I have issues with the conversation quality. We used FG 300D and there was interrupts in the call, but not that much. After migrating to FG 400E and updating to FortiOS 7.2 from 6.4 the quality of calls is terrible. IP phones are W52P base connecting to a cloud SIP.
Before all W52 bases was on the same VLAN as the computers, now they are separated in different VLANs.
Tests that have been made: All bases moved to the same ISP but different IP address with just a router and they work perfect. A few bases left behind FG so we can make test to resolve the problem.
When a call is made between one phone behind FG and one behind the router, FG phone send audio perfect and router phone hears everything, but FG phone receives audio with a lot of interrupts.
The setup: ISP cable is in MGMT port and there are configured ISP addresses Port 1 is going to a management switch.
On port 1 we have created VLANs. One for computer, one for servers and one for VoIP.
VoIP setup is:
config system interface edit "voice_vlan" set vdom "root" set ip 10.20.100.1 255.255.255.0 set allowaccess ping set vlanforward enable - this one was set few days ago to see if it will make a difference set role lan set snmp-index 88 set interface "port1" set vlanid 100 next end
Policy for internet. The service is set to ALL on purpose. If it is only SIP the phones are not working. They need dns port, a custom port for vpn, and a lot of random ports when a call is made
config firewall policy edit 100 set name "voice_vlan_net" set uuid 273696e2-c3da-51ed-4ab7-4178529a62b5 set srcintf "voice_vlan" set dstintf "mgmt" set action accept set srcaddr "voice_vlan address" set dstaddr "all" set schedule "always" set service "ALL" set utm-status enable set inspection-mode proxy set ssl-ssh-profile "Clone of no-inspection" set voip-profile "default" set logtraffic disable set nat enable next end
Made traffic shaper with guaranteed bandwidth 80Mbps and high traffic priority.
config voip profile edit "default" set comment "Default VoIP profile." config sip set strict-register disable end next end
SSL inspection profile
config firewall ssl-ssh-profile edit "Clone of no-inspection" set comment "Read-only profile that does no inspection." config https set ports 443 set status certificate-inspection set unsupported-ssl-version allow set expired-server-cert allow set cert-validation-failure allow end config ftps set status disable set unsupported-ssl-version allow set expired-server-cert allow set cert-validation-failure allow end config imaps set status disable set unsupported-ssl-version allow set expired-server-cert allow set cert-validation-failure allow end config pop3s set status disable set unsupported-ssl-version allow set expired-server-cert allow set cert-validation-failure allow end config smtps set status disable set unsupported-ssl-version allow set expired-server-cert allow set cert-validation-failure allow end config ssh set ports 22 set status disable end config dot set status disable set expired-server-cert allow set cert-validation-failure allow end set block-blocklisted-certificates disable set ssl-anomaly-log disable next end
Session-helper is removed as one technical tip here says and
set default-voip-alg-mode kernel-helper-based
If there is some other info that I can provide tell me. Would be nice to resolve this and move all phones behind FG and not to waste an entire IP address only for phones.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.