SIP Issues and Tips

[kirdovada]

Hello Everyone,

We are currently working for a pretty “gigantic” client in the Middle East, whose final request is to route, and apply security policies to the Customer support department before we finish the implementation and contract.

I dont have any experience with routing networks with heavy SIP usage through firewalls, especially NGFW with security features enabled. Now, the technical part… So the branch office has it’s own 100G box, which is not connected via SDwan and will not be since it is completely separated by the main network. The end-user devices will pass through the firewall, while the Cisco call manager servers will remain routed via the dedicated router. The end user devices have a “virtual phone” installed, and communicate with these servers to provide support to customers. Judging by the numerous issues we have encountered with more sensitive protocols, we suspect SIP will be the same. I want to ask you, fellow members, for any tips, tricks and guides you can provide to ensure this process goes as smooth as possible. Any help would be greatly appreciated. Troubleshooting tips or guides would be very helpful as well.

I want to thank everyone in advance for your help!!

[Yurisk]

Hi, SIP is old enough of a protocol for Fortinet to take care of it, so no expected troubles are in line.  If there are some issues, 99% of them are solved by disabling SIP ALG - Application level proxy for all traffic SIP. It is enabled by default and does a lot of security checks on passing SIP protocol, additionally to just dynamically opening RTP ports in incoming direction. And many SIP softphones/Call managers fail these security checks. In highly secure environment it is reasonable to leave it enabled and debug specific issues, as using VIOP profiles you have flexibility (to some extent) what security checks to enable/disable. But in a regular ENT environment (i.e. not CIA/Mossad/FSB) disabling SIP ALG prevents any head ache with SIP, so we do it by default for our clients unless they specifically request not to. The SIP traffic is still being processed by FGT, with ALG disabled, but it only opens dynamic incoming ports for RTP by looking at SIP messages. 

Here is to start: 

• https://community.fortinet.com/t5/FortiGate/Technical-Tip-SIP-useful-Commands/ta-p/195289
• https://community.fortinet.com/t5/FortiGate/Technical-Tip-Disabling-VoIP-Inspection/ta-p/194131