disable ports from internal to external

[kesha]

Dear i make before post to i need to disable i can access my server`s from internal with VIP Ip i need to access from internal by internal ip and from external with external ip and MR Nihas Help me now i have ppx and i have soft phone i my soft phone i can access it my EX by VIP from Internal inned to deny this i make policy and i disable port 5060 but still i can my soft phone can register by real ip from internal can you help me my forti gate 60B

[netmin]

I find it really difficult to understand what you are trying to achieve. Let me test my assumptions: 1. Your softphone can still connect to your PBX but you don' t want this to happen at all when you are at work? Or you don' t want it to connect to the external firewall IP? 2. Your PBX is located on the same interface (internal) as your laptop? How is your softphone configured to contact the server, by DNS name or IP address?

[kesha]

look bro i have my ppx location in my company i have private it and real ip i make forwarding to my real ip okay i need to when im in the office i can connect all my softphone with the private ip and when im out of office i need to coonected by real ip thats i need

[netmin]

Text formatting using dots and commas may really improve the readability of posts. Here is what I would do: softphones register to a DNS name, not an ip address: " sipserver.corp.example.com" where " corp.example.com" is your externally registered domain pointing to your external firewall address(es). Outside DNS servers resolve the name to your external IP. Create an internal, authoritative, non-forwarding DNS zone for " corp.example.com" with the internal ip for " sipserver.corp.example.com" . Inside clients using the FGT DNS or internal DNS servers resolve the name to the internal IP.

[kesha]

okay i will check and feedback you thanks bro