Troubleshooting Tip: Overcoming SIP registration failure due to wildcard contact field when using FortiGate SIP ALG

The behavior is observed only when SIP ALG is in use, and the SIP registration packet comes with the Contact field set to wildcard ('*').

1. How to identify the behavior: 

• Perform a packet capture on FortiGate, using a filter with the SIP signaling port (i.e., 'port 5060') and start the registration flow: confirm that FortiGate is receiving the registration packets, but it is not forwarding the packets towards the SIP registrar or external VoIP provider.  
• Run the following CLI debug commands and start the registration flow: confirm that the output shows a line containing 'Contact: *':

   

diagnose debug application sip -1

diagnose debug enable

Use 'diagnose debug disable' to stop the output once the issue is replicated.

The following is a sample output from the SIP debug commands:

sip port 19 vd 0 vrf 0 REGISTER 'sip.test:5060'
sip port 19 vd 0 vrf 0 CSeq: 1 REGISTER
sip port 19 vd 0 vrf 0 Via: UDP 172.16.1.2:35060 len 20 received 0 rport 1 0 branch 'test'
sip port 19 vd 0 vrf 0 From: '<sip:k@sip.test:5060>;tag=2137860069' URI 'sip:k@sip.test:5060'tag '2137860069' <======
sip port 19 vd 0 vrf 0 From: hostport 'sip.test:5060'
sip port 19 vd 0 vrf 0 To: '<sip:k@sip.test:5060>' URI 'sip:k@sip.test:5060' tag ''
sip port 19 vd 0 vrf 0 To: hostport 'sip.test:5060'
sip port 19 vd 0 vrf 0 Call-ID: '50da2499-276eee300ae16372b988080023d99431@172.16.1.2'
sip port 19 vd 0 vrf 0 Contact: * <--- Contact field is not set on the PBX.
sip port 19 vd 0 vrf 0 Expires: 0
sip port 19 vd 0 vrf 0 Content-Length: 0 len 1
sip port 19 vd 0 vrf 0 find call 0 0 '50da2499-276eee300ae16372b988080023d99431@172.16.1.2'
sip port 19 vd 0 vrf 0 call not found
sip port 19 vd 0 vrf 0 call 0x7f0bba619500 open
sip port 19 vd 0 vrf 0 call 0x7f0bba619500 open txn 0x7f0bba635700 REGISTER dir 0
sip port 19 vd 0 vrf 0 call 0x7f0bba619500 txn 0x7f0bba635700 REGISTER, cannot find matching AOR 'sip:k@sip.test:5060' with STAR <----
sip port 19 vd 0 vrf 0 drop
sip txn 0x7f0bba635700 close REGISTER state 14
sip call 0x7f0bba619500 close

2. To overcome the issue:

• Either set the Contact field on the device trying to register (do not use a wildcard on the contact field).
• Or do not use FortiGate SIP ALG (in this case, VIP/port forwarding configuration is required).

Related article:

Technical Tip: VoIP and SIP configuration and troubleshooting resource lists