Hosted SIP provider config help

[mark367]

We have around 50 Cisco IP phones (with SIP fw loaded) configured to use an external hosted SIP provider. I have configured our phones to use DHCP on own lan with default gw configured as an interface on the fortigate. So lan subnet 192.168.7.0/24 gw 192.168.7.254 (interface on ftg configured to use this address). SIP Proxy: Hosted SIP provider ext IP addr FTG Policy as follows: PhonelanInt ==> WanInt Allow: all Src addr: any Dest addr: SIP Proxy IP Service: Any Phones work mostly ok, but sometimes we get issues with a silence delay of 2 to 5 secs after call connects. The person making a call will hear the phone connect but will have to wait 2 to 5 secs before voice starts working. The same issue is seen when a person receiving the call will answer the phone to silence and will need to wait 2 to 5 secs before voice starts working. The other issue we have is that phones will drop registration and will need to be restarted in order for them to register again. Does anyone have any ideas as to why we get deathly silence on some calls after connection. Has this something to do with RTP sessions and NAT not working correctly? Is there a fw configuration that is suited to a purely hosted SIP provider. I have been pulling my hair out with this, I moved away from ISDN PriRate to save my company on line rental and call costs but reliability is becoming an issue. I have tested one of the SIP providers supplied handsets with their default settings and have the same problem. Any pointers or tips will be helpful. Thanks.

[Luis_Cerdas]

Depending on your FortiOS version, it could be load on the SIP helper ... you could maybe disconnect (remove the entry) the SIP helper and create a VoIP profile and apply that to the rule ...

[red_adair]

i' d suggest to use a recent Patch of either 4.2 or 4.3 Than change the Policy that allows " SIP" to be SIP (udp/tcp 5060) only and not ANY Under UTM -> Create a new VoIP Profile. lets say " SIP" .

 config voip profile
     edit " SIP" 
         set comment " default VoIP profile" 
             config sip
                 set log-violations enable
                 set block-unknown disable
             end
 end
 

Attach this Profile in your SIP-Firewall-Policy (we just modified) under UTM Section Don' t forget to tick NAT - assuming you NAT.

[mark367]

Should I disable sip session-helper, do I need to restart the FW? How do I make sure existing SIP sessions are dead without restarting the FW? Thanks.

[mark367]

Hey guys, from the fortigate documentation http://docs.fortinet.com/fgt/handbook/40mr2/fortigate-voip-sip-40-mr2.pdf should I be using the " Source NAT Scenario" on page 65 or the " Destination NAT Scenario" on page 66?

[Wenlong_Qin_FTNT]

Hi, I have done some tests to run SIP trunk over FortiGate. There is no any audio issue. If you have any audio issue over FortiGate, please try following configurations on FortiGate: config system session-helper show edit 20 set name sip set port 5060 set protocol 17 next delete 20 end config system settings set sip-helper disable set sip-nat-trace disable end config firewall address edit " all" next end config voip profile edit " voip_1" config sip set hosted-nat-traversal enable set hnt-restrict-source-ip enable end next end config firewall policy edit 1 set srcintf " internal" set dstintf " wan1" set srcaddr " all" set dstaddr " all" set action accept set utm-status enable set schedule " always" set service " ANY" set voip-profile " voip_1" set nat enable next edit 2 set srcintf " wan1" set dstintf " internal" set srcaddr " all" set dstaddr " all" set action accept set utm-status enable set schedule " always" set service " ANY" set voip-profile " voip_1" set nat enable next end Thanks, Wenlong Qin