FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
gmanea
Staff
Staff
Article Id 194131

Description


This article describes how to disable SIP-inspection on FortiGate and explains the consequences.
Fortinet recommends the use of SIP/SCCP proxy/ALG (called SIP-ALG even though it does not handle only SIP traffic) in most situations.
The alternative in FortiGate, SIP-helper, is obsolete and provides a very basic pinhole opening service.
In some cases, other vendors recommend disabling the SIP inspection altogether on the FortiGate (carefully note the date and FortiGate model of the articles, which may be outdated).

 

Disabling the VoIP inspection may influence the production systems. Re-enabling SIP-ALG will require a restart. 

DISABLING SIP-ALG IS NOT THE FIRST TROUBLESHOOTING ACTION TO TAKE!

Scope

 

Any supported version of FortiGate.

 

Solution

 

The use of an Application Layer Gateway (ALG) allows for:

  1. Modification of IP addresses in the application payload when NAT is used.
  2. Dynamic opening of data ports ('pinholes') as required to allow the audio traffic. Otherwise, SIP-helper can open these ports with very basic Layer4 logic.  Otherwise, firewall policies must be used to statically open a wide range of ports for RTP/audio (through a VIP). 
  3. Inspection and logging of VoIP traffic

For more details on the benefits of the SIP ALG in FortiOS, as well as information on how to troubleshoot SIP issues, consult the additional articles linked at the end of this article

 

Disabling the SIP-ALG should only be done for troubleshooting (to isolate a problem)

SIP ALG allows multiple options to configure and address incorrect FortiGate SIP ALG behavior, or to allow non-standard SIP handling in the overall VoIP deployment. These options are present below and must be considered before disabling SIP-ALG.

 

Since FortiOS 5.2, the FortiOS proxy/ALG handles all SIP traffic by default.
In FortiOS 5.0, if VoIP profile is not applied, the SIP session helper will be applied.

 

The following diagram shows a general SIP call flow over FortiGate:

 

AlexCFTNT_0-1650441007612.png


Disabling all VOIP inspection on the FortiGate, prevents it from opening the RTP session and therefore have no audio. 

When NAT is involved, FortiGate must use one of the three options above.


Preparation
Before disabling SIP ALG & SIP session-helper functionality, these two steps are required:

  1. Modify the local SIP server configuration (if NAT is used) 
    If the SIP traffic is NAT'd when passing through the FortiGate, the SIP server must be configured to use its public IP address in the application header. All other VoIP equipment must also refer to the SIP server by its public IP.
  2.  Open up corresponding audio ports (range) through VIP on the FortiGate.
    Firewall policies must now explicitely allow all UDP ports to be open for the audio traffic (and not only the SIP 5060 or SCCP 2000 control ports).

Note1:

When a firewall policy has a voip-profile applied, SIP-ALG is used over SIP session-helper, even if disabled.


Note2:

disabling SIP session-helper is only necessary if ALL the SIP inspection must be removed.

The commands associated with the SIP-helper will not be relevant if the FortiGate is using SIP-ALG. Fine-tuning SIP-ALG is done through the VoIP profile.


Note3:

Multi-vdom considerations: sip-helper is a global setting. Deleting sip-helper from a global context will make it inaccessible for all VDOMs. SIP-ALG is enabled (by default) and can be disabled per-vdom.

Follow the steps below to disable the SIP session-helper:

 

  1. Remove the corresponding session helper for sip. Check the ID of the sip session helper:

config system session-helper
      show

 

A similar setting to the following will appear among the displayed settings:

 

edit 13

set name sip

set protocol 17

set port 5060

next

 

Here, entry 13 points to SIP traffic, which uses UDP port 5060 for signaling.
In this example, run the following commands to remove the corresponding entry:

 

delete 13

end

 

Note that it is not necessary for the SIP entry to be 13. Cross verify which entry has the SIP helper settings.

