Issue with fortigate policy

[stylezz]

Hi,

I've seemed to have hit a snag with configuring our new VOIP provider.

The traffic from the external VOIP server is being blocked by our firewall.

I've tried to make a policy (KPN VOICE rule) to allow it but it doesnt seem to get hit and the incoming calls are still being blocked by the implicit deny rule.

I've included images with the policy rules and the log detail of an incoming call.

The fortigate is behind a new router which makes a VPN to the new provider, the WAN interface on the Fortigate has IP 10.4.7.1

The KPN SBC object in the policy rule contains the IP address of the external VOIP server.

Can anyone point me the in the right direction?

[MikePruett]

Are you getting one way audio issues or are calls not coming in at all?

config system settings

set sip-udp 5080

[stylezz]

I'm not getting any incoming calls, outgoing calls work fine and the audio is good.

[emnoc]

Qs

Did you run diag debug flow on the call and signaling ?

Since calls are working one-way, I would not over look any SIP diagnostic and  causes response  between SIP serve/client ?

Do you have any registration issues or is SIP-reg not being used here ?

[hmtay_FTNT]

From the logs, in the Destination section, it looks like the IP 10.4.7.1 is matched to the "root" interface and not "internal". That is likely the reason why it is blocked by the implicit deny rule.

[emnoc]

diag debug  flow is your friend, we do not have enough of information or  proper collection of diagnostics

no match firewall

no route

other items to be concern with ( typo, wrong addr object, /32 static routes,pbr,etc.......)