Source Port Change

If you use NAT in the outgoing policy the FGT will use a different high-range port for each outgoing connection. It can only differentiate connections by the port number as it uses the same source IP all the time. You can check " fixed-port" to force it to keep the source port number. But then, there will only be one connection possible per source port. From the CLI Guide: " config firewall policy set fixedport enable Enable to preserve packets’ source port number, which may otherwise be changed by a NAT policy. Some applications do not function correctly if the source port number is changed, and may require this option. If fixedport is enable, you should usually also enable IP pools; if you do not configure an IP pool for the policy, only one connection can occur at a time for this port."

Thanks for your help. Are you saying that if my vdom is in transparent mode, the set fixedport enable won' t do anything for me? This issue occurs on rtp protocol. There won' t be a situation where two sources are going to require the same port. Thanks

eh..what...VDOM, transparent mode? Maybe you should be more generous with information about your setup in the first place. If you run this particular policy in a tp-mode VDOM then you won' t use NAT in it, right? Then the FGT won' t change the source port at all. Still confused.

This issue and the question asked on firewall forum is part of the same issue. My topology is as follows: On my Lan I am running sip server and sbc server. The sbc server has internal interface with lan ip and external interface with wan ip. The sbc' s wan interface is connected to fortigate 50b transparent vdom internal interface. I created firewall policy which allows any protocol traffic to and from sbc server. My sbc does the following: 1. Registers with itsp and creates a bridge with the sip server. 2. Routes pstn calls in/out for sip users. 3. Routes remote user' s registration requests to the sip server. 4. Routes pstn calls in/out for sip remote users. 5. Routes local sip calls between local users and remote users. My configuration works for all of the cases mentioned above except for when remote user is trying to call to local sip user. As I had mentioned in the other post, the source of the problem is below. I capture traffic on both interface and the result is below. External Interface 42.663538 [client' s firewall wan ip].48516 -> [fortigate wan ip].31604: udp 16 42.663646 [fortigate wan ip] -> [client' s firewall wan ip]: icmp: [fortigate wan ip] udp port 31604 unreachable 43.070768 [fortigate wan ip].5060 -> [client' s firewall wan ip].16832: udp 4 45.212874 [client' s firewall wan ip].6121 -> [fortigate wan ip].31605: udp 152 45.213147 [fortigate wan ip] -> [client' s firewall wan ip]: icmp: [fortigate wan ip] udp port 31605 unreachable 48.072231 [fortigate wan ip].5060 -> [client' s firewall wan ip].16832: udp 4 48.282998 [client' s firewall wan ip].36456 -> [fortigate wan ip].31605: udp 132 48.283289 [fortigate wan ip] -> [client' s firewall wan ip]: icmp: [fortigate wan ip] udp port 31605 unreachable 51.342333 [client' s firewall wan ip].35881 -> [fortigate wan ip].31605: udp 132 51.342647 [fortigate wan ip] -> [client' s firewall wan ip]: icmp: [fortigate wan ip] udp port 31605 unreachable Internal Interface 39.663551 [client' s firewall wan ip].48516 -> [fortigate wan ip].31604: udp 16 39.663618 [fortigate wan ip] -> [client' s firewall wan ip]: icmp: [fortigate wan ip] udp port 31604 unreachable 39.663660 [fortigate wan ip] -> [client' s firewall wan ip]: icmp: [fortigate wan ip] udp port 31604 unreachable 39.663679 [fortigate wan ip] -> [client' s firewall wan ip]: icmp: [fortigate wan ip] udp port 31604 unreachable 40.070751 [fortigate wan ip].5060 -> [client' s firewall wan ip].16832: udp 4 42.212893 [client' s firewall wan ip].6121 -> [fortigate wan ip].31605: udp 152 42.213102 [fortigate wan ip] -> [client' s firewall wan ip]: icmp: [fortigate wan ip] udp port 31605 unreachable 45.072213 [fortigate wan ip].5060 -> [client' s firewall wan ip].16832: udp 4 45.283056 [client' s firewall wan ip].36456 -> [fortigate wan ip].31605: udp 132 45.283257 [fortigate wan ip] -> [client' s firewall wan ip]: icmp: [fortigate wan ip] udp port 31605 unreachable 48.342416 [client' s firewall wan ip].35881 -> [fortigate wan ip].31605: udp 132 48.342616 [fortigate wan ip] -> [client' s firewall wan ip]: icmp: [fortigate wan ip] udp port 31605 unreachable What I don' t understand if it is a remote firewall problem why when placing calls from sip local user to remote user works and not the reverse. The same ports need to be open on the remote firewall. Thanks in advance

So the traffic coming from the remote firewall is not allowed in on your fortigate. For the traces to make any sense both sides must negotiate the port number they want to communicate over. Apparently the FGT doesn' t follow this. 2 thoughts: 1. per default, the FGT does not allow the full port range 1-65535. You can set this via CLI in ' conf system global, set ip-src-port-range <start_port>-<end_port>' , for instance ' ip-src-port-range 1-65535' . 2. for protocols with negotiated ports FortiOS provides session helpers or session proxies. As I have no experience with VoIP I' ll leave that to you to search the docs for SIP support (e.g. FortiOS Handbook, ch. 17 " VoIP solutions: SIP" .

I captured tcp dump between sbc and fortigate and it seems that fortigate does change the port. 15614 38.707020 [fortigate or sbc lan or wan ip] [fortigate or sbc lan or wan ip] UDP Source port: 30480 Destination port: 24802 Since fortigate' s external and internal interfaces and sbc' s external interface have the same ip, I am not sure what direction the traffic is moving. But this seems to indicate the port is being modified. This is part of a conversation with itsp.