Toggle sidebar Toggle sidebar

FORTIGATE drop call issues

Status
Not open for further replies.

carlos.dias

Silver Partner
Basic Certified
Joined
Oct 28, 2020
Messages
11
Reaction score
3
Hi guys,

Any one here do a recent setup with FortiGate (forti-100 in my case) recently ?? if so did you have any issues with dropped calls ?

I just did one, followed the guide from 3cx for FortiGate (that seems a bit outdated) and am having dropped call issues.

I have done many 3cx setup begore with PF-Sense and never had this issue so I'm leaning toward the FortiGate.

So any experiences ? 3cx any new doc for the new models ?

thx!
 
Have you disabled SIP ALG? In this case, the SIP helper.

The 3CX doc is out of date but a quick Google search will give you everything you need.

Also, does the firewall checker passes?
 
  • Like
Reactions: Kevin@voxtelesys
Is it happening on both internal and external calls?
 
Frederick Marcoux said:
Have you disabled SIP ALG? In this case, the SIP helper.

The 3CX doc is out of date but a quick Google search will give you everything you need.

Also, does the firewall checker passes?
Click to expand...


Yes it was done via the CLI....
 
With PF-Sense it's very easy for me to debug/check the static ports.. nat etc... with the fortigate interface I'm not as efficient :(
 
carlos.dias said:
With PF-Sense it's very easy for me to debug/check the static ports.. nat etc... with the fortigate interface I'm not as efficient :(
Click to expand...
So, you need to have a VIP assigned to the PBX and then configure the policies to allow ports through to the address and enable NAT on those policies.

Have you done that?
 
Are you on a current firmware with the 60E? Follow these instructions to a T:

https://www.3cx.com/docs/fortigate-firewall-configuration/

If you are on 6.2.X firmware and above, your code will look something like this under step 1:

config system settings
set sip-expectation enable
set sip-nat-trace disable
set default-voip-alg-mode kernel-helper-based
 
  • Like
Reactions: Evolute IT
Also, one thing:

dropped calls happen on what? Smartphone, webclient, windows client or deskphone?
 
carlos.dias said:
External calls
Click to expand...

When we have customer that has issues with dropped external calls we open a packet capture and typically find that they are sending a private or wrong IP in the contact field. Can you request a pcap from your vendor?

Do you have the correct IP set in your network settings on 3CX as well as the correct port forwarding on your firewall?
 
  • Like
Reactions: Evolute IT
Hi Guys, thx for all your input, very useful.

I'm really starting to lean to improper config on the forti100 (not installed or managed by us).

The sip settings were wrong... (i already asked for it to be changed asap)
set sip-helper disable
set sip-nat-trace disable

But does anyone one have all the steps or maybe recent commands or print screens for 3cx in a recent Fortinet device ?

I know the 3cx settings are good because we did over 20 setups in the last year (with PF-Sense)... but we never worked with forti100 devices in the past.

A print screen of the Firewall Policy section where we can see the one-to-one nat and static port would be awesome i i can compete with the customer's

I might be old school but i think the FortiGate interface is harder to understand then the one from pfsense.. lol...


Again thx a lot!!!!
 
  • Like
Reactions: Evolute IT
Maybe you can get the customer to switch to a managed PF sense from you?

Can you ask your SIP trunk vendor for a PCAP to see what the call looks like? Could be translated IP, improper RTP setup. With that being said what are you using for RTP? G711 and G729? PBX delivers audio?
 
You have to reboot the device as well within those settings. If you follow the instruction with the modifications I sent, that is the correct setup. Below are sections from a 100D:


config system settings
set sip-expectation enable
set sip-nat-trace disable
set default-voip-alg-mode kernel-helper-based
set gui-multicast-policy enable
set gui-voip-profile enable
set gui-local-in-policy enable
set gui-explicit-proxy enable
set gui-sslvpn-personal-bookmarks enable
set gui-sslvpn-realms enable
set gui-spamfilter enable
set gui-ips enable
set gui-waf-profile enable
end

