SIP Phone problem

[#1]

I' m trying to configure a a Fortigate 30B in an office with 6 SIP phones. Without it on the line, they all work normally, once I put it in, with policies configured to explicitly allow traffic out from them and in from the server they communicate with we get the following problems: Taking a call off of hold results in the person on each side being able to hear themselves, but no other the other person on the call. Putting them on hold and taking them off again returns the call two normal. Also, for one of the incoming lines, only one phone seems to answer properly, the others cannot hear anything unless they hit the hold button four times (basically put the person on hold twice) after which it seems to work normally. Also, I created a protection profile that specifies VoIP logging on each of the firewall policies, but no logging information is showing up. I had it set in NAT mode at first, but then switched to transparent mode when I discovered that we already had a fully NATed range. I' ve searched all manner of documentation, but can' t seem to find any suggestion of what might need to be configured properly. Right now the Policy specifically allows any external comminication on 5060 and 5061 to the IP addresses of the phones (5060 using the default SIP protocol setting) and all outbound connections the phones make on the same. It also allows all incoming connections from the external SIP server. -Karl

[#2]

Has anyone been able to resolve this issue ? I too am seeing similar issues with a new 60B and I can see 2 other threads with similar issues to the OP

[#3]

This solution from the support team worked. Basically, you need to locate and manually remove the SIP session helper; the single line disable command isn' t sufficient to turn it off: 1. display sip session helper: sh sys session-helper, the output would be like below: config system session-helper ..... edit 12 set name sip set port 5060 set protocol 17 next ..... end 2. remove sip session-helper conf sys session-helper delete 12 end Note removing sip session helper only take effect for new created sessions, existing session still have helper applied, so we need to proceed with step 3 to clear existing sip sessions and make phone to re-register. 3.identify any sip related sessions, in GUI: System > Status> Sessions [Details] > filter on destination port 5060. And clear all the existing sip sessions.

[#4]

Thx. New to the fortinet line. I wish it was documented more thoroughly, either in the pdf, the cmd line manual or just online in their knowledgebase. I had to go digging to find out the command on how to set interface speeds, and it was pure luck that I was going through a thread on the fortinet KB, did I find it. Even a simple keyword search like duplex interface would not pull up the info via the search engine.