Hello,
I have issues with the conversation quality. We used FG 300D and there was interrupts in the call, but not that much. After migrating to FG 400E and updating to FortiOS 7.2 from 6.4 the quality of calls is terrible. IP phones are W52P base connecting to a cloud SIP.
Before all W52 bases was on the same VLAN as the computers, now they are separated in different VLANs.
Tests that have been made:
All bases moved to the same ISP but different IP address with just a router and they work perfect. A few bases left behind FG so we can make test to resolve the problem.
When a call is made between one phone behind FG and one behind the router, FG phone send audio perfect and router phone hears everything, but FG phone receives audio with a lot of interrupts.
The setup:
ISP cable is in MGMT port and there are configured ISP addresses
Port 1 is going to a management switch.
On port 1 we have created VLANs. One for computer, one for servers and one for VoIP.
VoIP setup is:
config system interface
edit "voice_vlan"
set vdom "root"
set ip 10.20.100.1 255.255.255.0
set allowaccess ping
set vlanforward enable - this one was set few days ago to see if it will make a difference
set role lan
set snmp-index 88
set interface "port1"
set vlanid 100
next
end
Policy for internet. The service is set to ALL on purpose. If it is only SIP the phones are not working. They need dns port, a custom port for vpn, and a lot of random ports when a call is made
config firewall policy
edit 100
set name "voice_vlan_net"
set uuid 273696e2-c3da-51ed-4ab7-4178529a62b5
set srcintf "voice_vlan"
set dstintf "mgmt"
set action accept
set srcaddr "voice_vlan address"
set dstaddr "all"
set schedule "always"
set service "ALL"
set utm-status enable
set inspection-mode proxy
set ssl-ssh-profile "Clone of no-inspection"
set voip-profile "default"
set logtraffic disable
set nat enable
next
end
Made traffic shaper with guaranteed bandwidth 80Mbps and high traffic priority.
VoIP profile
config voip profile
edit "default"
set comment "Default VoIP profile."
config sip
set strict-register disable
end
next
end
SSL inspection profile
config firewall ssl-ssh-profile
edit "Clone of no-inspection"
set comment "Read-only profile that does no inspection."
config https
set ports 443
set status certificate-inspection
set unsupported-ssl-version allow
set expired-server-cert allow
set cert-validation-failure allow
end
config ftps
set status disable
set unsupported-ssl-version allow
set expired-server-cert allow
set cert-validation-failure allow
end
config imaps
set status disable
set unsupported-ssl-version allow
set expired-server-cert allow
set cert-validation-failure allow
end
config pop3s
set status disable
set unsupported-ssl-version allow
set expired-server-cert allow
set cert-validation-failure allow
end
config smtps
set status disable
set unsupported-ssl-version allow
set expired-server-cert allow
set cert-validation-failure allow
end
config ssh
set ports 22
set status disable
end
config dot
set status disable
set expired-server-cert allow
set cert-validation-failure allow
end
set block-blocklisted-certificates disable
set ssl-anomaly-log disable
next
end
Session-helper is removed as one technical tip here says and
set default-voip-alg-mode kernel-helper-based
If there is some other info that I can provide tell me. Would be nice to resolve this and move all phones behind FG and not to waste an entire IP address only for phones.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Why is your ISP connected to your MGMT port?
There is no hardware acceleration on the MGMT ports. You will be using the very low-powered CPU to process all traffic on the FortiGate.
Please use one of the main ports that have ASIC connections for your ISP.
Hello,
Thank you for your reply. This explains a lot, I will preconfigure it in the next days.
This is how I found it configured from the previous team, when migrating I was wondering why is this port used for ISP, but left it this way.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1679 | |
1085 | |
752 | |
446 | |
226 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.