Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
AEK
SuperUser
SuperUser

SIP and NAT

Hi FG admins

 

From this tech tip:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Most-common-cases-of-SIP-implementation/ta...

 

I have this scenario (phones behind NAT):

 

Did all the required config, and even more:

config system settings
set sip-expectation disable
set sip-nat-trace disable
set default-voip-alg-mode kernel-helper-based
end

config system session-helper
delete 13
end

config voip profile
edit "default"
config sip
set rtp disable
set contact-fixup disable
end
end

...

 

Played with the above parameters and FG reboot but didn't work. I mean I have this behavior:

  • Calling from internal IP phone to external mobile cell phone (GSM): It rings but no voice
  • Calling from internal IP phone to internal IP phone: IP phone doesn't even ring

In the traffic logs I could see some "TCP reset from server" on SIP connections.

So I'm starting to think that probably on server side must be somehow configured to accept calls from IP phones behind NAT. Anyone knows something about that?

AEK
AEK
1 Solution
AEK
SuperUser
SuperUser

Hi BJ & MB

The issue has been fixed by enabling proxy-based inspection mode in the related firewall rule. All worked just fine after that.

Thanks again to both.

AEK

View solution in original post

AEK
5 REPLIES 5
BJ_Prakash_Ghising
New Contributor II

Are you using VOIP profile on firewall policy? If so then SIP traffic is processed by SIP-ALG and you have RTP disabled on your VOIP config which means it will block automatic pinhole creation for SIP traffic.

 

AEK

Thanks for your feedback.

Tried both, using and without using VoIP profile, but got the same result.

AEK
AEK
BJ_Prakash_Ghising

Can you share the system config of your firewall. 

 

sh full system settings

or 

config system settings

sh full

 

You can also verify if traffic is processed by SIP or SIP-ALG

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-confirm-if-FortiGate-is-using-SIP-S...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-verify-if-SIP-traffic-is-being-insp...

 

MZBZ
Staff
Staff

By default, all SIP traffic is processed by the SIP ALG. If the policy that accepts the SIP traffic includes a VoIP profile, the SIP traffic is processed by that profile. If the policy does not include a VoIP profile, the SIP traffic is processed by the SIP ALG using the default VoIP profile.
https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/147933/sip-alg-and-sip-sessi...

 

M. B.
AEK
SuperUser
SuperUser

Hi BJ & MB

The issue has been fixed by enabling proxy-based inspection mode in the related firewall rule. All worked just fine after that.

Thanks again to both.

AEK
AEK
Announcements
Check out our Community Chatter Blog! Click here to get involved
Labels
Top Kudoed Authors