Mitel Softphone FortiClient VPN issues

[mdriscoll51]

Hello All!  First post so don't flame me hard lol

Here is the issue we have at work.  Remote users working from home are able to VPN in with the FortiClient app on their Windows 10 laptops.  They are able to login to the Miltel app on the laptop.  When ever they make or receive a call via softphone they can not hear the audio but the other person can hear the audio on their side

Client app. ver.

FortiClient VPN6.2.2.0877Shortel Connect app. ver213.100.2885.0

[John_Williamson]

5 weeks later, but we are doing the same thing, but we get no audio on either end. The call is connected, but the audio part is missing. 

[Isaiahs]

Any update fellas?

[FortiLearner]

Hi,

Have you checked if you have a NAT enabled on your policy?

Have you tried disabling SIP ALG-Helper?

Regards,

FortiLearner

[hremillard]

If your using Micollab softphone NextGen all the sip signaling is encrypted with TLS so the Fortigate won't be able to modify the packet. Because Mitel have is own SIP proxy Firewall   (Mitel Border Gateway) the SIP ALG only cause trouble  and must be disable on Fortigate.

[John_Williamson]

Yes. 

In our case, it was NAT enabled on the incoming policy. We did disable all the SIP stuff and change the ALG but non of those fixed the issue. The SIP part of the connection worked. The calls were connected. It was just the audio that didn't. A Wireshark packet capture showed that incoming could not find UDP port 10000, but it was fine on outgoing. Turning off NAT in the incoming policy must have allowed that through. 

[BenjiS]

For us, we had the same issue but it was because the VPN did not have a route to the other phone (i.e. calling someone on your Micollab while on the VPN to someone also on Micollab on a VPN meant neither side could hear because there was no route specified) calling to mobiles was fine. 

If someone had a route to the Micollab caller they could hear the caller but the caller couldnt hear the person they called.

Just had to add in more routes in :)

[hremillard]

You should always use teleworker mode on the MiCollab softphone even on VPN, but when you're connected on VPN the MiCollab FQDN server must resolve to your internal Micollab and not the MBG, then you need o create a firewall rule VPN interface to your Micollab internal IP with port 5061 and all the ephemeral UDP ports for RTP. With this solution you won't need to create a lot of   routes.