FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes how to check whether the FortiGate config and SIP ALG were already disabled or not.
Scope
FortiGate.
Solution
The following are the steps that can be followed when unsure if SIP ALG is disabled or not.
Open the FortiGate CLI via GUI or SSH.
Check if 5060 exists in the config.
show full system session-helper | grep 5060
Review system settings and identify if default-voip-alg-mode is set to kernel-helper-based.
show full system | grep default-voip-alg-mode
In general, SIP ALG was already disabled if port 5060 was not available in the config system session-helper, and default-voip-alg-mode was set to kernel-helper-based.
Further references if SIP ALG needs to be disabled:
