No voip connections from branch fortigate.

[Tutek]

Hello,

I have such problem, after connecting new branch office with voip phones and voip gateway, users cannot call anymore. The call is established but the caller cannot be heard. The traffic from branch is routed to HQ fortigate. What seems strange to me is that the voip log in central fortigate, shows calls from the remote voip gateway as if they were calls from the local fortigate (127.0.0.1), the source address of the call from the remote voip gateway is not preserved:

Source: 192.12.0.6 (branch voip gateway)   CALL ID: 53c80ff47a4440b0440f86045f462391@127.0.0.1

Source: 192.10.0.6 (local voip gateway)   CALL ID: 5578e64444cf493767dac34c3cd50aa7@127.0.0.1

[gfleming]

I believe that is showing the central FGT is acting as SIP ALG and proxying/terminating the SIP leg so you see FGT's localhost IP there.

Can you explain better your topology?

Who is calling who? Where are they?

How many FortiGates is that call leg passing through?

Do you have policies allowing the VOIP traffic?

Is it just allowing SIP ports or also RTP ports?

Do you have any DNAT/SNAT enabled for the VOIP traffic?

[Tutek]

1.Branch: voip vlan (hera are phones)--> vlan server where is voip PBX located --->ipsec tunnel (central fortigate) here is doing NAT applied --->internet

2.the call is initiated from voip vlan on the branch fortigate

3. two fortigates are involved the branch and the HQ where is internet access

4. yes I have policies allowing from voip vlan to server vlan with UDP/TCP 5060 where voip PBX is located and second policy from server vlan to HQ fortigate with SIP 5060 ports.

Then on HG policy to allow internet connection from branch voip pbx to internet.

5.I have only allowed udp/tcp 5060 how to enable RTP I don't see anything like that in services.

6.I don't have any DSTNAT policies nor snat policies.

On the branch I had before Mikrotik router, now after installed there Fortigate device I have such problem. 

As I said call is established but in one way only, I can't hear the caller.

[gfleming]

So these calls are going out from your HQ FortiGate to some VOIP provider on the internet? These are not local calls?

If so you probably need to set up your VOIP ALG settings a bit. Depending on your VOIP provider you may  need to disable strict register. Read this page for some good background info and more details:

https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/809/sip-pinholes

You also most likely need to define your external interface on the HQ FortiGate so it can do the HNAT traversal. More info here:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Hosted-NAT-Traversal-for-SIP/ta-...

[gfleming]

OK i think your issue is you aren't allowing RTP packets here. SIP UDP/5060 is used for signalling and call set up during which ports are agreed upon to use for RTP which carries the voice traffic. RTP is generally done anywhere on UDP port range 16000-32766. Depends on VOIP implementation so it might be safe to just allow all UDP to/from phones VLAN to other phones and other systems that terminate phone calls.

[Tutek]

On HQ Fortigate where voip calls are working I have such Firewall Policies:

1. voip vlan--->vlan with voip pbx, Port UDP/TCP 5060

2.vlan with voip pbx ----> sip provider on internet, port tcp 5525, UDP 1190-1445, TCP/UDP 5060

3.vlan with branch voip pbx--->sip provider on internet, port tcp 5525, UDP 1190-1445, TCP/UDP 5060

I don't use any voip profile on any firewall policies.

On Branch (voips are not working):

1. voip vlan--->vlan with voip pbx, Port UDP/TCP 5060

2.vlan with voip pbx ----> SD-WAN ZOne to HQ, port tcp 5525, UDP 1190-1445, TCP/UDP 5060

here also I don't use any voip profiles.

I remember to get working DNS and Fortiguard service on branch, I had to specify in CLI to use SDWAN interface, maybe this is routing problem and VOIP have also such settings to use SDWAN?

[gfleming]

This is confusing. Why do you have a VLAN with VOIP PBX on both your HQ FGT and Branch FGT?

And remember, most times RTP traffic will terminate between the IP Phone and the remote phone or SIP server, not the internal PBX. Sometimes the internal PBX can act as a proxy for RTP traffic but it is rare.

Best thing to troubleshoot this for now would be to do a packet capture for the Branch phone and figure out:

1. Where is the RTP traffic going?

2. What ports is the RTP traffic using?

3. If you want, open up all your policies in the path to allow ALL UDP traffic and see if it works.

[Tutek]

I get from sip operator that they use 5060 TCP/UDP and RTP 10000-20000, so I have added UDP Ports range 10000-20000 from phones to pbx and from pbx to sdwan and then to internet - still no any change.

[gfleming]

Remember what I said about RTP paths: most often it is established direclty between SIP endpoints (and not the PBX). Please ensure UDP/10000-20000 is allowed between the phones and the VOIP provider (both ways).

And also the best thing you could do is get a packet capture going so we can see exactly what's wrong.

[Tutek]

I have log enabled on implicit deny firewall policy at the bottom, and all the time I look at the forward logs on Branch:

-to/from vlan voip phones

-to/from pbx vlan

On Hub Fortigate:

-to/from internet facing cloud sip provider.

And nothing is on blocked/denied if if any ports were missing after all it would be visible.