Technical Tip: How to verify if SIP traffic is being inspected by FortiGate

[ACARIMO]

Description	This article describes the steps needed to confirm whether or not SIP traffic is being inspected by FortiGate.
Scope	VoIP traffic over FortiGate.
Solution	In a FortiGate CLI window, run the following commands to get a list of all existing SIP sessions running on port 5060: diagnose sys session filter clear diagnose sys session filter dport 5060 diagnose sys session list diagnose sys session filter clear diagnose sys session filter sport 5060 diagnose sys session list In the output for each session, examine the line starting with 'class_id=': If the line contains a tag 'helper=sip', then FortiGate is inspecting SIP traffic using the SIP Session-Helper feature: class_id=0 ha_id=0 policy_dir=0 tunnel=/ helper=sip vlan_cos=0/255 If the line contains a tag 'helper=20', then FortiGate is inspecting SIP traffic using the SIP ALG feature: class_id=0 ha_id=0 policy_dir=0 tunnel=/ helper=20 vlan_cos=0/255 If the line does not contain a tag 'helper', FortiGate is not inspecting SIP traffic: class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255 Related article: Technical Tip: VoIP and SIP configuration and troubleshooting resource lists