Fortinet FortiGate Series Administration Guide

Configuring SIP SIP support
FortiGate Version 4.0 MR1 Administration Guide
510 01-410-89802-20090903
http://docs.fortinet.com/ • Feedback
You need to configure the FortiOS SIP support in the following order:
1 Create a firewall protection profile that enables SIP (see “Enabling SIP support and
setting rate limiting from the web-based manager” on page 510).
Once the profile is included in a policy, the ALG will parse the SIP traffic and open the
RTP ports for each specific VoIP call.
When creating a protection profile, you configure SIP features using the web-based
manager and CLI. You then apply the profile to a firewall policy. You can apply a profile
to multiple policies.
2 Create a firewall policy that allows SIP and includes a SIP-enabled protection profile.
Specifically, select the SIP or ANY pre-defined service for the policy.
When the FortiGate unit receives a SIP packet, it checks the packet against the firewall
policies. If the packet matches a policy, the FortiGate firewall inspects and processes
the packet according to the SIP profile applied to the policy.
For more information about firewall policies, see “Firewall Policy” on page 387.
3 Configure advanced SIP features as required (see “Configuring SIP” on page 510).
Configuring SIP
You can enable SIP support, set two rate limits, enable SIP logging, and view SIP
statistics using the web-based manager. You can do this plus configure many other SIP
support features from the CLI.
Enabling SIP support and setting rate limiting from the web-based manager
To enable SIP support you need to:
• enable SIP in an application control list
• select this application control list in a protection profile
• add this protection profile to a firewall policy that accepts SIP traffic.
From the web-based manager, you can also configure some SIP rate limiting settings.
Rate limiting for SIP also limits SIMPLE traffic. SIP rate limiting is useful for protecting a
SIP server within a company. Most SIP servers do not have integrated controls and it is
very easy to flood SIP servers with INVITE or REGISTER requests.
Enabling SIP in an application control list actually enables the SIP application level
gateway (SIP ALG) for sessions accepted by a firewall policy that includes the SIP
application.
To enable SIP and set rate limiting from the web-based manager
1 Go to UTM > Application Control.
Tip: The SIP and SCCP application control list entries are used only for enabling the SIP or
SCCP application level gateways (ALGs). They are not like any other application control list
entry. For example, you cannot use the SIP and SCCP application control list entries to
block SIP or SCCP traffic. From the CLI SIP is application number 12 and SCCP is
application number 13.
Tip: The SIP.TCP and SIP.UDP application control list entries are normal application
control list entries and are not involved with the SIP ALG. You can use the SIP.TCP or
SIP.UDP application control list entries to block SIP sessions.

Fortinet FortiGate Series Specifications

General

Model	FortiGate Series
Category	Firewall
Throughput	Varies by model
Interfaces	Varies by model
Concurrent Sessions	Varies by model
VPN Support	Yes
High Availability	Yes
Firewall Throughput	Varies by model
VPN Throughput	Varies by model
IPS Throughput	Varies by model
NGFW Throughput	Varies by model
Threat Protection Throughput	Varies by model
New Sessions per Second	Varies by model
Power Supply	Varies by model
Security Features	Firewall, IPS, Application Control, Web Filtering, Antivirus, VPN
Virtual Domains	Yes
Form Factor	Desktop, Rackmount