SIP processing on FortiGate disabled?

[AtiT]

Hello,

I have a problem with our customer to get the SIP calls to be function. We disabled the SIP session-helper and rebooted the fortigate. When I run a diagnose command I cannot see any invite messages but I can see the following:

diagnose debug disable diagnose debug reset diagnose debug application sip -1 diagnose debug enable 2015-02-18 10:48:56 sip recvfrom: admin_sock, 150 bytes, 2, 142 2015-02-18 10:48:56 sip not HA NEW STATE, ignore 2015-02-18 10:49:01 sip recvfrom: admin_sock, 129 bytes, 2, 121 2015-02-18 10:49:01 sip not HA NEW STATE, ignore 2015-02-18 10:49:27 sip recvfrom: admin_sock, 76 bytes, 2, 68 2015-02-18 10:49:27 sip not HA NEW STATE, ignore diagnose debug disable

Can anyone tell what do these debug messages say? I expected to not see anyting. But it seems that the FortiGate is still doing something with SIP.

Thank you.

[vjoshi_FTNT]

Hello,

May I know the exact issue for which you have removed the SIP helper? And any specific reason to do so?

I am assuming that there is no need of NAT in your case and hence you deleted the session helper.

Also, Fortigate will not be aware of the RTP pinholes of the voip call when you remove it unless you have applied the SIP ALG.

If you want to completely remove the helper, you will have to apply the below as well:

config system settings set sip-helper disable set sip-nat-trace disable end

Use the following command to display status information about the SIP sessions being processed by the SIP ALG. You can also clear all SIP ALG statistics.

diagnose sys sip-proxy calls list

diagnose sys sip-proxy stats {clear | list} diagnose sys sip-proxy stats diagnose sys sip status diagnose sys sip dialog list diagnose sys sip mapping list

[AtiT]

Hi vjoshi,

Thank you for the quick response. All the diagnostics command you wrote shows no SIP processing.

Previously the customer had his local network and network for IP phones direcly connected to the provider's router via his L3 swithces where OSPF took care of the routing. Everithyng was working fine.

The customer has the network 10.10.0.0/16 for servers and local PCs and network 10.13.0.0/16 for IP phones.

The PBX and media gateway is on network 10.10.0.0/16.

Now the traffic has been moved into the FortiGate and the 10.10.0.0/16 network is attached to (let's say) port1 and the IP phones are attached to port2.

There is a firewall policy ALL ALL ANY between the two networks. (in this case no SIP helper is needed - am I correct? I am not sure.)

The guy who is responsible for the PBX said that there is a problem with the SIP communication (one phone is not able to call the other phone) and he wants to disable the SIP helper.

We did it but not helped.

That is the reason why I posted the output from debug to be sure that the FortiGate is not participating in SIP communication and it is only forwarding packets from one port to another and vice-versa.

[AtiT]

Sorry I forgot: also these were set:

config system settings set sip-helper disable set sip-nat-trace disable end

[vjoshi_FTNT]

Hello,

1) Where is SIP server hosted?

2) Are the phones getting registered fine?

3) In your setup, do you need natting? Coz, actual RTP media works on the real IP which is present in the SDP header and upstream should be capable of natting the SDP header IP as well

4) Removing the SIP helper doesn't really help if there is a need of NAT

Those commands in my earlier post are mainly for SIP ALG and if they are not returning any output, I am assuming that is no SIP ALG applied.

I would recommend apply the SIP ALG (VOIP profile) on the Firewall policy which is allowing the traffic

[patrick_z]

Hi,

1) Disable Sip Proxy config system settings set sip-helper disable // by default enabled set sip-nat-trace disable // by default enabled end 2) Disable Sip Session Helper config system session-helper show delete <helper_number> >> delete only SIP Number end 3) A reboot of the Fortigate Unit is Necessary to take the effect 4) Run the below command : config sys global set gui-voip-profile enable end 5) Once the above is done, click on UTM > VOIP > Create New VOIP profile - Name it and do not make any changes If no changes made to the default profile, then you can also use the default voip profile 6) Edit the Firewall policy which passes this traffic - Apply the VOIP profile created in step (4) Please refer the below links to configure SIP VoIP guide Version 4 & 5 http://docs.fortinet.com/fgt/handbook/40mr3/fortigate-voip-sip-40-mr3.pdf

http://docs.fortinet.com/fgt/handbook/50/fortigate-voip-sip-50.pdf

Cheers, Patrick