FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
JHelio
Staff
Staff
Article Id 246687
Description

This article describes how to apply VoIP profile where SIP inspection is not required for specific traffic crossing IPv4 policy.

 

The latest FortiGate versions have by default VoIP SIP ALG enabled globally and sometimes the FortiGate needs to handle more than one VoIP solutions where one solution will need SIP ALG active and other VoIP solutions will not be required.

 

FortiGate config by default:

 

# config system settings
    set default-voip-alg-mode proxy-based  <----- SIP ALG enabled.
end

 

But if needed specific traffic does not have SIP ALG inspection active, It is not possible to accomplish by adding a VoIP profile at a specific IPv4 policy.

 

1) Create VoIP profile with no SIP inspection by CLI:

 

# config voip profile
    edit "VoIP_ALG_Off"
    config sip
        set status disable <----- Disable SIP inspection.
        set rtp disable <----- Avoid RTP pinholes creation. 
    end
next

 

2) Assign such VoIP profile to the policy desired:

 

ALG.PNG

 

By CLI:

 

# config firewall policy
    edit 1
        set name "disable VoIP"
        set utm-status enable
        set voip-profile "VoIP_ALG_Off" <----- VoIP profile assigned.
next

 

Note:

Enable VoIP feature from System -> Feature Visibility -> VoIP.

 

voip.PNG

 

Scope FortiGate.
Solution

Having VoIP profiles where one has SIP ALG disabled, allows one to decide which traffic needs SIP inspection and which does not at the policy level.

 

voip2.PNG

 

 

Contributors