Required Ports & Settings for VoIP Service (All Firewall Models)

For Winet SIP Trunk

Phone system or phone terminals on the customer's LAN

For Winet Ayrix & hostedPBX

Additional Settings for Specific Firewall Models

Here you'll find screenshots and quick guides for the most common firewalls.

Fortigate (Fortinet)

We recommend following these instructions: http://kb.fortinet.com/kb/documentLink.do?externalID=FD33271

How to Disable SIP-ALG (SIP Helper) on Fortinet

Open the FortiGate CLI from the dashboard. Enter the following commands in the FortiGate CLI:

  config system settings
  set sip-helper disable
  set sip-nat-trace disable
  reboot the device

Reopen the FortiGate CLI and enter the following commands (do not enter the text after //)

  config system session-helper
  show // You need to find the entry for SIP, usually 12, but it may vary
  delete 12 // or the number you identified from the previous command

Create a rule and configure it as shown in the image above. Reboot the device, and you should be all set.

Disable RTP processing as follows

  config voip profile
  edit default
  config sip
  set rtp disable

Depending on what is configured as the default support, SIP support can be completely disabled.
The following code sets the SIP SessionHelper as the «default» support and then removes it.
As a result, the Fortigate can no longer provide SIP support because the session helper it is configured to use no longer exists.

Set the base support to the SessionHelper (kernel-helper-based):

  config system settings
  set default-voip-alg-mode kernel-helper-based
  end

Delete the SIP session helper (as described above):

  config system session-helper
  show
 ...
 edit 
 set name sip
 set protocol 17
 set port 5060
 next
    ...
  delete 
  end

You can find a complete guide to VoIP configuration for FortiOS 5.6 in this document: https://docs.fortinet.com/uploaded/files/3611/fortigate-sip-56.pdf

pfSense

pfSense does not include SIP-ALG by default.

Adjust the UDP session timeout:

SonicWall

SonicOS 6.5

SIP-ALG is called «SIP Transformations» in SonicWall. Please disable Try this setting:

Adjust the UPD session timeout (at least 300s):

SonicOS 5.9

SIP-ALG is called «SIP Transformations» in SonicWall. Please disable Try this setting:

Adjust the UPD session timeout (at least 300s):

Sophos

On the Sophos firewall, the UDP session timeout setting is changed via the console using the following command (set it to at least 300 seconds):

or

Disable the SIP module (also known as SIPALG) as follows:

1. Log in to the CLI using Telnet or SSH. You can also access the CLI from admin > Console in the upper-right corner of the Admin Console screen.

2. Select an option4. Device Console.

3. Run the following command(s):

Zyxel USGxx

Adjust Settings via the GUI

Adjust the UDP session timeout (to at least 300 seconds):

SIP-ALG disable:

After this setting has been adjusted, a Restarting the firewall is required.

If any of these settings are not available, you must first perform a firmware upgrade to the latest version.

Check and Adjust the UDP Session Timeout via Telnet

1. Enable Telnet on USG
   
2. Enable the Telnet client on your PC (Control Panel -> Programs & Features)
3. Configure the following settings via Telnet: - Zywall IP address - Username: admin - Password:

   – configure terminal (Switch to command mode)

   – show session timeout udp (Check values; default values: Connect 9, Deliver 300 sec.)

   – session timeout udp-connect 300 (change the UDP connection timer)

   – session timeout udp-deliver 300 (change the UDP deliver timer if it is not set to 300 seconds)

   – show session timeout udp (Check the values; both must be 300 sec.)

   – exit (exit command mode)

   – exit (end the Telnet connection)
   

The following ZyWall script also works:

configure terminal 
session timeout udp-deliver 300
session timeout udp-connect 300 
no alg sip transformation 
no alg sip inactivity-timeout 
no alg sip 
write