Skip to main content
Brady_R__Houser
New Member
January 22, 2015
Question

Polycom advice

  • January 22, 2015
  • 4 replies
  • 15028 views

I'm trying to put a Polycom device behind my firewall with a VIP NAT overload.

 

I can get it working so that I can browse the web interface but run into issues with one sided Voice/audio.

 

here's my config.

 

config firewall vip edit "War Room Polycom - 38.xx.xx.xx" set extip 38.xx.xx.xx set extintf "wan1" set mappedip 172.40.100.48 next end

 

config firewall policy

edit 130 set srcintf "wan1" set dstintf "port1" set srcaddr "all" set dstaddr "War Room Polycom - 38.xx.xx.xx" set action accept set schedule "always" set service "ALL" set logtraffic disable set nat enable set ippool enable set poolname "Cogent War Room - 38.xx.xx.xx"

 

I've also deleted the SIP and H232 helper from config system session-helper

 

I'm running 5.0.9 on Fortigate 200D setup in an Active-Passive HA.

    4 replies

    Dave_Hall
    New Member
    January 22, 2015

    Just guessing, you may want to setup a wf policy from port1/172.40.100.48 to WAN, using that NAT pool (or a 1-to-1 NAT.

    seadave
    New Member
    January 23, 2015

    We had this problem.  The fixup/helper setting for the codec didn't seem to work.  We finally gave up and purchased a Polycom VBP ($1500).  This is a VTC/SIP dedicated firewall.  It has the advantage of allowing you to register your HDX Codex by E.194 numbers so people can dial direct using IP##NUM

     

    If you only have one HDX you should be able to do something with the Fortinet to make it work, if you have more than one, you should look into the VBP.  Makes things much easier.

     

    http://www.polycom.com/products-services/realpresence-platform/universal-access-security/vbp-e-series.html#stab5

     

    http://www.ipphone-warehouse.com/Polycom-2583-73545-001-p/2583-73545-001.htm

    seadave
    New Member
    January 24, 2015

    Just found this.  Look in page 925 of the FortiOS Handbook for FortiOS 5.2  Even if you are not on that, it has great info about ports and Polycom.  Trying to find original download.  There appears to be 10 versions of this document.  PDF I have is called:

     

    fortios-handbook-52.pdf

     

    I'll be darned if I can find the exact version.  Here is a Dropbox link to it:

     

    https://www.dropbox.com/s/w5c03tsx4ltbiyw/fortios-handbook-52.pdf?dl=0

    emnoc
    New Member
    January 24, 2015

    1st off you don't need  nat on a VIP ( dnat )

     

    e.g remove these

     

    set nat enable set ippool enable

     

    2nd you need to get out diag debug flow and get  the reason why your sessions is not being made

     

     

    3rd you will need some type of policy allowing traffic outbound and SNAT , once again  the diag debug flow  is your friend.

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.