VoIP quality issues

[Tech-co]

Hello,

I have issues with the conversation quality. We used FG 300D and there was interrupts in the call, but not that much. After migrating to FG 400E and updating to FortiOS 7.2 from 6.4 the quality of calls is terrible. IP phones are W52P base connecting to a cloud SIP. 

Before all W52 bases was on the same VLAN as the computers, now they are separated in different VLANs.

Tests that have been made:
All bases moved to the same ISP but different IP address with just a router and they work perfect. A few bases left behind FG so we can make test to resolve the problem.

 When a call is made between one phone behind FG and one behind the router, FG phone send audio perfect and router phone hears everything, but FG phone receives audio with a lot of interrupts.

The setup:
ISP cable is in MGMT port and there are configured ISP addresses
Port 1 is going to a management switch.

On port 1 we have created VLANs. One for computer, one for servers and one for VoIP.

VoIP setup is:

config system interface
 edit "voice_vlan"
  set vdom "root"
  set ip 10.20.100.1 255.255.255.0
  set allowaccess ping
  set vlanforward enable  - this one was set few days ago to see if it will make a difference
  set role lan
  set snmp-index 88
  set interface "port1"
  set vlanid 100
 next
end

Policy for internet. The service is set to ALL on purpose. If it is only SIP the phones are not working. They need dns port, a custom port for vpn, and a lot of random ports when a call is made

config firewall policy
 edit 100
  set name "voice_vlan_net"
  set uuid 273696e2-c3da-51ed-4ab7-4178529a62b5
  set srcintf "voice_vlan"
  set dstintf "mgmt"
  set action accept
  set srcaddr "voice_vlan address"
  set dstaddr "all"
  set schedule "always"
  set service "ALL"
  set utm-status enable
  set inspection-mode proxy
  set ssl-ssh-profile "Clone of no-inspection"
  set voip-profile "default"
  set logtraffic disable
  set nat enable
 next
end

 Made traffic shaper with guaranteed bandwidth 80Mbps and high traffic priority.

VoIP profile

config voip profile
  edit "default"
   set comment "Default VoIP profile."
   config sip
     set strict-register disable
   end
 next
end

 SSL inspection profile

config firewall ssl-ssh-profile
 edit "Clone of no-inspection"
  set comment "Read-only profile that does no inspection."
 config https
  set ports 443
  set status certificate-inspection
  set unsupported-ssl-version allow
  set expired-server-cert allow
  set cert-validation-failure allow
 end
 config ftps
  set status disable
  set unsupported-ssl-version allow
  set expired-server-cert allow
  set cert-validation-failure allow
 end
 config imaps
  set status disable
  set unsupported-ssl-version allow
  set expired-server-cert allow
  set cert-validation-failure allow
 end
 config pop3s
  set status disable
  set unsupported-ssl-version allow
  set expired-server-cert allow
  set cert-validation-failure allow
 end
 config smtps
  set status disable
  set unsupported-ssl-version allow
  set expired-server-cert allow
  set cert-validation-failure allow
 end
 config ssh
  set ports 22
  set status disable
 end
 config dot
  set status disable
  set expired-server-cert allow
  set cert-validation-failure allow
 end
 set block-blocklisted-certificates disable
 set ssl-anomaly-log disable
 next
end

 Session-helper is removed as one technical tip here says and 

set default-voip-alg-mode kernel-helper-based

 If there is some other info that I can provide tell me. Would be nice to resolve this and move all phones behind FG and not to waste an entire IP address only for phones.

[gfleming]

Why is your ISP connected to your MGMT port?

There is no hardware acceleration on the MGMT ports. You will be using the very low-powered CPU to process all traffic on the FortiGate.

Please use one of the main ports that have ASIC connections for your ISP.

https://docs.fortinet.com/document/fortigate/6.4.12/hardware-acceleration/655120/fortigate-300d-fast...

https://docs.fortinet.com/document/fortigate/6.4.12/hardware-acceleration/75781/fortigate-400e-and-4...

[Tech-co]

Hello,
Thank you for your reply. This explains a lot, I will preconfigure it in the next days.

This is how I found it configured from the previous team, when migrating I was wondering why is this port used for ISP, but left it this way.