How to configure correctly Fortinet(s) Unit(s) so that to Handle SIP traffic

[Phinestra200]

Hi All,

We have Several Fortigate Units on our infrastructure and we have to make SIP traffic Works properly since few mounth.
Actually, this is not the first time we are face to this issue and we still stuck on it.

i've check several TIPS on Googleor whatever you want and must of all recommand  to disable sip session helper by following some step depending on the FortiOS Version.

In our case traffic going through 3 Fortigate Units (800C then 600D and finally 201E which is our frontal unit) and there is no NAT applied all along the traffic.

there is no Bad NAT implemented i can clearly see the same IP adress(Internal and Public) from one part and the last one
I was able to traffic going to VOIP provider but never get back

On the last forti Unit, the debug flow looked like :

id=20085 trace_id=21 func=print_pkt_detail line=4903 msg="vd-SIP received a packet(proto=17, 10.X.X.X:5060->46.X.X.X:5060) from SIP_LAN. "
id=20085 trace_id=21 func=resolve_ip_tuple_fast line=4967 msg="Find an existing session, id-014a782a, original direction"
id=20085 trace_id=21 func=npu_handle_session44 line=1028 msg="Trying to offloading session from SIP_LAN to SIP_PUB, skb.npu_flag=00000400 ses.state=20130306 ses.npu_state=0x00100000"
id=20085 trace_id=21 func=av_receive line=268 msg="send to application layer"
id=20085 trace_id=22 func=print_pkt_detail line=4903 msg="vd-SIP received a packet(proto=17, 10.X.X.X:5060->46.X.X.X:5060) from local. "
id=20085 trace_id=22 func=resolve_ip_tuple_fast line=4967 msg="Find an existing session, id-014a782a, original direction"
id=20085 trace_id=22 func=__ip_session_run_tuple line=2931 msg="run helper-sip(dir=original)"
id=20085 trace_id=23 func=print_pkt_detail line=4903 msg="vd-SIP received a packet(proto=17, 10.X.X.X:5060->46.X.X.X:5060) from SIP_LAN. "
id=20085 trace_id=23 func=resolve_ip_tuple_fast line=4967 msg="Find an existing session, id-014a782a, original direction"
id=20085 trace_id=23 func=npu_handle_session44 line=1028 msg="Trying to offloading session from SIP_LAN to SIP_PUB, skb.npu_flag=00000400 ses.state=20130306 ses.npu_state=0x00100000"
id=20085 trace_id=23 func=av_receive line=268 msg="send to application layer"
id=20085 trace_id=24 func=print_pkt_detail line=4903 msg="vd-SIP received a packet(proto=17, 10.X.X.X:5060->46.X.X.X:5060) from local. "

here is the diag sys session list (filter on the internal IPBX)

session info: proto=17 proto_state=00 duration=6959 expire=179 timeout=0 flags=00000000 sockflag=00000000 sockport=5060 av_idx=6 use=5
origin-shaper=
reply-shaper=
per_ip_shaper=
ha_id=0 policy_dir=0 tunnel=/ helper=sip vlan_cos=0/255
state=redir log local may_dirty npu npd nlb ha_replicate none inherit_sockport
statistic(bytes/packets/allow_err): org=1316152/2488/1 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 1047/8 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=144->143/143->144 gwy=172.16.x.x/0.0.0.0
hook=pre dir=org act=noop 10.X.X.X:5060->46.X.X.X:5060(0.0.0.0:0)
hook=post dir=reply act=noop 46.X.X.X:5060->10.X.X.X:5060(0.0.0.0:0)
misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=2
serial=014a782a tos=ff/ff app_list=0 app=0 url_cat=0
dd_type=0 dd_mode=0
npu_state=0x100000
npu info: flag=0x00/0x00, offload=0/0, ips_offload=0/0, epid=0/0, ipid=0/0, vlan=0x0000/0x0000
vlifid=0/0, vtag_in=0x0000/0x0000 in_npu=0/0, out_npu=0/0, fwd_en=0/0, qid=0/0
no_ofld_reason:  redir-to-av offload-denied helper
total session 1

note: i can show you what i had with the "debug application sip -1" , but it is really long :

so i've decided to disable the Session :

https://www.3cx.com/community/threads/fortigate-sip-alg-disable-steps-5-2-firmware-and-above.47694/ 

but now i'm not not only able to see traffic in CLI  when i make the :diag sni pack any "host 10.X.X.X" 4 or the debug flow
--> maybe because of the action i've made.

Here is the new here is the diag sys session list (filter on the internal IPBX)

session info: proto=17 proto_state=00 duration=167 expire=148 timeout=0 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=4
origin-shaper=
reply-shaper=
per_ip_shaper=
ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=log may_dirty npu none
statistic(bytes/packets/allow_err): org=1058/2/1 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 6/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=144->143/143->144 gwy=172.16.1X.2X/0.0.0.0
hook=pre dir=org act=noop 10.X.X.X:5060->46.X.X.X:5060(0.0.0.0:0)
hook=post dir=reply act=noop 46.X.X.X:5060->10.X.X.X:5060(0.0.0.0:0)
misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=2
serial=014c84c7 tos=ff/ff app_list=0 app=0 url_cat=0
dd_type=0 dd_mode=0
npu_state=0x000400
npu info: flag=0x81/0x00, offload=8/0, ips_offload=0/0, epid=65/0, ipid=64/0, vlan=0x89c5/0x0000
vlifid=64/0, vtag_in=0x09c5/0x0000 in_npu=1/0, out_npu=1/0, fwd_en=0/0, qid=1/0
no_ofld_reason:
total session 1

At one moment i've realized that it is mandatory to open few more ports after disable sip helper , i did it, and i did it both way and during the last action i saw this traffic for few sec :

***************
id=20085 trace_id=1 func=print_pkt_detail line=4903 msg="vd-SIP received a packet(proto=17, 10.X.X.X:5060->46.X.X.X:5060) from SIP_LAN. "
id=20085 trace_id=1 func=resolve_ip_tuple_fast line=4967 msg="Find an existing session, id-00000063, original direction"
id=20085 trace_id=2 func=print_pkt_detail line=4903 msg="vd-SIP received a packet(proto=17, 10.X.X.X:5060->46.X.X.X:5060) from SIP_LAN. "
id=20085 trace_id=2 func=resolve_ip_tuple_fast line=4967 msg="Find an existing session, id-00000063, original direction"
id=20085 trace_id=2 func=npu_handle_session44 line=1028 msg="Trying to offloading session from SIP_LAN to SIP_PUB, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x00000400"
id=20085 trace_id=2 func=ip_session_install_npu_session line=322 msg="npu session intallation succeeded"
**************** 

AT THIS POINT I REALLY DON'T KNOW WHAT TO DO, SO I'VE FEW QUESTIONS

- If in my case, i really should disable the SIP session helper, should i do it for all fortigate the traffic going through or only on the frontal one ?
- Who already has been face to this issue with fortinet equipement without using NAT anyware?
- According to you how can i solve this and Make it works?
- What means the state of npu ( npu_state=0x000400 and npu_state=0x100000)

Thanks in advance for any help Guyz.

Regards,

Phi.

[mahesh_secure]

Hi

 """id=20085 trace_id=21 func=av_receive line=268 msg="send to application layer"""

you have enabled Application control profile in SIP access policy. did you check the application control log and log and report section ?
any traffic drop by app scan ? did you try disabling app scan ?


Regards
Mahesh