Polycom advice

[Brady_R__Houser]

I'm trying to put a Polycom device behind my firewall with a VIP NAT overload.

I can get it working so that I can browse the web interface but run into issues with one sided Voice/audio.

here's my config.

config firewall vip edit "War Room Polycom - 38.xx.xx.xx" set extip 38.xx.xx.xx set extintf "wan1" set mappedip 172.40.100.48 next end

config firewall policy

edit 130 set srcintf "wan1" set dstintf "port1" set srcaddr "all" set dstaddr "War Room Polycom - 38.xx.xx.xx" set action accept set schedule "always" set service "ALL" set logtraffic disable set nat enable set ippool enable set poolname "Cogent War Room - 38.xx.xx.xx"

I've also deleted the SIP and H232 helper from config system session-helper

I'm running 5.0.9 on Fortigate 200D setup in an Active-Passive HA.

[Dave_Hall]

Just guessing, you may want to setup a wf policy from port1/172.40.100.48 to WAN, using that NAT pool (or a 1-to-1 NAT.

[seadave]

We had this problem.  The fixup/helper setting for the codec didn't seem to work.  We finally gave up and purchased a Polycom VBP ($1500).  This is a VTC/SIP dedicated firewall.  It has the advantage of allowing you to register your HDX Codex by E.194 numbers so people can dial direct using IP##NUM

If you only have one HDX you should be able to do something with the Fortinet to make it work, if you have more than one, you should look into the VBP.  Makes things much easier.

http://www.polycom.com/products-services/realpresence-platform/universal-access-security/vbp-e-serie...

http://www.ipphone-warehouse.com/Polycom-2583-73545-001-p/2583-73545-001.htm

[seadave]

Just found this.  Look in page 925 of the FortiOS Handbook for FortiOS 5.2  Even if you are not on that, it has great info about ports and Polycom.  Trying to find original download.  There appears to be 10 versions of this document.  PDF I have is called:

fortios-handbook-52.pdf

I'll be darned if I can find the exact version.  Here is a Dropbox link to it:

https://www.dropbox.com/s/w5c03tsx4ltbiyw/fortios-handbook-52.pdf?dl=0

[emnoc]

1st off you don't need  nat on a VIP ( dnat )

e.g remove these

set nat enable set ippool enable

2nd you need to get out diag debug flow and get  the reason why your sessions is not being made

3rd you will need some type of policy allowing traffic outbound and SNAT , once again  the diag debug flow  is your friend.