In the 'default' VOIP profile which is used for all calls, SIP IP address conservation is enabled by default (i= field is added). This may fail over multiple NATs.įor the SIP ALG, u se the following command to disable SIP IP address conservation in the VoIP profile The problems may arise when the SIP server choses to use the 'i=' record (which may be a local IP) for the return path. This is useful for example when the local phones are tracked individually on the SIP server, instead of only one IP (public IP of FortiGate). If the SIP server can retrieve information from the SDP i= line, it can be useful for keeping a record of the source IP address of the originator of a SIP message when operating in a NAT environment.

NAT with IP address conservation (also called SIP NAT tracing) changes the contents of SIP messages by adding the source IP address of the originator of the message into the SDP i= line of the SIP message. This is done by default whether SIP ALG or SIP session-helper is used. In a SIP session with SNAT or DNAT, the original source IP address of the SIP message is preserverd in the 'i=' line of the SDP header. This is enabled by default in SIP ALG or SIP session-helper and should be left unchanged. Generally, the original IP address and port from the SIP contact is required in SDP header after the NAT (details below). This article describes that in a source or destination NAT firewall policy that accepts SIP sessions, it is possible to configure the SIP ALG (or the SIP session helper) to remove the original source IP address of the SIP message in the Session Description Protocol (SDP) profile.

Sip alg fortigate