Hi FG admins
From this tech tip:
I have this scenario (phones behind NAT):
Did all the required config, and even more:
config system settings
set sip-expectation disable
set sip-nat-trace disable
set default-voip-alg-mode kernel-helper-based
end
config system session-helper
delete 13
end
config voip profile
edit "default"
config sip
set rtp disable
set contact-fixup disable
end
end
...
Played with the above parameters and FG reboot but didn't work. I mean I have this behavior:
In the traffic logs I could see some "TCP reset from server" on SIP connections.
So I'm starting to think that probably on server side must be somehow configured to accept calls from IP phones behind NAT. Anyone knows something about that?
Solved! Go to Solution.
Hi BJ & MB
The issue has been fixed by enabling proxy-based inspection mode in the related firewall rule. All worked just fine after that.
Thanks again to both.
Are you using VOIP profile on firewall policy? If so then SIP traffic is processed by SIP-ALG and you have RTP disabled on your VOIP config which means it will block automatic pinhole creation for SIP traffic.
Thanks for your feedback.
Tried both, using and without using VoIP profile, but got the same result.
Can you share the system config of your firewall.
sh full system settings
or
config system settings
sh full
You can also verify if traffic is processed by SIP or SIP-ALG
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-confirm-if-FortiGate-is-using-SIP-S...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-verify-if-SIP-traffic-is-being-insp...
By default, all SIP traffic is processed by the SIP ALG. If the policy that accepts the SIP traffic includes a VoIP profile, the SIP traffic is processed by that profile. If the policy does not include a VoIP profile, the SIP traffic is processed by the SIP ALG using the default VoIP profile.
https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/147933/sip-alg-and-sip-sessi...
Hi BJ & MB
The issue has been fixed by enabling proxy-based inspection mode in the related firewall rule. All worked just fine after that.
Thanks again to both.
User | Count |
---|---|
2087 | |
1181 | |
770 | |
451 | |
344 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.