FG 50B setup for RingCentral - no audio

[JJLatFortinet]

I' m evaluating RingCentral' s hosted VoIP and my current FortiGate 50B seems to be getting in the way. The phone works from home and their site' s capacity test and quality test indicate I should be able to sustain about 50 simultaneous calls. I' m able to dial out (it rings the outside phone and shows the caller id) and I' m able dial in (it rings and displays the caller id of the inbound caller). But neither side can hear the other. I' ve policies that open the destination ports suggested by RingCentral and opened all traffic to destination sip.ringcentral.com and *.ringcentral.com. I have traffic shaper for these policies maximizing bandwidth and priority. This stuff is probably simple for a residential firewall because they' re designed to be loose. I' ve seen very little on this forum dealing with this VoIP " carrier" , but perhaps I missed something. Please help. Thank you.

[rwpatterson]

Try removing the SIP session helper. It' s given mixed results in the past, depending on carrier and firmware level... (See number 12...)

 login as: admin
 admin@gateway' s password:
 Gateway # config system session-helper
 
 Gateway (session-helper) # show
 config system session-helper
     edit 1
         set name pptp
         set port 1723
         set protocol 6
     next
     edit 2
         set name h323
         set port 1720
         set protocol 6
     next
     edit 3
         set name ras
         set port 1719
         set protocol 17
     next
     edit 4
         set name tns
         set port 1521
         set protocol 6
     next
     edit 5
         set name tftp
         set port 69
         set protocol 17
     next
     edit 6
         set name rtsp
         set port 554
         set protocol 6
     next
     edit 7
         set name rtsp
         set port 7070
         set protocol 6
     next
     edit 8
         set name ftp
         set port 21
         set protocol 6
     next
     edit 9
         set name mms
         set port 1863
         set protocol 6
     next
     edit 10
         set name pmap
         set port 111
         set protocol 6
     next
     edit 11
         set name pmap
         set port 111
         set protocol 17
     next
     edit 12
         set name sip
         set port 5060
         set protocol 17
     next
     edit 13
         set name dns-udp
         set port 53
         set protocol 17
     next
 end
 
 Gateway (session-helper) #
 

[ede_pfau]

config system session-helper
   delete 12
 end

in the Console widget on Dashboard.

[JJLatFortinet]

Thanks for the assist. Unfortunately, the deletion of the session-helper made no difference. However, I made a change that seems to work. If this is the ultimate fix, I' m stuck having to manually assign an IP address to each phone. I was hoping I' d be able to set up the FG in a way that would let me plug in any RingCentral supplied phone and have to make no manual changes to the phone. I now have a simple Firewall Policy where the Source Address is the group of ip addresses assigned to the RingCentral phones and they basically unrestricted access to the world. One day I may do a little packet sniffing and see what addresses and ports they' re actually calling. In the meantime, it seems to work.