One-way audio over fortigate FW

[MazenH]

Hi team, I need your help in a one way audio in a network. The design is a bit complex and is a follows: - fortigate acts an internal firewall --> connected to Cisco FW --> Service provider - the voice server is at the service provider premises I can make calls from the internal network to any phone to remote sites (they don' t have Fortigate) or to the phones at the service provider. They can hear me, I can' t hear them. They cannot call me, of course. Phones are registered normally. I tried to bypass the Cisco Firewall for the voice traffic, it didn' t change anything. I enabled " any any" for the voice, I enabled SIP and ICMP and nothing changed (the phones in question are Cisco SIP). Can you please advise on what I can do? Do you require any command outputs? Any help would be appreciated. Regards, Mazen

[Sean_Toomey_FTNT]

Hi there! I would recommend that you move your question to another section of these forums for the best assistance. FortiVoice is a SMB VoIP solution, and what you' re describing is general difficulty with VoIP traffic. VoIP can be tricky to troubleshoot because there are so many different ways it can be implemented. First, I hope you aren' t using src/dst of any/any as this is very bad security practice :) Here are some steps you can try as a first pass, but I would still recommend you ask this in another section, perhaps FortiOS. I would say ask the provider what configurations need to be in place for your system to work. I assume that your phones have internal IP' s, you can' t just create a rule to allow access from your service provider inbound to your phones, NAT or a VIP would have to be involved. I suspect that you are simply missing some configuration and/or there is a misconfig on another component. Since you' ve bypassed the cisco FW and problem persists, check with your service provider and ensure you have everything open that needs to be open and the proper configuration on their side. I' m sorry I can' t be more specific. Without knowing all the parameters and how the service provider is setup on the head end, it' s hard to say. Bear in mind FortiOS does have VoIP specific policy in the GUI that may be relevant here depending on your needs. If you don' t see it, enabled in in the Features widget on the dashboard. Cheers!

[neonbit]

Hi Mazen, I' ve seen this behaviour several times with SIP traffic going through a FortiGate. Usually the problem is to do with the FortiGates SIP session helper (should be renamed ' unhelper' ...). For myself the fix has usually been to delete and disable the SIP helper, then restart the firewall. This must be done in the CLI. When you run the below ' show' command, look for the id that SIP has been configured under. Usually I see this as 13, but sometimes it' s 12 too.

 config system session-helper
 show
 delete 13 (or whatever the ID is for the SIP session helper)
 end
 
 config system settings
 set sip-helper disable
 set sip-nat-trace disable
 end
 
 execute reboot
 

The firewall reboot is a requirement. After the firewall reboots I generally disable all the SIP protection profiles from the policy and then make a test call. If it' s still not working you can then try to enable the SIP protection profiles in the policy Hope it helps!

[Sean_Toomey_FTNT]

Thanks for the info neonbit, Generally speaking, the SIP helper should of course not be a problem. Sorry that it has caused you issue. If you don' t mind Mazen, if that change happens to magically solve your issue, could you please open a TAC case so we can grab some debugs? I' d rather see to it that the SIP helper works as expected, and if indeed it' s a SIP helper problem and debugs show a root cause, it' s something that could be fixed not only for you but for the community. My focus is to try to make the product work to it' s best potential. Cheers!

[Bromont_FTNT]

The SIP session helper is turned on by default and typically the first thing TAC will do in these cases is disable it. There should be settings on the PBX for it to ignore headers if the SIP traffic was natted, however if the SIP headers do need translating then applying the VoIP profile (ALG) is the better solution.

[Sean_Toomey_FTNT]

ORIGINAL: Bromont The SIP session helper is turned on by default and typically the first thing TAC will do in these cases is disable it.

Hi Bromont, This is kind of the point I' m trying to make. That particular TAC engineer may choose to disable it because it' s the path of least resistance to get your problem resolved and there is nothing necessarily wrong with that, but I' d really like to see a trouble ticket opened for a deep dive debug and improve the operation of the SIP helper so that it doesn' t need to be disabled. I unfortunately don' t have the means to duplicate this issue myself in my home lab, and I do know of installations where SIP helper is enabled and working as expected, so it clearly is not an issue of it failing 100% of the time. If one of you is having issues where you had to disable the SIP helper, and you are willing to take a few minutes of your time during a maintenance window to help reproduce the problem and debug the issue to see if we can make it work smoothly in a wider range of deployments, that is something I know the community as a whole would appreciate. cheers!

[Bromont_FTNT]

In the vast majority of cases the SIP helper will need to be disabled.. Modern PBX systems are smart enough to not need it... In the event it is needed the SIP ALG (VoIP profile) should be used instead. http://kb.fortinet.com/kb/viewContent.do?externalId=FD31530

[Sean_Toomey_FTNT]

Hi Bromont, If that' s the case, I could make the argument that the SIP helper needs to be disabled by default. Thanks for the info!

[Mark_Oakton]

Hi Mazen Did you get this sorted in the end, if not let us know some details about the setup, what / where the voice switch is, what internet router / connection do you have. There are other issues that can cause 1 way audio if the Fortinet fix doesn' t work Mark

[baitken]

In my case I needed to disable BOTH the SIP helper and ALG on the FortiGate to resolve issues of one-way audio on external phones. In 5.2.x the SIP helper is disabled by default. Blair