VoIP Issues Fortigate 60B

[mcuhan]

We have a hosted VoIP system and over the last few days, we can no longer complete a phone call. Both incoming and outgoing calls end after 20 seconds. Additionally, we sometimes receive a quick busy signal. We use SilverSky to manage our Fortigate 60B device and they tell me that the SIP traffic is going through the device as cleanly as possible. I trust they know the proper configuration to allow SIP traffic. My Fortigate 60B is in NAT mode and running v.4.0 firmware. Here are my symptoms; 1) Incoming calls ring through multiple times and don' t quit, even if the incoming caller hangs up. Likewise on an outgoing call, when the call drops after 20 seconds, the phone handset timer continues to tick and the call doesn' t terminate. 2) Sometimes incoming calls never ring, after a pause of silence, the voicemail on the handset just picks up. 3) Sometimes on outgoing calls, a quick busy signal is returned. 4) Note - I do have one VoIP phone plugged directly into our DSL modem and works just fine. Our VoIP provider, Nextera, has been worthless with any support. Thanks for any input. Matt

[emnoc]

Will you will need to provide diagnostics but for starters; Q: 1: has anybody conduct pcap or diag debug flow 2: has this ever worked correctly 3:( if #2 is a yes ) have you recently added new policies or upgrade the unit 4: what exact v4 build are you running 5: what' s the status of the ALG FWIW and in my experience one-way audio or no audio, is a fwpolicy issues or ALG issue lack of call control is typically Soft-PBX related or firewallpolicy or authentication and the registering of devices A 20sec call drop is typically related to the count-down timer and the called party not ACk' ing in the 20sec window What you need to do is to lean into SilverSky and have them provide you the diagnostics. I heard good and bad things about them, but if they are managing the device(s), they should be able to identify the problem(s). The same is said of the VoIP. The IP phone provider has the best means to assist from the Soft Switch with logs, traces and debugs. fwiw, here fortinet KB on how to identify the ALG status; http://kb.fortinet.com/kb/viewContent.do?externalId=FD31530

[mcuhan]

Thank you for the information. I' ve answered some of your questions below. The VoIP provider has been next to worthless because we' re not on their " managed" service line. We run over the public pipe but has been just fine since we started. Where can I get the diagnostics from? SilverSky or my VoIP provider? Who can do the PCAP or diag debug flow from? Q: 1: has anybody conduct pcap or diag debug flow - Not sure 2: has this ever worked correctly - Yes - has worked the better part of 14 months. 3:( if #2 is a yes ) have you recently added new policies or upgrade the unit - no. 4: what exact v4 build are you running - v4.0, build0672, 130904 (MR3 Patch 15) 5: what' s the status of the ALG - SIP ALG is disabled FWIW and in my experience one-way audio or no audio, is a fwpolicy issues or ALG issue lack of call control is typically Soft-PBX related or firewallpolicy or authentication and the registering of devices A 20sec call drop is typically related to the count-down timer and the called party not ACk' ing in the 20sec window What you need to do is to lean into SilverSky and have them provide you the diagnostics. I heard good and bad things about them, but if they are managing the device(s), they should be able to identify the problem(s). The same is said of the VoIP. The IP phone provider has the best means to assist from the Soft Switch with logs, traces and debugs. fwiw, here fortinet KB on how to identify the ALG status; http://kb.fortinet.com/kb/viewContent.do?externalId=FD31530

[emnoc]

Your managed security or voip provider , should have away to get the pcap going. You might be able to span/mirror/tap a port on the outside wan and capture traffic also fwiw; If your VoIP provider can' t assist you due to your account-type, than you have the following choices; 1: upgrade your account 2: or move to another provider :) If nothing changed on the FGT60B, than I would think the VoIP has some issues. What have you asked from Sliversky in support of the diagnostics? fwiw: Gathering a pcap of traffic to the sPBX and analyzing it thru wireshark and the SIP decoders, would be my 1st step.

[shehan8787_]

Hi Mcuhan,

I have the same exact issue.. Did you find a solution for this..

The issue happens only when I plug the Fortigate 90D in between the Router and the Core Switch...

I've also opened a TAC case with Fortinet regarding this but the TAC Engineer couldn't find the issue either (He was too lazy to investigate the issue). He has requested for remote sessions on two days, and leaves in middle of the session saying that his working hours are over.. :(

Since we are a 24*7 call center we can't schedule down times whenever he requests.. So, the case is still open, but no solution..

Our PABX is in the cloud. The steps of events happen on the phones are as follows..

0. Put the Fortigate 90D in between the router and the Core switch.

1. All phones starts to register with the PABX which is in the cloud. 2. Some phones can take outbound calls and local calls between the LAN. Some phones can only take local calls. 3. After 2, 3 minutes, one by one, the phones becoming unable to take calls. 4. After about 10 minutes, phones starts to unregister from the PABX (Registration fails). 5. After about 30 minutes, all the phones are unable to register with the PABX..

Please update the ticket if you've found any solution for this...

[mcuhan]

We never found a solution. Had to revert to a copper line.

[nn]

config voip profile edit default config sip set status disable end end config system settings set sip-helper disable set sip-nat-trace disable end config voip profile edit default config sip set rtp disable end end config system session-helper show delete 12 (whatever sip is) end reboot the device (firewall)

Also run ALG tests from here to ensure ALG isnt enabled on soemthing:

http://thec0de.com/sip-alg-tester/

I havent tried that one, but its better than using the online one that requires Java installed :\