SIP/RTP issue - FortiGate 100E

[padraig2392]

Hello,

I was wondering if anyone may be able to assist with an ongoing issue I'm experiencing with a client. The client has an internal PBX system and a SIP trunk from a third party which originally had issues with inbound RTP working. 

I've gone ahead and managed to rectify the problem with inbound RTP not working and audio now works both ways, although it seems the call cuts off around 5 minutes, 33 seconds each time. This issue seems to have only started since the new FortiGate 100E was installed.

The changes I've made were the following:

config system settings

set sip-helper disable

set sip-nat-trace disable

set default-voip-alg-mode kernel-helper based

end

config system session-helper

delete 12 (this was the voip rule) 

end

config voip profile

edit default

config sip

set rtp disable

end

diagnose sys session clear

Any assistance would be much appreciated.

Thanks,

Padraig

[Johan_Lysen]

Hi

We have an 200E 5.6.6 with similar problems. The build in VoIP/SIP/RTP engines is disabled just about the same as you have disabled it.

Incoming RTP Stream is cutoff for a small percentage of our calls.

Sometimes it can start working again during the call

It seems that the "5 min 33 sec into the call" does not apply for our fault. I looked in to one of the examples, and it was around 2 min 10 seconds into the call on that one.

Using Wireshark and mirror ports on our switches we can see that; * For "no reason at all" it stops forwarding RTP packages  * The incoming RTP frames are seen on incoming interface, but not on the outgoing. * When the Sequence Number rollover from 65535 to 0 in the RTP stream, it starts working OK again!

We cannot see any differences with the last few UDP / RTP frames or the first frame that is not forwarded. We have created an Fortigate Ticket today.

[Schmo]

Hi Johan, Did u ever get a resolution or fix to the RTP packets getting dropped?

[kubimike]

Try all these steps

https://vata.com/knowledge-base/disable-sip-alg-fortigate-firewalls/