Esteemed Contributor III

Question

VOIP over VPN IPSEC

Forum|Forum|15 years ago
December 13, 2010
13 replies
5915 views

Hello, I' ve configured VPN properly between fortigate & Cisco ASA & I want to allow our Nortel i2002 phone to connect to VOIP gateway through VOIP . Any special configuration needed to allow VOIP ? thanks

emnoc

New Member

Nothing special, you might want to look at priority-queuing for the VoIP traffic. Btw, my office uses that same phone and I used it in the past over a FGT-cisco firewall also. IIRC it' s not standard SIP traffic.

A

Anonymous_UserAuthor

Esteemed Contributor III

Sorry , what do u mean by ( look at priority-queuing for the VoIP traffic) ? I looked in Protection Profile to enable VOIP log but there is no VOIP log available , SO how can I log the VOIP traffic ? I' m using FW V.4.0,build0192,091222 (MR1 Patch 2)

A

Anonymous_UserAuthor

Esteemed Contributor III

Any suggestion please

FortiRack_Eric

New Member

It' s a good idea to create a traffic shaper for the SIP traffic to guarantee bandwidth and priority

A

Anonymous_UserAuthor

Esteemed Contributor III

thank you Eric , but is there anyway to log the SIP traffic to check what is wrong excatly?

A

Anonymous_UserAuthor

Esteemed Contributor III

Hossam, would you please let me know how did you configure the VPN tunnel between FG and ASA ?! this is v.imp to me Thanks man..

A

Anonymous_UserAuthor

Esteemed Contributor III

Dear Dodzmano, I followed this article http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=13574&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=12111504&st

emnoc

New Member

You can log match to your fwpolicy, but that' s not going to tell you what' s wrong. What are you trying to achieve? Systems logs or applications logging ? And yes, I would enable a traffic-shaper, but be advise it' s probably not SIP traffic. It' s unified stimulus or unistim for short. I would advise you to pcap some phone traffic to see the port(s)/protocol range and then prioritize that fwpolicy 1st and apply a shaper to it. I think when I last computed bandwidth guesses, it was about 87kbps or so per call.

A

Anonymous_UserAuthor

Esteemed Contributor III

emnoc , sorry can you explain please how to investigate what is wrong exactly ?

emnoc

New Member

emnoc , sorry can you explain please how to investigate what is wrong exactly ?

Here' s what I would; Do a packet capture to ensure you have the right protocol and ports between phone2phone and phone2pbx e.g diag sniffer packet lan ' iphone-addr and bcm-addr' Then define a policy at the top of your policy list for that traffic for the ipsec interface ( don' t forget you have a voice and control channel ) Next, craft a traffic shaper. Here' s what I did for one SoHo office and my single nortel i2002 phone; config firewall shaper traffic-shaper edit " VoIP" set guaranteed-bandwidth 90 set maximum-bandwidth 120 next end Apply the shaper to your fwpolicy. And that' s all that you need & all should work. VoIP quality was great and everything one 100% functional back to our corpHQ office and teh BCM/pbx that my phone registered to. IIRC, I did not need any special dhcp-option or any tricks with dhcp and serve my address for the phone locally and dynamic. So once you have identify the port(s)/protocol and have the appropiate rules, all should work. I never fully research the code type nor bandwidth consumption, but I have a hunch it' s 80k or so per call. Hope this helps.

A

Anonymous_UserAuthor

Esteemed Contributor III

Thank you emnoc so much , I Nortel i2002 is connected now but when I try to make a call I just hear the ring after that didn' t hear any voice . I got these errors 2010-12-28 10:03:38 log_id=0101037130 type=event subtype=ipsec pri=error fwver=040002 vd=" root" msg=" progress IPsec phase 2" action=" negotiate" rem_ip=2.2.2.2 loc_ip=1.1.1.1 rem_port=500 loc_port=500 out_intf=" wan1" cookies=" 0c562c3eae35aa18/8d4cf119efb0f8a6" user=" N/A" group=" N/A" xauth_user=" N/A" xauth_group=" N/A" vpn_tunnel=" VPN" status=failure init=remote mode=quick dir=inbound stage=1 role=responder result=ERROR 2 2010-12-28 10:03:30 log_id=0101037130 type=event subtype=ipsec pri=error fwver=040002 vd=" root" msg=" progress IPsec phase 2" action=" negotiate" rem_ip=2.2.2.2 loc_ip=1.1.1.1rem_port=500 loc_port=500 out_intf=" wan1" cookies=" 0c562c3eae35aa18/8d4cf119efb0f8a6" user=" N/A" group=" N/A" xauth_user=" N/A" xauth_group=" N/A" vpn_tunnel=" VPN" status=failure init=remote mode=quick dir=inbound stage=1 role=responder result=ERROR 3 2010-12-28 10:03:22 log_id=0101037130 type=event subtype=ipsec pri=error fwver=040002 vd=" root" msg=" progress IPsec phase 2" action=" negotiate" rem_ip=2.2.2.2 loc_ip=1.1.1.1 rem_port=500 loc_port=500 out_intf=" wan1" cookies=" 0c562c3eae35aa18/8d4cf119efb0f8a6" user=" N/A" group=" N/A" xauth_user=" N/A" xauth_group=" N/A" vpn_tunnel=" VPN" status=failure init=remote mode=quick dir=inbound stage=1 role=responder result=ERROR so why I can just dial any number but cannot hear any voice when anyone hang up the handset ?

emnoc

New Member

Will that looks like a vpn p2 error if I had to guess. Have you checked the following; is the vpn tunnel establish? ( diag vpn ike status and followed by a diag vpn ike gate ) and on the cisco " show crypto ike sa" , " show crypto ipsec sa" iirc Do you have a phase2 SA established ? ( diag vpn tunnel stat or list , are you defining correct IPs for the left & right networks ? ) and for the cisco " show crypto ipsec sa " Have you valid connectivity over the ipsec-tunnel ? ( ping the remote subnet the phone is and from both ways ) Do you have the correct firewall rules to allow traffic? ( I would do a general rule first and then narrow down the policy if required permit phone_net to remote_phone-net ) Lastly, what does the VoIP PBX see? ( are the instrument registered, do you see call setup or establishment ,softwitch diagnostics , etc...) if your having ASA issues, a packet trace would be helpful and tell you alot, ASAcodset 7.2 or higher ; " packet input " interface-name" " protocol" udp " src_net" + " port" " dst_net" + " port detail" Good luck.

A

Anonymous_UserAuthor

Esteemed Contributor III

Finally everything is working properly , thank you emnoc so much for your support & help.

Sign up

Login with SSO

Login to the community

Login with SSO