Hot!PROBLEM SOLVED: SIP connection

Author
Access1denied
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/06/26 06:09:06
  • Status: offline
2020/07/30 06:32:05 (permalink)
0

PROBLEM SOLVED: SIP connection

I have a Grandstream UCM PBX that is behind my fortigate 100D.  my local network is 10.15.20.x and my PBX wan port is 10.15.20.249.  My gateway is configured with 69.231.225.154/29  with 69.231.225.154 my default IP.
 
I have a VIP labeled as OffsitePhone: 69.231.225.157 -->10.15.20.249 port 5060 
My policy ID 60 is configure to accept incoming traffic from specific IP Address from the WAN1 port TO internal OffsitePhone I also set the service type to SIP.  I know this doesn't matter because of the VIP map with port... but I still set it.
 
I am running into a few problems.
1.  The policy doesn't seem to prevent others from accessing the UCM on port 5060.  As a result of this, I had to turn on the UCM firewall.
2. The connection works for some users and not for others. 
    after reviewing the logs.  I can see the packets coming through to the OffsitePhone policy to the 10.15.20.249.  However, the packets from the 10.15.20.249 IP is going to the private ip address of the user's network.  It is suppose to go to the user's gateway public ip.  I don't understand why it works for some users and not for others...
post edited by Access1denied - 2020/08/02 16:08:12
#1

6 Replies Related Threads

    Access1denied
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/06/26 06:09:06
    • Status: offline
    Re: SIP connection 2020/07/31 06:23:33 (permalink)
    0
    update, I am using Fortigate 60 and I am having the same problem.  The firewall policy doesn't appear to block UDP traffic. This is scary... Am i the only person having this problem.... I have also tried to set the source IP in the VIP policy... but it appears no effect. I am still finding IP address not assigned being able to access my end point.
    #2
    TheJaeene
    Silver Member
    • Total Posts : 113
    • Scores: 10
    • Reward points: 0
    • Joined: 2010/01/06 00:56:49
    • Status: offline
    Re: SIP connection 2020/07/31 07:49:33 (permalink)
    0
    Hi!
     
    Please take a look at :
    https://kb.fortinet.com/kb/documentLink.do?externalID=FD36750
     
    and
     
    https://kb.fortinet.com/kb/documentLink.do?externalID=FD36405
     
    After disabling the SIP ALG you need to create a separate VIP for RTP Traffic with their respective UDP Port Range.
     
     
    Please also note that you need to create a outgoing rule from PBX to WAN with SNAT. (IP-Pool) 69.231.225.157 as the SNAT (not the interface IP as NAT) and place this policy above the general outbound NAT.
     
    Since you are using a VIP with Portforwarding, which is no 1:1 NAT, you need to do that (established traffic will flow correct though)
     
    Greetings,
     
    The Jane
     
    post edited by TheJaeene - 2020/07/31 07:56:47
    #3
    Access1denied
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/06/26 06:09:06
    • Status: offline
    Re: SIP connection 2020/08/01 13:08:16 (permalink)
    0
    Thank for the reply..
    Is there any way to undo this kb? in the event it doesn't work?  I wasn't sure if the changes is specific to the policy or global?
    https://kb.fortinet.com/kb/documentLink.do?externalID=FD36405
    #4
    poundy
    Silver Member
    • Total Posts : 61
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/06/13 20:58:45
    • Status: offline
    Re: SIP connection 2020/08/01 21:40:14 (permalink)
    0
    @Access1denied, to remove those settings you can either put them back to the original ones, or otherwise restore your configuration (if you take the backup before starting).
     
    For example, in point 1 they help you identify a particular session-helper. Take a copy of that part of the config before you delete it, and replace it if you want to back-out.  Do this by going to the appropriate section (config system session-helper, for example) and typing SHOW, which then allows you to copy the current settings out into a text file to simply replace them. You can use UNSET new settings that you add to remove them.
     
    #5
    Access1denied
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/06/26 06:09:06
    • Status: offline
    Re: SIP connection 2020/08/02 06:22:49 (permalink)
    0
    Okay thanks Poundy
    #6
    Access1denied
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/06/26 06:09:06
    • Status: offline
    Re: SIP connection 2020/08/02 16:06:39 (permalink)
    0
    Thank you jkassner and poundy...
     
    problem solved.  
     
    #7
    Jump to:
    © 2020 APG vNext Commercial Version 5.5