How to disable SIP ALG on a Fortigate Firewall

The following article will show you how to disable the SIP ALG setting on a Fortigate Firewall.

Requirements:

• CLI access to the Fortigate Firewall

Disable SIP ALG

1. Open the CLI interface for your Fortigate Firewall
   • Before making any changes be sure to backup your configuration
2. Use the following commands for a device on FortiOS starting at 6.2.2
   config system settings set sip-expectation disable set sip-nat-trace disable set default-voip-alg-mode kernel-helper-based end
3. For devices below FortiOS version 6.2.2 use the following commands
   config system settings set sip-expectation disable set sip-nat-trace disable set default-voip-alg-mode kernel-helper-based end
4. If you encounter and error while entering set default-voip-alg-mode kernel-helper-based go ahead and ignore it
5. The rest of the configuration will be the same for all FortiOS versions
6. Run the following commands
   config system session-helper show
   • Here you will want to find the entry for SIP, this is typically 12 but it may differ depending on software version and model
     delete 12
   • Alternatively use the entry you found in the previous step
     end
7. Enter the following commands in the CLI to disable RTP processing
   config voip profile edit default config sip set rtp disable end end
8. Once done go ahead and reboot the device, Fortigate firewalls do not require a reboot when you change configuration but in this case, we will need the reboot to activate the session helper changes
9. Lastly, reboot all of your SIP Devices/Phones