 

  1. Change the default–voip–alg-mode to disable SIP-ALG.
    By default, SIP-ALG is enabled by the following command, which can be verified with 'show full'.

config system settings
    set default-voip-alg-mode proxy-based
end

 

Run the following command to instruct the FortiGate to disable SIP-ALG (proxy-based) and use SIP-helper (kernel-helper-based):

 

config system settings
    set default-voip-alg-mode kernel-helper-based
end

 

Note1:

The command 'set sip-helper enable | disable' is not designed to enable | disable sip-helper. Instead, the purpose of the command is to control whether or not the pinhole is created in order to decrease the number of pinholes, as explained in the command-help:

'Enable/disable helper to add dynamic SIP firewall allow rule' // 'Enable/disable the SIP kernel session helper to create an expectation for port 5060.'
(Since version 6.2.2 the CLI command is different: set sip-expectation disable)


Note2:

The command 'sip-nat-trace enable | disable' is not designed to enable | disable sip-helper. This command is in effect ONLY when SIP session-helper is used (ONLY when 'set default-voip-alg-mode kernel-helper-based' AND 'SIP session helper is present/not deleted'). As the command-help says: 'Enable/disable recording the original SIP source IP address when NAT is used'.

 

         3. Either clear sessions or reboot the FortiGate to ensure changes take effect

  • To clear sessions, select the control session (port 5060) which will be cleared. Once the control session is ended, the RTP session is also ended.

    diagnose system session filter dport 5060

The command to clear the sessions applies to ALL sessions unless a filter (like above) is applied, and therefore will interrupt all traffic!

 

diagnose system session clear

 

  • Alternatively, reboot the FortiGate using either GUI or CLI. The CLI command is:

 

execute reboot

 

Note: 

It is also possible to disable SIP-ALG from the VoIP profile if needed (for example, when SCCP and SIP are both transiting the firewall, and SCCP works ok).

In this case, the SIP traffic will be handled by the SIP-helper even if the default-voip-alg-mode is set to proxy-based:


This allows SCCP to be handled by SIP-ALG and SIP by sip session-helper

 

config voip profile

edit default

config sip
    set status disable

end

end

end

 

Disabling SIP session helper with VDOMs enabled

If VDOMs are enabled, disable the session helper from global as the session helper setting is a global parameter, and is not available under any particular VDOM. Since this is a global setting, removing or disabling the session-helper globally affects all the VDOMs.

 

config global
(global)# config system session-helper

 

There might be scenarios where a particular VDOM (VDOM-A, for example) has to use the session-helper settings for the SIP traffic processing, and VDOM-B needs to have the session-helper disabled so that SIP traffic passing through VDOM-B is not inspected by the SIP session-helper.

In these or in similar cases, use the following settings:

 

config firewall service custom
(custom) edit SIP-Helper-disable
(Helper-disable) set udp-portrange 5060
(Helper-disable) set helper disable
(Helper-disable) next

 

Once the above custom service with the helper set to disabled has been created, the same has to be called in the corresponding policy which allows the SIP traffic.

This will ensure that the firewall does not process the SIP traffic provided the traffic hits the corresponding policy where the customer service named Helper-disable is applied.
As proved by some isolated cases, this last method is not the best approach, as the sip-helper may be triggered by the traffic, even when the session-helper is disabled per service SIP-Helper-disable.

 

Note:

It is necessary to clear all of the sessions for port 5060 (clearing 5060 session will drop all of the active calls passing through FortiGate).

 

 diag sys session filter  clear

 diag sys session filter dport 5060

 diag sys session clear

 

 diag sys session filter  clear

 diag sys session filter sport 5060

 diag sys session clear


Related documents:

Technical Tip: Most common cases of SIP implementation

Troubleshooting Tip: FortiGate session table information

Technical Tip: VOIP calls (using SIP)

Techincal Tip: SIP useful Commands

Technical Tip: Enabling the SIP Application Layer Gateway (ALG)

Technical Tip: How to confirm if FortiGate is using SIP Session Helper or SIP ALG

Technical Tip: How to use the SIP ALG to prevent unwanted calls

SIP and SCCP Traffic is Handled by the VoIP ALG/Proxy by default in FortiOS 5.2

Technical Tip: How to apply VoIP profile to policy where no SIP inspection is required

 

https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/858887/voip-solutions
https://docs.fortinet.com/document/fortigate/6.2.7/cookbook/858887/voip-solutions

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/858887/voip-solutions