Description
Fortinet recommends disabling the SIP session-helper (Layer4) and using the SIP Application Layer Gateway (ALG) (Layer7).
Currently supported FortiOS versions have SIP-ALG enabled by default.
If SIP-ALG was disabled on a recent firmware, enable it with:
# config system settings
set default-voip-alg-mode proxy-based
end
While disabling SIP-ALG is changing a simple command, note that to enable SIP-ALG requires a reboot of the FortiGate in some cases.
If the statistics for the 'diag sys sip-proxy stats' are not increasing with the calls, then a reboot is necessary.
Reading further, this article is intended for older FortiOS firmware, though similar steps apply.
Solution
Until FortiOS 5.0, session-helper was the default SIP inspection mechanism.
Starting with FortiOS 5.2, SIP-ALG is enabled by default.
It is not necessary to apply a VoIPprofile to a Firewall policy to apply SIP ALG. When SIP traffic is detected, the 'default' VoIP profile is used by FortiGate.
The default voip profile can be modified from the default settings.
This, for example, makes FortiGate use sip session-helper for SIP (but keep SCCP and other voice traffic under SIP-ALG inspection):
config voip profile
edit default
config sip
set status enable/disable
end
end
The procedure to enable ALG profile before FortiOS 5.2:
- Check the session-helper number:
show system session-helper
edit 12 [*]
set name sip
set port 5060
set protocol 17
next
[*] Use this ID for the next step
- Remove this session-helper:
config system session-helper
(session-helper) delete 12
(session-helper) end
- Reboot the FortiGate , in order for the above changes to take effect.
- Enable VoIP Feature from WebGUI under System -> Config -> Features.
- Create a VoIP Profile with SIP enabled:
Note:
Instructions below are for FortiOS firmware versions 4.0 to 5.2.
Enter the following command to a Voip Profile for SIP, limit REGISTER and INVITE requests to 100 requests per second per firewall policy (values are given as an example).
config voip profile
edit "test"
config sip
set register-rate 100
set invite-rate 100
set block-long-lines disable
set block-unknown disable
end
next
end
- Enable this Protection Profile in the appropriate Firewall Policy(ies) for example.
config firewall policy
edit 1
set srcintf "internal"
set dstintf "wan1"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ANY"
set utm-status enable
set voip-profile "test"
set profile-protocol-options "default"
set nat enable
next
end
Related documents:
