FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
MichaelTorres
Article Id 366974
Description

 This article describes a common issue where calls can not be established when SIP trunks are using port 5064 for the SIP communication protocol.

Scope

FortiGate.

Solution

Network diagram:

                                                                           

MichaelTorres_0-1735216592546.png

 

 

In environments where users are deploying multiple SIP trunks with different carriers, it may happen ports being used for the SIP communication protocol can be different to the conventional 5060.

In the above diagram, users set one VoIP carrier with port 5060 (default) and the other SIP Carrier with port 5064 for the SIP communication.

 

By Default FortiGate uses port 5060 for the SIP communication protocol. Session helpers are configured using these default ports:

 

edit 13
    set name sip
    set protocol 17
    set port 5060
next

 

Sessions for the VoIP 1 provider are correctly established. In the session, verify the traffic using the pinhole ports (session helpers) with the following commands:

 

di sys session filter x.x.x.x <----- Replace x.x.x.x with the IP of the PBX.

di sys session list

 

However, calls from VoIP 2 providers do not get established. Firewall policies an routing are correctly configured.

 

Solution:

Create another SIP session helper using the SIP port 5064

 

config system session-helper
    edit 23
        set name sip
        set protocol 17
        set port 5064
    next

 

Related articles:

Technical Tip : Session helpers and expectation se... - Fortinet Community

Technical Tip: SIP useful Commands - Fortinet Community