FortiGate can process SIP through the SIP ALG or SIP session helper, and the exact disable procedure varies by FortiOS version and inspection design. Back up first, identify which mechanism owns the session, follow the matching Fortinet release instructions and clear only affected sessions before retesting.
Identify the FortiOS SIP processing path
FortiOS has used both a SIP ALG and a SIP session helper. Features, defaults and recommended commands have changed between releases. A copied command that deletes a numbered helper can affect the wrong entry where IDs differ.
- Record the FortiGate model, FortiOS build, VDOM, HA role and policy ID carrying the SIP flow.
- Back up configuration and ensure console or out-of-band access for rollback.
- Inspect the active VoIP profile, firewall policy, session-helper table and a representative live session.
- Confirm whether traffic is plain SIP, SIP over TLS or on a non-default port and whether central NAT is used.
The session-helper entry number is not a universal promise. Display the table and use the exact Fortinet document for the installed FortiOS release before changing or deleting an entry.
Disable the correct FortiGate SIP inspection mechanism
- 1Match the official document to FortiOS
Open Fortinet’s SIP ALG and SIP session-helper page for the exact FortiOS branch. Check release notes for behaviour changes before applying CLI.
- 2Remove SIP ALG from the policy path
If the firewall policy or VoIP profile invokes the SIP ALG, change that supported policy/profile setting so SIP is not application-layer rewritten. Preserve IPS, antivirus and other required controls.
- 3Handle the session helper only if it is active
Display system session-helper configuration, identify the entry whose name is sip and follow the version-specific Fortinet procedure. Do not assume an ID or delete unrelated helpers.
- 4Save and synchronise HA
Confirm the intended configuration on the active and standby members and monitor HA status before touching sessions.
- 5Clear only affected sessions
Use narrow source/destination/port filters and a maintenance window so existing non-VoIP traffic and unrelated calls are not dropped. New sessions are required to test the new inspection path.
Replace ALG behaviour with explicit secure policy
| Control | Recommended approach |
|---|---|
| Registered SIP | Permit the required outbound destination/port and return state; no blanket inbound VIP to a phone |
| Direct-IP SIP | Restrict policies/VIPs to issued UKDDI signalling and media sources and exact destinations |
| Management | Allow FortiGate and PBX administration only from trusted networks with MFA where supported |
| Logging | Log policy denies and session metadata without retaining SIP passwords or unnecessary call content |
| Flood/fraud protection | Keep rate, geography, dial-plan and account controls independent of the ALG |
Validate the new FortiGate session path
- 1Create a fresh registration/session
Restart only the affected registration or clear its filtered state, then confirm it uses the expected policy and no SIP helper/ALG rewriting.
- 2Test both directions
Verify inbound and outbound calls, approved caller ID and exact DDI routing.
- 3Inspect signalling and media
Confirm original Contact/SDP handling, two-way audio, keypad tones, hold, transfer and long-call stability.
- 4Monitor after the window
Watch policy denies, session counts, HA health, registration state and call quality. Restore the backed-up design if impact extends beyond the scoped change.