PTT Service issue help

[June]

Dear all,

I have a question about PPT(Push to Talk) Server Issue.

The customer's existing equipment is FortiGate-300C(Standalone), and OS version is in 5.0 Patch 12 version.

Changed to FortiGate-400D(HA Cluster A/S), and OS Version is in 5.4 Patch 8 due to configuration change and equipment change progress.

However, there has been an issue with the PTT service since the equipment was replaced.

The symptoms of the issue are as follows.

- During communication between PTT Device(UE), noise occurs.

- As a result of packet capture via wire shark, the UE device is in the correct receive state.

- However, a packet that has been sent to the PTT server appears to be Lost and a "Wrong sequence number" log is found.

The default setting of "set anti-replay strict / set asymroute disable" is applied to the FG-300C. Also, session helper settings are also default.

As a result of reviewing the firewall policy, it is judged that you are using the two-way policy, not the session helper and ALG. (Apply Port related to PTT service as Range)

We have compared the configurations of FG-400D (5.4.8) and FG-300C (5.0.12) and found that "set default-voip-alg-mode" is different.

The "set default-voip-alg-mode" setting has been added since version 5.2.X. It seems to be working as proxy-based by default.

So, we changed the "set default-voip-alg-mode" setting to "Kernel-Based" same as the existing 5.0.12 configuration, and the issue was the same.

What do we need to check? We need everyone's help. please provide a solution.

Thanks and Best Regards

[Toshi_Esumi]

If your devices are using SIP, I would start with no SIP session helper and no SIP ALG to see if they're affecting to the symptom. This article describes the steps to disable both:

https://www.3cx.com/docs/fortigate-firewall-configuration/

If this doesn't change the symptom, the problem is somewhere else.

[June]

In the following link, "step1" and "step2(Except for the voip profile setting)" went through the process. but the results are the same.

- SIP(5060) Session-helper Delete

- set default-voip-alg-mode kernel-helper based

default profile does not work unless apply the voip profile to the policy after I set it to "set default-voip-alg-mode kernel-helper based". Is this true?

Even if you look at the posts of some websites, it is said to disable the sip setting of Default profile.

Also, there seems to be a problem with RTP packets because of the noise of the voice.

##The service ports used for voice transmission are as follows. UDP 40000 ~ 44999 Audio RTP : Voice transmission Packet (UDP Port)

[Toshi_Esumi]

That was my original assumption as well but our experiences tell differently. Even without applying the profile to  policies it must be affecting to something behind the scene. I think that's why those instructions we can find to disable the helper/alg include that part. It wouldn't hurt disabling is unless you're actually using it. Then reboot the unit. If this doesn't change the symptom, you just ruled out it's not the SIP session-helper or ALG problem, but something else. Without this confirmation, it's very difficult to narrow down any VoIP related issues.

Depending the type of noise you're getting, it might be completely a completely physical issue.