Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
teo-en-ming
New Contributor

Yeastar S20 PBX behind Fortigate 60F firewall. Linkus softphone has no audio at all during telephone

Subject: Yeastar S20 PBX behind Fortigate 60F firewall. Linkus softphone has no audio at all during telephone calls.
 
Good day from Singapore,
 
The Linkus softphone installed on Android phones has no audio at all during telephone calls. We were troubleshooting for a few days. We have tested countless settings in both the Fortigate 60F firewall and Yeastar S20 PBX appliance. But we could not solve the issue.
 
Then a breakthrough occurred when I noticed that when I make a telephone call using Linkus softphone on my Android phone, RTP packets were being sent. ***But no RTP packets were received.*** This implies that the Fortigate 60F firewall were blocking RTP packets.
 
I did a Google search and found this article.
 
Article: Technical Tip: Disabling VoIP Inspection
 
You need to ensure that ALL of the following lines are present in the Fortigate 60F firewall CLI configuration.
 
config voip profile
edit default
config sip
    set status disable
end
end
end
 
The one line that I have added is: "set status disable".
 
After adding the above line, telephone calls on Linkus softphone started to have audio both ways.
 
I have solved the problem! (At 3.00 AM on 7 Oct 2023 Saturday morning Singapore time)
 
I hope that the above information is useful to you. I don't know why adding the line "set status disable" to the voip profile solved the problem. I didn't read the above article thoroughly from start to finish. Perhaps someone else can explain.
 
Thank you.
 
Regards,
 
Mr. Turritopsis Dohrnii Teo En Ming
Targeted Individual in Singapore
9 Oct 2023 Monday
1 REPLY 1
xsilver_FTNT
Staff
Staff

Hello @teo-en-ming 

 

Well, instead of using FortiOS capabilities to do some protective magic on SIP you simply disabled all of that.

 

By default FortiOS do have two tools to handle SIP, and some other VoIP protocols as well, but let's focus on SIP alone.

 

1. SIP Session Helper

- old, deprecated, but fast solution via "config system session-helper" kernel module, which is also a bit insecure (part of reasons why it was made obsolete, but is kept in FortiOS for backward compatibility).

- better approach described in mentioned doc would be to disable it on per VDOM level.

 

2. ALG - Application Layer Gateway

- successor of SIP Session Helper and supported solution .. for like decade++

- intelligent proxy which can handle various SIP traffic, including TCP, SIPS and TLS based variations

- allows sanity checks, traffic rate limits on per SIP request/response basis .. nice, and more

- logs (if set, and even to GUI visible security event logs) and is much better option for troubleshooting

 

To make bidirectional audio, you simply need :

- let's assume you do have symmetrical traffic

- firewall policy from inside out to allow traffic from PBX with NAT enabled

- configured VIP for DNAT

- use that VIP as destination in firewall policy for outside in traffic, so phones will be able to reach PBX

- use voip-profile setting in those policies, those profiles govern how ALG handles the traffic

- on per-VDOM basis have that in VDOM with 


config system settings
set default-voip-alg-mode proxy-based
end

 

Above mentioned firewall policies should have inspection-mode set to "proxy", not to flow as in 7.0 and above. Note that in 7.0++ the default for the policy is "flow" which means IPS driven SIP inspection. And we need ALG to handle SIP.

 

There are also respective "config voip profile" parts.
With respective "feature-set" either as ..
- in FortiOS 7.0.0-7.2.4 as "flow" or "proxy"

- in FortiOS 7.2.5 ++ as "ips" or "voipd".

And we need either "proxy" or "voipd" (latest FortiOS) as it refers to ALG.

 

I'd suggest to clone "default" voip profile and enhance it a bit .. 

config voip profile

  edit "test-profile"
    set comment "Default VoIP profile."
    config sip
      set block-long-lines disable
      set block-unknown disable
      set log-violations enable
      end
    next
end

- block long lines is by default enabled and some implementations of SIP which do not respect RFCs completely might send excessive payload and get blocked by FortiGate

- block unknown is similar to long-lines, but it refers to 3rd party vendors who "enhance" general SIP with their own vendor-specific headers and so might be blocked by FortiGate due to sanity check done by ALG as their extra content does not fit RFCs

- log-violations .. simply turn on logging to all the voip profile restrictions, and so if you have all relevant settings correct you will see security logs in you FortiGate GUI.
More on logging:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-VoIP-traffic-logging-as-troubleshooting-an... 

 

Basis is to have NAT done by ALG.
In that case pay attention to fact that even configured VIP is by its nature bidirectional, so as DNAT and also act as SNAT for reply direction traffic. Therefore use VIP in outside in traffic policy, and simple NAT in inside out policy.

Do NOT use VIP in combination to other NAT-ting tools like IPpool as it makes double SNAT and also leads to one way audio.

 

More info on how FortiGate/FortiOS handles VoIP can be also found here:
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/858887/voip-solutions 

 

Hope that helped to explain what happened in your case and how to do inspection on FortiGate.

 

Tomas Stribrny - NASDAQ:FTNT - Fortinet stuff - TAC Staff Engineer

Top Kudoed Authors