One way audio

[Phillip.palmer]

I have seen lots on the net about one way audio and mostly always points to the firewall but I just can't see what I have done wrong.
I will try to explain what has been done.

We have a mitel 3300, our network is small so we only have the one van, let's say 192.168.10.0/24.
Our mitel switch is 192.168.10.60, with a gateway of 192.168.10.1, dhcp is being via a server so switched off on the mitel, the want port is also disabled and the subnet is in the ip network parameters.

We have a fortinet 60d firewall.
I have created inbound and outbound rules.
Internal to wan - source = mitel switch, destination = any, NAT = enabled using outgoing port ( let's say 234.123.123.10)

Wan to internal - source = any, destination = mitel vip, NAT = mitel_ippool

The mitel vip is a straight one to one static nat 234.123.123.11 to 192.168.10.60
The mitel Ippool is an external range containing  just 234.123.123.11

Sip helper has been deleted and sip alg in the voip profile disabled.

When I call a mobile from a mitel phone they can hear me but I can't hear them.

Hopefully someone can point me in the right direction.
(Ip addresses are fictitious)

[x-man]

You'll need to open some RTP ports as well. Both ways wan to lan andlan to wan. We had trouble with a fortinet (looked after by IT company) and it took them some time to get it to work. Sorry don't know what they did but I suspect it was the RTP ports. I read somewhere recently that later software on the Mitel can use the SIPAlg.

[Phillip.palmer]

Thanks for the help.
Just added rtp 50000-500127 udp both ways but still getting one way audio.
Also we have a dial through auto attendant setup and that isn't working either.
I'm new to fortinet so may have to get their support involved.

[x-man]

Auto attendant on the 3300 using embedded one? Whats the problem?

[Phillip.palmer]

I dont think the problem is with the configuration of the auto attendant, but a symptom of the firewall/routing problem we seem to have.

We currently have the mitel configured with the lan connection only, the mitel has internet, the sip trunks have registered ok, internal voice works both ways, but when making or receiving an external call the audio is always one way,

The external person can hear audio but the internal person using the mitel phone cant.

Our firewall currently is allowing all services both ways to and from the mitel and we have nat translation:
lan to wan using an ip pool one to one
wan to lan using a virtual ip address

[x-man]

Yup, sounds like a firewall issue. Are you sure SIPAlg is OFF?

What level of software on the 3300?

[Phillip.palmer]

Release Level 7.2
Active Software Load 13.2.0.17
inactive software load 13.0.1.28

Hopefully thats the correct info.

I have turned off sip alg, currently have a ticket open with fortinet to rectify the problem, currently waiting for a call back.

I performed the following

Step One: Disable SIP Helper!
1.config system settings
2.set  sip-helper disable
3.set sip-nat-trace disable
4.REBOOT THE DEVICE!!! (You may want to wait on rebooting until AFTER you do the next few steps!)

Step Two: Delete the SIP Helper
1.config system session-helper
2.show (Look for the SIP helper, often object 12)
3.delete # (whatever number the SIP helper was)

Step Three: Disable RTP Processing
1.config voip profile
2.edit default
3.config sip
4.set rtp disable

[x-man]

Is disable RTP processing SIPalg?......otherwise I would think you need it. Unless you are making sure you are opening rtp ports BOTH ways. Lan to Wan and Wan to Lan. You may even need it as well (assuming its not SIPalg)

[Phillip.palmer]

Thanks for all your help.
We managed to get it workingredients in the end, our network guy in the USA created a voip profile and disabled nat traversal on the outbound and it is now working.
I couldn't see him making the changes but that's what he told me. We are going to go through it next week so I will leave this post open and detail what we done incase others have this problem.

[x-man]

Makes sense, NAT would cause problems unless using a stun server...