One-way audio, dropped registrations, or crunchy/static filled calls on phones behind a FortiGate is almost always caused by the firewall's SIP ALG rewriting call traffic. Disabling it and opening the correct ports for your PBX resolves most of these issues.
Step 1: Disable the SIP ALG
- Remove the SIP session helper: In the CLI, run config system session-helper then show. Find the entry named sip (usually port 5060), note its ID, then run delete <id> and end.
- Switch off SIP inspection mode: Run config system settings, then set default-voip-alg-mode kernel-helper-based, then end.
- Check firewall policies: Make sure no policy handling phone traffic still has a VOIP profile with SIP inspection enabled. Either remove the profile from the policy, or disable it under config voip profile > config sip > set status disable.
- Clear existing sessions: Run diagnose sys session filter dport 5060 then diagnose sys session clear (a reboot works too, if one's already scheduled).
Step 2: Allow Outbound Traffic to the PBX
- Create custom service objects (Policy & Objects > Firewall Policy, or via CLI):
- SIP Signaling: TCP/UDP 5060, TCP 5061 (TLS)
- RTP Media: UDP 10000 to 20000
- Provisioning: TCP 443
- DNS and NTP: UDP 123
- Create the firewall policy: Source is the phone subnet/VLAN, destination is the PBX server address(es) for this site, service is the objects above, action ACCEPT with NAT enabled.
Step 3: Increase the UDP Session Timeout for SIP
- Extend the timeout on port 5060: If the default timeout is shorter than the phones' registration-refresh interval, the NAT mapping can expire between refreshes and cause drops. Run config system session-ttl > config port > edit <id>, then set protocol 17, set start-port 5060, set end-port 5060, set timeout 300, then next and end.
Step 4: Allow Ping and Traceroute for DiagnosticsÂ
This is for testing and troubleshooting from our end, not something you need to configure on your side beyond allowing it through the firewall.
- Allow ICMP: Add the built-in ALL_ICMP service to the policy handling this traffic so echo, echo-reply, time-exceeded, and unreachable are permitted outbound and back.
- Allow traceroute: Create a custom service for UDP 33434 to 33534 and add it to the same policy.
Step 5: Traffic Shaping for Call Quality (Optional)
- Prioritize voice traffic: On WAN links that get busy, add traffic shaping that prioritizes DSCP EF (46) for RTP media and CS3/AF31 for SIP signaling. Not required, but recommended if the link is shared with other traffic.
Note: no inbound port forwards are needed. Phones register outbound to the PBX and keep the session open for return traffic.
If issues persist after applying these steps, please contact our support team for further troubleshooting.