SIP ALG RTP Issue

[Anthrondo]

Hey All, I have had sip trunks up and running over the fortigate for a few months, but i' m having some issue still that I cannot seem to resolve up to his point. It seemed at times that users would experience one way audio issues as well as problems with trunk to trunk transfers. If a customer calls in from wireless phone A to a DID and I answer it internally on Mitel phone it works. If I pickup the call on my cell phone using the twining feature from the Mitel I have serious audio issues. Also, even on normal calls I regularly have 1 way audio issues. I have worked with Mitel and performed packet captures and what we are finding is that the Fortigate is blocking the RTP stream. I have 1 inbound firewall policy using the SIP ALG, service set to ANY and a VIP configured for port forwarding UDP 5060. I also have 1 outbound firewall policy with proper NAT but it isn' t used at all since it has a matching inbound/wan->internal policy that the traffic uses. I have read that there are issues with Fortinet' s ALG, Port Forwarding, and SIP Session Helper or issues with the combination of these. Any ideas on what could be causing these problems? Thanks in advance.

[Wenlong_Qin_FTNT]

Hi All, I have done some tests to run SIP trunk over FortiGate. There is no any one way audio issue. If you have any one way audio issue over FortiGate, please try following configurations on FortiGate: config system session-helper show edit 20 set name sip set port 5060 set protocol 17 next delete 20 end config system settings set sip-helper disable set sip-nat-trace disable end config firewall address edit " all" next end config voip profile edit " voip_1" config sip set hosted-nat-traversal enable set hnt-restrict-source-ip enable end next end config firewall policy edit 1 set srcintf " internal" set dstintf " wan1" set srcaddr " all" set dstaddr " all" set action accept set utm-status enable set schedule " always" set service " ANY" set voip-profile " voip_1" set nat enable next edit 2 set srcintf " wan1" set dstintf " internal" set srcaddr " all" set dstaddr " all" set action accept set utm-status enable set schedule " always" set service " ANY" set voip-profile " voip_1" set nat enable next end Thanks, Wenlong Qin

[Anthrondo]

I did see some new stuff in your configuration, but I see an immediate red flag which is your wan1->internal policy. you are not using a static nat/vip, or sourcing the nat table so how are you pointing to your PBX on this policy? you aren' t so I don' t see how this could have possibly been a valid test. If you were to use a static nat, would you use port forwarding for 5060 or just send all traffic to the pbx and not filter any services?

[Anthrondo]

I followed your directions to the T with no avail. If I call in from cellphone a through firewall to internal phone a, which is forwarded to cellphone b through firewall i get one way audio. however, if i set no-sdp-fixup enabled in the voip_1 profile the trunk to trunk calls are working for the first time, but it breaks regular outbound and inbound calls.

[Wenlong_Qin_FTNT]

Hi, I did not use VIP with port forwarding UDP 5060. If you want to use port forwarding, you have to enable all UDP ports because RTP port will not use 5060. Thanks, Wenlong