Technical Tip : Accessing FortiVoice externally via Vip enabled on FortiGate with Central Natting

1. create a VIP, under Policy and Objects -> Virtual IPs and select 'Create New'

As shown in the above example, 172.24.3.29 is an external WAN IP and 10.10.10.8 is a mapped internal server IP.

The incoming traffic is on port 56004 and is mapped internally to the port 5060.

2. Create another VIP to allow the 443 port, this helps in the registration of FortiVoice during the initial communication.

3. Create a policy to allow this traffic under Policy and Objects -> IPv4 and select 'Create New'.

As shown in the screenshot above, the IPv4 policy configuration where the WAN interface is WAN1 and the FortiVoice connected interface is VOIP VLAN.

When Central NAT is enabled, the firewall policy configuration is to set an IP address object as the 'destination', which also refers to the IP addresses of FortiVoice. Ensure the match-vip-only option is enabled for the firewall policy.

4. Configure the Central SNAT rule. The Central SNAT (Secure NAT) table enables definition and control (with more granularity) of the address translation performed by the FortiGate.

This will allow to access FortiVoice from outside of the network when central NAT is enabled.