Avaya IP Trunks are not working when the ports are limited

[#1]

Dear All, I have configured a Site to Site VPN between FortiGate and Checkpoint. Both end' s of the Firewalls we have Avaya IP telephone setup. our aim is to achive the IP Trunk beween these to offices through VPN. We achived the task by applying the corresponding rule at both the ends. The problem comes here is, on both the Firewalls (FortiGate & CP) if I allow ANY as a service, The IP Trunk starts working and when I filtered the logs I found that the service that in user are icmp/8 and tcp/5020. When I put these to ports on the services option, The IP Trunk is not working. I don' t know where the problem is????? Could any one help me in this case, That will be a good thing for me. Thanks in advance, Regards, Basha

[doshbass]

Basha, Clearly there is something else trying that got missed on the logs. You can try several things, 1) run the diag sniffer command to see what other traffic is being sent from your phones 2) create an explicit devy rule after your allow rule and tick the " log violation traffic" option to see what is beiing bloicked.

[g3rman]

If it is a SIP trunk it will very likely also need port 5060 for SIP signalling. Typically the media stream between the two devices is on some random high ports which are negotiated during call setup.