Skip to main content
A
Anonymous_User
Contributor
February 15, 2011
Question

asterisk and fortinet and no sound

  • February 15, 2011
  • 8 replies
  • 12040 views
hi. we have fortinet 110c and asterisk server. we use port forwarding to mask our sip port with a simply virtual ip and a firewall rule. when using clients to connect to the server we have no issues. when checking the asterisk log everything looks ok. however, there is no sound. no incoming or outgoing sound. am i missing a settings? do i need to add some rule or port to make it work? do i need to " notify" the fortinet that this virtual ip is a sip protocol? thank you for the help.

    8 replies

    Austin_M
    Austin_M
    New Member
    February 16, 2011
    Enable NAT in the WAN-> Internal policy and see if it helps
    A
    Anonymous_UserAuthor
    Contributor
    February 16, 2011
    i have tried before without NAT and with NAT and with Use Central NAT Table for the same results. thanks for trying. anyone else can think of something? it worked with a simple router we had before fortinet, so it must be some setting or a port on the device... thank you.
    red_adair
    red_adair
    New Member
    February 16, 2011
    If the call comes up but no voice, than it seems that the UDP-Packets for Voice (RTP) are being blocked. These Ports are dynamically assigned high-ports during SIP Session setup. - Check if SIP is running UDP/5060 in your case - Check KB for the SIP-ALG and enable that (in 4.2 you can activate it in your SIP-Policy, UTM->VoIP-><profile>) If you do NAT, the ALG kicks in and does SIP-Header NAT as well. (so do not use STUN or workaround stuff like that). The SIP-ALG also dynamically opens the Pinholes for the Voice communication. You _may_ need to change your VoIP-Profile to " allow unknown SIP Headers" in case. Do that through CLI. -R.
    FortiRack_Eric
    FortiRack_Eric
    New Member
    February 16, 2011
    remove the sip-helper in conf sys session-helper and reboot the FG
    A
    Anonymous_UserAuthor
    Contributor
    February 20, 2011
    removing sip helper was no help. i do not have VOIP under my UTM graphical interface, however when checking the KB and trying to implement it i got several errors, for example: FWCL (Application_Co~t) # config entries FWCL (entries) # edit 2 new entry ' 2' added FWCL (2) # set category voip FWCL (2) # set application SIP FWCL (2) # set reg-diff-port enable command parse error before ' reg-diff-port' Command fail. Return code -61 FWCL (2) # set contact-fixup enable command parse error before ' contact-fixup' Command fail. Return code -61 EDIT: i was trying to get the logs to show me droped packages or accepted packages that is concerned to the SIP. i have made sure that the allow_sip fw rule has Log Allowed Traffic and also the explicit drop all policy, however when checking the logs i cannot find any mention to the ip that i use to connect to the sip. i am beginning to think that maybe there is another rule that i cannot see in the graphical policy that is handling the sip (disabling my rule stop the sip so my rule is working and should have logged the event) that is ranked higher then my rule and is dropping the packages. the real question is, how do i even begin to verify this.....
    A
    Anonymous_UserAuthor
    Contributor
    February 20, 2011
    more development. i found the when enabling UTM VOIP on the FW rule i have i get logs. however the packets are droped as follow: profile=" default" profile_group=" N/A" profile_type=" VoIP_Profile" voip_proto=sip kind=call action=block status=blocked reason=unrecognized-form duration=0 dir=outbound message_type=response request_name=" REGISTER" count=1 when i turn off the UTM on the FW rule i am connected, have no logs and no sound. i have checked the profile=" default" and it is set to pass anything : FWCL # config voip profile FWCL (profile) # show config voip profile edit " default" config sip set register-rate 1000 set invite-rate 1000 set log-violations enable end config sccp set log-call-summary enable set log-violations enable set max-calls 1000 end next end so why is it droped? and why i have no logs if the UTM is not turned on?
    A
    Anonymous_UserAuthor
    Contributor
    February 21, 2011
    If you are using freepbx make sure your ip address is set correctly in asterisk sip settings.
    A
    Anonymous_UserAuthor
    Contributor
    February 21, 2011
    i believe i found the solution. using this: config system settings set sip-udp-port <port_number> end and disabling NAT and UTM on the FW rule i now have sound. thank you for the help.
    Terms & ConditionsAccessibility statement