No voip connections from branch fortigate.

[Tutek]

Hello,

I have such problem, after connecting new branch office with voip phones and voip gateway, users cannot call anymore. The call is established but the caller cannot be heard. The traffic from branch is routed to HQ fortigate. What seems strange to me is that the voip log in central fortigate, shows calls from the remote voip gateway as if they were calls from the local fortigate (127.0.0.1), the source address of the call from the remote voip gateway is not preserved:

Source: 192.12.0.6 (branch voip gateway)   CALL ID: 53c80ff47a4440b0440f86045f462391@127.0.0.1

Source: 192.10.0.6 (local voip gateway)   CALL ID: 5578e64444cf493767dac34c3cd50aa7@127.0.0.1

[gfleming]

Can you please get a packet capture from the phone when it initiates a call?

Also what about the policies between the sites on the IPSec tunnel? Anything blocked there?

[Tutek]

ok, but is this possible to hide phone numbers in wireshark pcap file?

[gfleming]

Not sure but we just want to see the RTP packets so you can filter for those and that wont show the phone #

[Tutek]

Branch voip pbx have sip account provider configued on it (sip.voice4u.pl ).

The same account is configured on voip pbx located in HQ Fortigate.

On HQ fortigate calls are working without any problems and I don't have any voip profiles applied to outgoing policy.

From branch when calling to outside to any numbers fixed/mobile we can't hear the caller, on the other side the caller heard us but when he speak we don't hear him.

Voip provider that is configured on both voip pbx, send us command to help resolve this problem, like:

proxy address: sip.voice4u.pl (195.162.16.201) SIP UDP 5060
server address media-gateways z puli 195.162.16.0/24 RTP 0-65536

So I have configured policy to these servers with udp/tcp 5060, and more:

I have execute these commands on the branch and the HQ - did this did not help:

config system settings
set default-voip-alg-mode kernel-helper-based
set sip-expectation disable
set sip-nat-trace disable

[gfleming]

OK are branch calls going direct to the SIP provider from the branch fortigate or from the HQ fortigate?

What are your IPSec policies? Do they allow all traffic?

[Tutek]

All traffic from branch is pushed to the HQ, so branch's voip pbx is using internet located at HQ Fortigate.

Ipsec tunnels between these devices was created using sdwan vpn wizard, and traffic between is not natted, branch users have internet access from HQ and this is working, calls are also initiated using HQ internet but they are only one way call.