Quadro 16x behind FortiGate Firewall

[pdiaz]

Hello Everyone:


I have installed a Quadro 16x in my work place, but I have to placed it behind a firewall (fortigate 60) you can check it at www. fortinet.com. I enabled all services in this firewall to the private IP address, but the extensions are not registering with the SIP proxy ofepygi (sip.epygi.com) and also I'm having another trouble about calling extensions. All IP lines are configured with Softphones (xlite) and sometimes when I call one extension there is a message that says "System Overloaded" and I have to reboot the quadro to get rid of this message. Does anybody has an idea of what could be happening here?


Thanks,


Pedro

[Sergio]

Please help if somebody is familiar with the mentioned type of router. Pedro says he opened all possible ports but still something prevents pakets to go back to the Quadro. From the Quadro it is impossible to ping even the default gateway:


Checking internet connectivity (ICMP ping):
Gateway (200.82.180.1): Warning: could not be reached (many ISPs block this)


Thanks

[NevisComputers]

Ok this firewall does work fine.
A few things : Firstly ensure the device doing the NAT in your network has it's SIP ALG enabled. Any other devices should have it disabled.

We ran into an issue because the ADSL router in front of the firewall had the SIP ALG still on.

Next dedicate an external IP address to your phone system on the firewall. Under firewall -> virtual IP create a new entry :

EPYGI_PBX
External Interface WAN1
Type Static NAT
external Ip X.X.X.X
internal ip 192.168.1.6

This sets up the full cone NAT for the PBX.

Now go to protection profile and create a new one called SIP.

Expand VoIP

Check SIP
Set the register limit to something low, I use 2 (are you going to get more than 2 extensions registering a second ?)
Same with invites adjust to suit.

Click ok.

Now create an address book entry internal for the QUADRO_PBX.

Finally create a new WAN1 to Internal rule

Source All
Destination QUADRO_PBX
Service SIP
Action Accept
NAT check

Protection Profile SIP.

That should do it. Out going traffic should match the existing Internal -> WAN1 rule.