config voip profile
edit "default"
set comment "Default VoIP profile."
config sip
set strict-register disable
end
next
edit "strict"
config sip
set strict-register disable
set malformed-request-line discard
set malformed-header-via discard
set malformed-header-from discard
set malformed-header-to discard
set malformed-header-call-id discard
set malformed-header-cseq discard
set malformed-header-rack discard
set malformed-header-rseq discard
set malformed-header-contact discard
set malformed-header-record-route discard
set malformed-header-route discard
set malformed-header-expires discard
set malformed-header-content-type discard
set malformed-header-content-length discard
set malformed-header-max-forwards discard
set malformed-header-allow discard
set malformed-header-p-asserted-identity discard
set malformed-header-sdp-v discard
set malformed-header-sdp-o discard
set malformed-header-sdp-s discard
set malformed-header-sdp-i discard
set malformed-header-sdp-c discard
set malformed-header-sdp-b discard
set malformed-header-sdp-z discard
set malformed-header-sdp-k discard
set malformed-header-sdp-a discard
set malformed-header-sdp-t discard
set malformed-header-sdp-r discard
set malformed-header-sdp-m discard
end
next
end

config firewall vip
edit "SIP1"
set uuid
set extip XXX.XXX.XXX.XXX
set extintf "wan1"
set portforward enable
set mappedip "XX.XX.XX.XX"
set extport 5060-5061
set mappedport 5060-5061
next
edit "SIP2"
set uuid
set extip XXX.XXX.XXX.XXX
set extintf "wan1"
set portforward enable
set mappedip "XX.XX.XX.XX"
set extport 5090
set mappedport 5090
next
edit "SIP3"
set uuid
set extip XXX.XXX.XXX.XXX
set extintf "wan1"
set portforward enable
set mappedip "XX.XX.XX.XX"
set extport 9000-9500
set mappedport 9000-9500
next
edit "SIP4"
set uuid
set extip XXX.XXX.XXX.XXX
set extintf "wan1"
set portforward enable
set mappedip "XX.XX.XX.XX"
set protocol udp
set extport 5060-5061
set mappedport 5060-5061
next
edit "SIP5"
set uuid
set extip 10.0.0.34
set extintf "wan1"
set portforward enable
set mappedip "XX.XX.XX.XX"
set protocol udp
set extport 5090
set mappedport 5090
next
edit "SIP6"
set uuid
set extip XXX.XXX.XXX.XXX
set extintf "wan1"
set portforward enable
set mappedip "XX.XX.XX.XX"
set protocol udp
set extport 9000-9500
set mappedport 9000-9500
next
edit "SIP7"
set uuid
set extip XXX.XXX.XXX.XXX
set extintf "wan1"
set portforward enable
set mappedip "XX.XX.XX.XX"
set extport 10600-10999
set mappedport 10600-10999
next
edit "SIP8"
set uuid
set extip XXX.XXX.XXX.XXX
set extintf "wan1"
set portforward enable
set mappedip "XX.XX.XX.XX"
set protocol udp
set extport 10600-10999
set mappedport 10600-10999
next
edit "SIP9"
set uuid
set extip XXX.XXX.XXX.XXX
set extintf "any"
set portforward enable
set mappedip "XX.XX.XX.XX"
set extport 5001
set mappedport 5001
end

config firewall vipgrp
edit "SIP"
set uuid
set interface "wan1"
set member "SIP1" "SIP2" "SIP3" "SIP4" "SIP5" "SIP6" "SIP7" "SIP8" "SIP9"
next
end

config firewall policy
edit 38
set name "SipServerOut"
set uuid
set srcintf "lan"
set dstintf "wan1"
set srcaddr "Sip Server"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
next
edit 30
set name "SipUSInt"
set uuid
set srcintf "wan1"
set dstintf "lan"
set srcaddr "VOIPServer"
set dstaddr "SIP"
set action accept
set schedule "always"
set service "ALL"
set logtraffic all
next
 
  • Like
Reactions: Evolute IT and Kevin@voxtelesys
Status
Not open for further replies.

Latest Posts

Forum statistics

Threads
111,991
Messages
590,167
Members
164,929
Latest member
Cloudstar
3CX Logo Footer Copyright © Sitemap Privacy
Top Bottom