Yeastar S20 PBX behind Fortigate 60F firewall. Linkus softphone has no audio at all during telephone

[teo-en-ming]

Subject: Yeastar S20 PBX behind Fortigate 60F firewall. Linkus softphone has no audio at all during telephone calls.

Good day from Singapore,

The Linkus softphone installed on Android phones has no audio at all during telephone calls. We were troubleshooting for a few days. We have tested countless settings in both the Fortigate 60F firewall and Yeastar S20 PBX appliance. But we could not solve the issue.

Then a breakthrough occurred when I noticed that when I make a telephone call using Linkus softphone on my Android phone, RTP packets were being sent. ***But no RTP packets were received.*** This implies that the Fortigate 60F firewall were blocking RTP packets.

I did a Google search and found this article.

Article: Technical Tip: Disabling VoIP Inspection

Link: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Disabling-VoIP-Inspection/ta-p/194131

You need to ensure that ALL of the following lines are present in the Fortigate 60F firewall CLI configuration.

config voip profile

edit default

config sip

    set status disable

end

end

end

The one line that I have added is: "set status disable".

After adding the above line, telephone calls on Linkus softphone started to have audio both ways.

I have solved the problem! (At 3.00 AM on 7 Oct 2023 Saturday morning Singapore time)

I hope that the above information is useful to you. I don't know why adding the line "set status disable" to the voip profile solved the problem. I didn't read the above article thoroughly from start to finish. Perhaps someone else can explain.

Thank you.

Regards,

Mr. Turritopsis Dohrnii Teo En Ming

Targeted Individual in Singapore

9 Oct 2023 Monday

[xsilver_FTNT]

Hello @teo-en-ming 

Well, instead of using FortiOS capabilities to do some protective magic on SIP you simply disabled all of that.

By default FortiOS do have two tools to handle SIP, and some other VoIP protocols as well, but let's focus on SIP alone.

1. SIP Session Helper

- old, deprecated, but fast solution via "config system session-helper" kernel module, which is also a bit insecure (part of reasons why it was made obsolete, but is kept in FortiOS for backward compatibility).

- better approach described in mentioned doc would be to disable it on per VDOM level.

2. ALG - Application Layer Gateway

- successor of SIP Session Helper and supported solution .. for like decade++

- intelligent proxy which can handle various SIP traffic, including TCP, SIPS and TLS based variations

- allows sanity checks, traffic rate limits on per SIP request/response basis .. nice, and more

- logs (if set, and even to GUI visible security event logs) and is much better option for troubleshooting

To make bidirectional audio, you simply need :

- let's assume you do have symmetrical traffic

- firewall policy from inside out to allow traffic from PBX with NAT enabled

- configured VIP for DNAT

- use that VIP as destination in firewall policy for outside in traffic, so phones will be able to reach PBX

- use voip-profile setting in those policies, those profiles govern how ALG handles the traffic

- on per-VDOM basis have that in VDOM with 

config system settings
set default-voip-alg-mode proxy-based
end

Above mentioned firewall policies should have inspection-mode set to "proxy", not to flow as in 7.0 and above. Note that in 7.0++ the default for the policy is "flow" which means IPS driven SIP inspection. And we need ALG to handle SIP.

There are also respective "config voip profile" parts.
With respective "feature-set" either as ..
- in FortiOS 7.0.0-7.2.4 as "flow" or "proxy"

- in FortiOS 7.2.5 ++ as "ips" or "voipd".

And we need either "proxy" or "voipd" (latest FortiOS) as it refers to ALG.

I'd suggest to clone "default" voip profile and enhance it a bit .. 

config voip profile
  edit "test-profile"
    set comment "Default VoIP profile."
    config sip
      set block-long-lines disable
      set block-unknown disable
      set log-violations enable
      end
    next
end

- block long lines is by default enabled and some implementations of SIP which do not respect RFCs completely might send excessive payload and get blocked by FortiGate

- block unknown is similar to long-lines, but it refers to 3rd party vendors who "enhance" general SIP with their own vendor-specific headers and so might be blocked by FortiGate due to sanity check done by ALG as their extra content does not fit RFCs

- log-violations .. simply turn on logging to all the voip profile restrictions, and so if you have all relevant settings correct you will see security logs in you FortiGate GUI.
More on logging:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-VoIP-traffic-logging-as-troubleshooting-an... 

Basis is to have NAT done by ALG.
In that case pay attention to fact that even configured VIP is by its nature bidirectional, so as DNAT and also act as SNAT for reply direction traffic. Therefore use VIP in outside in traffic policy, and simple NAT in inside out policy.

Do NOT use VIP in combination to other NAT-ting tools like IPpool as it makes double SNAT and also leads to one way audio.

More info on how FortiGate/FortiOS handles VoIP can be also found here:
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/858887/voip-solutions 

Hope that helped to explain what happened in your case and how to do inspection on FortiGate.