SIP Issues and Tips

[maysobano]

Hello Everyone,

We are currently working for a pretty “gigantic” client in the Middle East, whose final request is to route, and apply security policies to the Customer support department before we finish the implementation and contract.

I dont have any experience with routing networks with heavy SIP usage through firewalls, especially NGFW with security features enabled. Now, the technical part… So the branch office has it’s own 100G box, which is not connected via SDwan and will not be since it is completely separated by the main network. The end-user devices will pass through the firewall, while the Cisco call manager servers will remain routed via the dedicated router. The end user devices have a “virtual phone” installed, and communicate with these servers to provide support to customers. Judging by the numerous issues we have encountered with more sensitive protocols, we suspect SIP will be the same. I want to ask you, fellow members, for any tips, tricks and guides you can provide to ensure this process goes as smooth as possible. Any help would be greatly appreciated. Troubleshooting tips or guides would be very helpful as well.

I want to thank everyone in advance for your help!!

[kaman]

Hi maysobano,

There are three scenarios in which the FortiOS session initiation protocol (SIP) solution is usually deployed:

> The SIP server is in a private network that is protected from the internet by a FortiGate.
> The SIP clients are in a private network that is protected from the internet by a FortiGate.
> The SIP server is in a private network, such as a corporation's internal network or an ISP’s network, that is protected from the internet by a FortiGate. The SIP clients are in a remote private network, such as a SOHO network, and behind a NAT device that is not aware of SIP applications.

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/858887/voip-solutions

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/667795/general-use-cases

++ You can refer to the document below, which provides a full list of resources that can be used to configure and troubleshoot SIP and VoIP on FortiGate:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-VoIP-and-SIP-configuration-and-troubleshoo...

++ Additionally, please refer to the document below for a list of useful SIP-related commands:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SIP-useful-Commands/ta-p/195289

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards,
Aman

[hooram95]

Yeah, SIP over NGFW can definitely get tricky, especially with security features on, so make sure SIP ALG and inspection behavior are tuned carefully or even disabled if they cause issues. Clear logging, proper port handling, and testing call flows early will save a lot of pain when things go live.