Hello,
I have a problem with our customer to get the SIP calls to be function. We disabled the SIP session-helper and rebooted the fortigate. When I run a diagnose command I cannot see any invite messages but I can see the following:
diagnose debug disable diagnose debug reset diagnose debug application sip -1 diagnose debug enable 2015-02-18 10:48:56 sip recvfrom: admin_sock, 150 bytes, 2, 142 2015-02-18 10:48:56 sip not HA NEW STATE, ignore 2015-02-18 10:49:01 sip recvfrom: admin_sock, 129 bytes, 2, 121 2015-02-18 10:49:01 sip not HA NEW STATE, ignore 2015-02-18 10:49:27 sip recvfrom: admin_sock, 76 bytes, 2, 68 2015-02-18 10:49:27 sip not HA NEW STATE, ignore diagnose debug disable
Can anyone tell what do these debug messages say? I expected to not see anyting. But it seems that the FortiGate is still doing something with SIP.
Thank you.
AtiT
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello,
May I know the exact issue for which you have removed the SIP helper? And any specific reason to do so?
I am assuming that there is no need of NAT in your case and hence you deleted the session helper.
Also, Fortigate will not be aware of the RTP pinholes of the voip call when you remove it unless you have applied the SIP ALG.
If you want to completely remove the helper, you will have to apply the below as well:
config system settings set sip-helper disable set sip-nat-trace disable end
Use the following command to display status information about the SIP sessions being processed by the SIP ALG. You can also clear all SIP ALG statistics.
diagnose sys sip-proxy calls list
diagnose sys sip-proxy stats {clear | list} diagnose sys sip-proxy stats diagnose sys sip status diagnose sys sip dialog list diagnose sys sip mapping list
Hi vjoshi,
Thank you for the quick response. All the diagnostics command you wrote shows no SIP processing.
Previously the customer had his local network and network for IP phones direcly connected to the provider's router via his L3 swithces where OSPF took care of the routing. Everithyng was working fine.
The customer has the network 10.10.0.0/16 for servers and local PCs and network 10.13.0.0/16 for IP phones.
The PBX and media gateway is on network 10.10.0.0/16.
Now the traffic has been moved into the FortiGate and the 10.10.0.0/16 network is attached to (let's say) port1 and the IP phones are attached to port2.
There is a firewall policy ALL ALL ANY between the two networks. (in this case no SIP helper is needed - am I correct? I am not sure.)
The guy who is responsible for the PBX said that there is a problem with the SIP communication (one phone is not able to call the other phone) and he wants to disable the SIP helper.
We did it but not helped.
That is the reason why I posted the output from debug to be sure that the FortiGate is not participating in SIP communication and it is only forwarding packets from one port to another and vice-versa.
AtiT
Sorry I forgot: also these were set:
config system settings set sip-helper disable set sip-nat-trace disable end
AtiT
Hello,
1) Where is SIP server hosted?
2) Are the phones getting registered fine?
3) In your setup, do you need natting? Coz, actual RTP media works on the real IP which is present in the SDP header and upstream should be capable of natting the SDP header IP as well
4) Removing the SIP helper doesn't really help if there is a need of NAT
Those commands in my earlier post are mainly for SIP ALG and if they are not returning any output, I am assuming that is no SIP ALG applied.
I would recommend apply the SIP ALG (VOIP profile) on the Firewall policy which is allowing the traffic
Hi,
1) Disable Sip Proxy config system settings set sip-helper disable // by default enabled set sip-nat-trace disable // by default enabled end 2) Disable Sip Session Helper config system session-helper show delete <helper_number> >> delete only SIP Number end 3) A reboot of the Fortigate Unit is Necessary to take the effect 4) Run the below command : config sys global set gui-voip-profile enable end 5) Once the above is done, click on UTM > VOIP > Create New VOIP profile - Name it and do not make any changes If no changes made to the default profile, then you can also use the default voip profile 6) Edit the Firewall policy which passes this traffic - Apply the VOIP profile created in step (4) Please refer the below links to configure SIP VoIP guide Version 4 & 5 http://docs.fortinet.com/fgt/handbook/40mr3/fortigate-voip-sip-40-mr3.pdf
http://docs.fortinet.com/fgt/handbook/50/fortigate-voip-sip-50.pdf
Cheers, Patrick
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1712 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.