VOIP Phones (SOLVED)

[#1]

I can' t get my VOIP phones to work behind my FortiGate 60B Firewall. My unit is in Nat/Route mode and the firmware version is: Fortigate-60B 3.00-b0668(MR6 Patch 2) I have my 2 VOIP phones connected to the internal network and they are getting a DHCP IP Address. I have a firewall policy from internal to external and the service is set to ANY and the action is set to ACCEPT. I also have the NAT box checked. I have the same policy set from External to internal. Any ideas why my VOIP phones don' t work? I get Network Error. They work when they are behind a Linksys router with no blocking.

[UkWizard]

Are you using SIP? if so, perhaps this might apply to you; http://kc.forticare.com/default.asp?id=3546&SID=&Lang=1 Here is a lot of useful voip info as well; http://kc.forticare.com/default.asp?id=1085&SID=&Lang=1

[#3]

ok I got the phone to work, well partially. I can make out going calls but I cannot hear the person on the other end of the call. They can hear me but I can' t hear them. Any ideas what' s blocking what?

[#4]

I tried the first link gives you the command to disable the sip helper using the CLI. I have a question, I logged into my UNIT using the webmanager and within there I connected to it using the CLI Console and I ran the command but it didn' t give me any confirmation that it disable the SIP helper etc. Should I get some kind of confirmation saying it was disabled? Also is connecting from the webmanager and logging into the unit then connected through the CLI console that is withing the web manager is the same and using hyperterminal to connect from a serial port on my computer to the console on the unit via the cable provided is the samething?

[red_adair]

1st you may try to search this forum for SIP - there has been lots of talking already... 2nd: the short guide to SIP success. - create a FW rule with SIP allowed (udp || tcp 5060) - attach a protection profile to it that has " SIP checkbox" ticked on (under the respective VoIP section) - you don' t need need " session helper" so you may disable them. The SIP-Protectionprofile is a much more advanced version of a " session helper" - make sure you have no " STUN" or so enabled on the phone. - You should install the brand new MR7 as it includes some SIP enhancements that may apply in your case (or not). - If you use the services from " Sipgate" you must use MR7.

[#6]

I solved my problem. I created a VIP and mapped it to the phone internal IP Address and that solved my issue. Now I can hear the person on the other end of the line. I think it will work if you map the ports your phone is using to it' s IP Address.