
  206.247.118.55 54808 -> 10.X.X.1 9824 17 AS=0 ID=2 GR=1-1 RTP client candidate returned error-invalid (-11)
  10.X.X.1 9824 -> 206.247.118.55 54808 17 AS=0 ID=2 GR=1-1 app event changes: created

• FTD show asp drop command shows quick incrementation of blocklist drops.

  Frame drop:
  -----------------------ABBREVIATED-----------------------
    Blocked or blacklisted by the firewall preprocessor (firewall)           11224
    Blocked or blacklisted by the stream preprocessor (stream)                2354
    Fragment reassembly failed (fragment-reassembly-failed)                      3
    Packet is blacklisted by snort (snort-blacklist)                         27173
    Packet is blocked as requested by snort (snort-block)                       42

Environment

• Cisco Firepower FTD version 7.7.11 managed by FMC

• Vulnerability Database (VDB) version 427 or older

• Snort version 3.3.5.1100-66

• Traffic primarily affecting Zoom IP subnets 170.114.0.0/16 and 206.247.0.0/16, but can include other Zoom IPs

Resolution

Cisco bug ID CSCwu22106 Workaround - Prefilter Rule Implementation

1: Create a prefilter rule for the Zoom traffic.

Navigate to Policies > Access Control > Prefilter and create a new rule with this configuration:

• Rule Name: Zoom-Prefilter

• Action: Fastpath

• Source Zone: INPUT INTERFACE

• Destination Zone: OUTPUT INTERFACE

• Source Address: any

• Source Port: any

• Destination Address: Zoom IP ranges (170.114.0.0/16, 206.247.0.0/16) and any others stated in Zoom network firewall or proxy server settings.

• Destination Port: UDP 10000-64000

2: Alternative Access Control Rule Configuration

If prefiltering is not preferred, modify the existing Access Control Policy rule by removing Zoom application identifiers and using explicit IP and port matching:

• Rule Name: Zoom-Allow

• Action: Allow

• Source Zone: INPUT INTERFACE

• Destination Zone: OUPUT INTERFACE

• Source Address: any

• Source Port: any

• Destination Address: Zoom IP ranges (170.114.0.0/16, 206.247.0.0/16) and any others stated in Zoom network firewall or proxy server settings.

• Destination Port: UDP / "Zoom-Phone-Ports" (range 10000 64000)

• Logging: (optional, for monitoring allowed traffic)

3: Deploy the configuration changes to the FTD devices and verify two-way audio functionality is restored.

• Monitor ASP drop counters to confirm the blocklisting has stopped:

  device# show asp drop

• Check packet captures for successful bidirectional traffic:

  device# show capture

4: Defect Cisco bug ID CSCwu22106 was resolved in the release of Cisco Vulnerability Database (VDB) version 428. Firepower devices must run the latest VDB versions to avoid impact from this defect. Likewise, the related defect Cisco bug ID CSCwn80786 was resolved in VDB version 395.

Cause

A defect in the Cisco Secure Firewall application identification signatures within Vulnerability Database (VDB) version 427 cause Zoom Phone media traffic to be misclassified and subsequently blocklisted by the Snort inspection engine. This behavior is tracked under Cisco bug ID CSCwu22106 and related defect Cisco bug ID CSCwn80786, which documents incorrect handling of Zoom IP addresses and media flows when application IDs are used.

Related Content

• Zoom network firewall or proxy server settings

• Best practices for fastpath prefiltering

• Cisco bug ID CSCwu22106 - Zoom IP addresses incorrectly handled in VDB 427

• Cisco bug ID CSCwn80786 - Zoom application detector does not detect networks for zoom phone

• Cisco Technical Support & Downloads

Revision History

Revision	Publish Date	Comments
1.0	27-Oct-2026	Initial Release