Virtual IPs vs SNAT &DNAT

[Daryaya]

Hi everyone,

I’m having trouble configuring SIP on my Fortinet firewall and could use some guidance.

For inbound calls, I receive traffic from an external IP (a.a.a.a) to my server (b.b.b.b). I’ve created a Virtual IP (VIP) to map this to an internal IP (c.c.c.c). Currently, I have two VIPs configured:

• One for SIP signaling on port 5060 (UDP)

• One for RTP traffic on ports 16384–32767 (UDP)

For port 5060, I can see hits on the corresponding VIP. However, for the RTP range, there are no hits at all, and when I place an inbound call, there’s no ringing or audio.

I’ve set up a firewall policy with the source as a.a.a.a and the destination as my two VIPs. The policy only registers hits for port 5060 traffic.

Could someone confirm whether this setup is correct? Or should I instead use DNAT for inbound and SNAT for outbound traffic? I tried running debug commands but didn’t see any traffic being blocked. I also enabled SIP debugging, but I’m not sure what specific indicators I should look for.

Any insights or configuration examples would be greatly appreciated.

Thanks in advance,

[funkylicious]

hi,

have a read at these,

https://community.fortinet.com/t5/FortiGate/Technical-Tip-VOIP-calls-using-SIP/ta-p/193831

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Disabling-VoIP-Inspection/ta-p/194131?exte...

as for recommendations, VIP would be the better option in my opinion, just remember for outbound traffic from c.c.c.c in the firewall rule to enable preserve-source-port and have the same outbound PubIP as for the VIP