Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Tech-co
New Contributor

VoIP quality issues

Hello,

I have issues with the conversation quality. We used FG 300D and there was interrupts in the call, but not that much. After migrating to FG 400E and updating to FortiOS 7.2 from 6.4 the quality of calls is terrible. IP phones are W52P base connecting to a cloud SIP. 

Before all W52 bases was on the same VLAN as the computers, now they are separated in different VLANs.

Tests that have been made:
All bases moved to the same ISP but different IP address with just a router and they work perfect. A few bases left behind FG so we can make test to resolve the problem.

 When a call is made between one phone behind FG and one behind the router, FG phone send audio perfect and router phone hears everything, but FG phone receives audio with a lot of interrupts.

The setup:
ISP cable is in MGMT port and there are configured ISP addresses
Port 1 is going to a management switch.

On port 1 we have created VLANs. One for computer, one for servers and one for VoIP.

VoIP setup is:

config system interface
edit "voice_vlan"
set vdom "root"
set ip 10.20.100.1 255.255.255.0
set allowaccess ping
set vlanforward enable - this one was set few days ago to see if it will make a difference
set role lan
set snmp-index 88
set interface "port1"
set vlanid 100
next
end

Policy for internet. The service is set to ALL on purpose. If it is only SIP the phones are not working. They need dns port, a custom port for vpn, and a lot of random ports when a call is made

config firewall policy
edit 100
set name "voice_vlan_net"
set uuid 273696e2-c3da-51ed-4ab7-4178529a62b5
set srcintf "voice_vlan"
set dstintf "mgmt"
set action accept
set srcaddr "voice_vlan address"
set dstaddr "all"
set schedule "always"
set service "ALL"
set utm-status enable
set inspection-mode proxy
set ssl-ssh-profile "Clone of no-inspection"
set voip-profile "default"
set logtraffic disable
set nat enable
next
end

 Made traffic shaper with guaranteed bandwidth 80Mbps and high traffic priority.

VoIP profile

config voip profile
edit "default"
set comment "Default VoIP profile."
config sip
set strict-register disable
end
next
end

 SSL inspection profile

config firewall ssl-ssh-profile
edit "Clone of no-inspection"
set comment "Read-only profile that does no inspection."
config https
set ports 443
set status certificate-inspection
set unsupported-ssl-version allow
set expired-server-cert allow
set cert-validation-failure allow
end
config ftps
set status disable
set unsupported-ssl-version allow
set expired-server-cert allow
set cert-validation-failure allow
end
config imaps
set status disable
set unsupported-ssl-version allow
set expired-server-cert allow
set cert-validation-failure allow
end
config pop3s
set status disable
set unsupported-ssl-version allow
set expired-server-cert allow
set cert-validation-failure allow
end
config smtps
set status disable
set unsupported-ssl-version allow
set expired-server-cert allow
set cert-validation-failure allow
end
config ssh
set ports 22
set status disable
end
config dot
set status disable
set expired-server-cert allow
set cert-validation-failure allow
end
set block-blocklisted-certificates disable
set ssl-anomaly-log disable
next
end

 Session-helper is removed as one technical tip here says and 

set default-voip-alg-mode kernel-helper-based

 If there is some other info that I can provide tell me. Would be nice to resolve this and move all phones behind FG and not to waste an entire IP address only for phones.

 

2 REPLIES 2
gfleming
Staff
Staff

Why is your ISP connected to your MGMT port?

There is no hardware acceleration on the MGMT ports. You will be using the very low-powered CPU to process all traffic on the FortiGate.


Please use one of the main ports that have ASIC connections for your ISP.

 

https://docs.fortinet.com/document/fortigate/6.4.12/hardware-acceleration/655120/fortigate-300d-fast...

 

https://docs.fortinet.com/document/fortigate/6.4.12/hardware-acceleration/75781/fortigate-400e-and-4...

Cheers,
Graham
Tech-co

Hello,
Thank you for your reply. This explains a lot, I will preconfigure it in the next days.

This is how I found it configured from the previous team, when migrating I was wondering why is this port used for ISP, but left it this way.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors