Skip to main content
How do I configure my Fortinet Fortigate 60D router for 8x8 service?
8x8 Support Knowledge Base

How do I configure my Fortinet Fortigate 60D router for 8x8 service?

Note: We highly recommend consulting an IT or network professional when configuring advanced network settings or devices.

For your convenience, routers and firewalls pre-configured for optimal QoS are also available from 8x8. Contact your 8x8 Sales representative to ask about ordering.

See also: Virtual Office Technical Requirements

Important Information about Fortigate Firewalls and 8x8 Service

After testing the Fortigate series firewalls and working with Fortigate support, Support Engineers have found there are issues with the NAT configuration on these devices.

While the Firewall is not unsupported, users with these devices will run into the following issues using a Fortigate:

  1. Dropped calls
  2. One way or no way audio 
  3. Potential device registration issues
  4. Duplicate SIP Ports and port shuffling

To mitigate some of these issues, Strict Register should be disabled to stop all phones from using a pinhole through port 65476 (external) and 5060 (internal). After this is complete, set the local SIP ports on each phone to unique port assignments.

Delete SIP Firewall

  1. In the Command Line Interface (CLI) run the following commands:
    • config system session-helper
    • show
  2. Notice that edit 13 contains SIP.
  3. Enter the following commands:
    • delete 13
    • end

Disable SIP Helper

  1. In the Command Line Interface (CLI) run the following commands:
    • config system settings
    • set default-voip-alg-mode kernel-helper-based
    • set sip-helper disable
    • set sip-nat-trace disable
    • end
  2. Reboot the router using the web GUI under Status, or in the CLI with the following command:
    • execute reboot

Disable Strict Register

Strict Register forces VoIP devices through a pinhole at port 65476 and will cause duplicate porting to occur.

To disable this setting run the following command in the Command Line Interface (CLI):

  • config voip profile
  • edit <Profile_name>
  • config sip
  • set strict-register disable
  • end

 

Note: The VoIP profile name can be found under Security Profile -> VoIP

VoiP Profile.PNG

Configure Traffic Shaping and VoIP

  1. In the web GUI, go to System > Feature Select > Additional Features.
  2. Toggle Traffic Shaping and VoIP on.
  3. Click Apply.

Create 8x8 Objects

  1. In the web GUI, go to Policy & Objects.
  2. Select Objects, then Addresses.
  3. Click Create New, then click Address.
  4. You will need to add each subnet in the format xxx.xx.xx.x/xx.
  5. Do this for each of the 8x8 US subnets listed in the Virtual Office Technical Requirements document.

Group the 8x8 Networks

  1. In the web GUI, go to Policy & Objects.
  2. Select Objects, then Addresses.
  3. Click Create New, then click Address Group.
  4. Create a Group Name.
  5. Click Members, click each subnet, then click OK.

Set High-Priority Traffic Guarantee

  1. In the web GUI, go to Policy & Objects.
  2. Select Traffic Shapers.
  3. Edit the existing High Priority Traffic Shaper.
  4. Set Type to Shared.
  5. Set Apply Shaper to Per Policy.
  6. Set Traffic Priority to High.
  7. Check Max Bandwidth and set to 1048576 Kb/s.
  8. Check Guaranteed Bandwidth and set to 1000 Kb/s.
  9. Click OK.

Create a New Policy

  1. In the web GUI, go to Policy & Objects > Policy.
  2. Select IPv4.
  3. Create a new policy.
  4. Set the following options:
    • Incoming Interface: Internal
    • Source Address: All
    • Outgoing Interface: WAN
    • Destination Address: 8x8-networks
    • Service: All
    • Service: SIP, RTSP
  5. Click OK.

Arrange Policy

  1. In the web GUI, go to Policy & Objects > IPv4 Policy.
  2. Double-click the 8x8 policy.
  3. Drag and drop the All 8x8-Networks policy to the top spot.

Verify Traffic

Start a call and download some large traffic (e.g., https://www.nasa.gov/content/ultra-high-definition-video-gallery shown below) or use a tool like iperf.

Review Traffic Shaper Monitor

  1. In the web GUI, go to Policy & Objects > Monitor.
  2. Select Traffic Shaper Monitor.
  3. Note that since the default traffic is left alone, it doesn’t show in the Traffic Shaper Monitor. Only the reserved traffic displays, in this case high-priority.

 

Additional Information: 

Firmware updates may re-enable some system settings. After a firmware update if you begin to experience issues with the phones again, verify the firewall still has the proper configuration.