FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 192004



Fortinet recommends disabling the SIP session-helper (Layer4) and using the SIP Application Layer Gateway (ALG) (Layer7).
Currently supported FortiOS versions have SIP-ALG enabled by default.
If SIP-ALG was disabled on a recent firmware, enable it with:


# config system settings
    set default-voip-alg-mode proxy-based


While disabling SIP-ALG is changing a simple command, note that to enable SIP-ALG requires a reboot of the FortiGate in some cases.
If the statistics for the 'diag sys sip-proxy stats' are not increasing with the calls, then a reboot is necessary.


Reading further, this article is intended for older FortiOS firmware, though similar steps apply.



Until FortiOS 5.0, session-helper was the default SIP inspection mechanism.

Starting with FortiOS 5.2, SIP-ALG is enabled by default.
It is not necessary to apply a VoIPprofile to a Firewall policy to apply SIP ALG. When SIP traffic is detected, the 'default' VoIP profile is used by FortiGate.

The default voip profile can be modified from the default settings.
This, for example, makes FortiGate use sip session-helper for SIP (but keep SCCP and other voice traffic under SIP-ALG inspection):


config voip profile

edit default

config sip
   set status enable/disable




The procedure to enable ALG profile before FortiOS 5.2:

  1. Check the session-helper number:

show system session-helper
    edit 12 [*]
        set name sip
        set port 5060
        set protocol 17



[*] Use this ID for the next step

  1. Remove this session-helper:



config system session-helper

(session-helper) delete 12

(session-helper) end  



  1. Reboot the FortiGate , in order for the above changes to take effect.

  2. Enable VoIP Feature from WebGUI under System -> Config -> Features.

  3. Create a VoIP Profile with SIP enabled:

Instructions below are for FortiOS firmware versions 4.0 to 5.2.

Enter the following command to a Voip Profile for SIP, limit REGISTER and INVITE requests to 100 requests per second per firewall policy (values are given as an example).


config voip profile
    edit "test"

config sip
    set register-rate 100
    set invite-rate 100
    set block-long-lines disable
    set block-unknown disable





  1. Enable this Protection Profile in the appropriate Firewall Policy(ies) for example.


config firewall policy
    edit 1
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"            
        set dstaddr "all"            
        set action accept
        set schedule "always"
        set service "ANY"            
        set utm-status enable
        set voip-profile "test"
        set profile-protocol-options "default"
        set nat enable


Related documents: