Technical Tip: How to apply VoIP profile to policy where no SIP inspection is required

[JHelio]

Description	This article describes how to apply VoIP profile where SIP inspection is not required for specific traffic crossing IPv4 policy. The latest FortiGate versions have by default VoIP SIP ALG enabled globally and sometimes the FortiGate needs to handle more than one VoIP solutions where one solution will need SIP ALG active and other VoIP solutions will not be required. Default FortiGate configuration: # config system settings     set default-voip-alg-mode proxy-based  <----- SIP ALG enabled. end But if needed specific traffic does not have SIP ALG inspection active, It is possible to accomplish this by adding a VoIP profile to a specific IPv4 policy. Create VoIP profile with no SIP inspection by CLI: config voip profile     edit "VoIP_ALG_Off"     config sip         set status disable <----- Disable SIP inspection.         set rtp disable <----- Avoid RTP pinholes creation.      end next Assign such VoIP profile to the policy desired: By CLI: config firewall policy     edit 1         set name "disable VoIP"         set utm-status enable         set voip-profile "VoIP_ALG_Off" <----- VoIP profile assigned. next Note: Enable VoIP feature from System -> Feature Visibility -> VoIP.
Scope	FortiGate.
Solution	Having VoIP profiles where one has SIP ALG disabled, allows one to decide which traffic needs SIP inspection and which does not at the policy level.

[DPadula]

Hey Helio,

Mate, I got confused with this part : "But if needed specific traffic does not have SIP ALG inspection active, It is not possible to accomplish by adding a VoIP profile at a specific IPv4 policy."

You wrote is not possible to use a voip profile to have SIP ALG not inspecting the traffic, then you show how to apply a voip profile to do that. 

Also, you started the article with this sentence: This article describes how to apply VoIP profile where SIP inspection is not required for specific traffic crossing IPv4 policy.

Regards

Danilo