FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
ACARIMO
Staff
Staff
Article Id 332325
Description This article describes the steps needed to confirm whether or not SIP traffic is being inspected by FortiGate.
Scope VoIP traffic over FortiGate.
Solution

In a FortiGate CLI window, run the following commands to get a list of all existing SIP sessions running on port 5060:

 

diagnose sys session filter clear

diagnose sys session filter dport 5060

diagnose sys session list

 

In the output for each session, examine the line starting with 'class_id=':

 

  • If the line contains a tag 'helper=sip', then FortiGate is inspecting SIP traffic using the SIP Session-Helper feature:

 

class_id=0 ha_id=0 policy_dir=0 tunnel=/ helper=sip vlan_cos=0/255

 

  • If the line contains a tag 'helper=20', then FortiGate is inspecting SIP traffic using the SIP ALG feature:

 

class_id=0 ha_id=0 policy_dir=0 tunnel=/ helper=20 vlan_cos=0/255

 

  • If the line does not contains a tag 'helper', FortiGate is not inspecting SIP traffic:

class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255

 

If it is inspected by the session helper, it can be checked using the command below:

diagnose sys session list expectation