Configuring FortiGate Firewall for Mitel OpenScape Business

Configuring FortiGate Firewall for Mitel OpenScape Business

👋 Introduction

Hey there! So you’ve got yourself a shiny Mitel OpenScape Business system and a FortiGate firewall that need to play nice together? You’re in the right place!

I previously wrote a guide for Orange Cloud Telephony , and now it’s time to tackle the on-premise beast.

🎯 What You’ll Learn

This guide covers the essential baseline configuration that every OpenScape Business system needs. Think of it as the foundation - without this, your System won’t work properly!

💡 Good to Know
OpenScape Business can have optional features like MyPortal@Work and Unify Phone. We’ll tackle those in separate articles (links coming soon!). This guide focuses on getting the core system operational.

V3 vs V2 Systems

This guide is specifically for V3 mainboard systems. Why does this matter?

  • V3 (New): Single board, single IP - simple!
  • V2 (Old): Had a separate OCAB module with its own NIC and IP address - complicated!

Since V2 is outdated, we’re focusing on the modern V3 setup.

🚫 Step 1: Disable SIP ALG (The Phone Killer!)

FortiGate’s SIP-ALG feature is like that helpful friend who always makes things worse by “helping.” It modifies SIP packets, and telephony systems hate that. Let’s turn it off!

⚠️ BACKUP FIRST!
Before touching anything, backup your firewall config. Future you will thank present you if something goes sideways!

🔧 Disable SIP ALG and SIP NAT Trace

The commands differ based on your FortiOS version. Check which one you have:

📌 For FortiOS ≥ 6.2.2 (Most Modern Systems)

What does this do?

  • ❌ Disables SIP-ALG expectation
  • ❌ Disables NAT trace
  • ✅ Sets VOIP ALG to kernel-helper-based (prevents packet modification)

📌 For FortiOS < 6.2.2 (Older Systems)

Same effect, slightly different command syntax. Easy peasy!

🗑️ Remove the SIP Session Helper

The session helper also processes SIP packets via ALG. We need to find it and delete it!

First, let’s find it:

You’ll see output like this:

edit 13
    set name sip
    set protocol 17
    set port 5060
next
end

🎯 Important!
In this example, the helper ID is 13. DON’T assume yours is 13 too! Always check your own output before deleting.

Now delete it (replace 13 with YOUR ID):

Disable RTP Processing

RTP carries your actual voice data. Let’s make sure FortiGate doesn’t touch it!

Step 1: Disable RTP in the VoIP profile

Step 2: Completely disable SIP in the VoIP profile

These commands ensure FortiGate leaves your audio streams completely alone. Crystal clear calls, here we come!

💡 Pro Tip: Reboot (Optional but Recommended)
Most changes take effect immediately, but it’s good practice to reboot after removing the session helper:

📦 Step 2: Create Address Objects, Groups & Services

Time to tell FortiGate exactly where OpenScape Business needs to go! We’re creating a comprehensive service group with all the ports, IP ranges, and FQDNs.

🎨 Create Custom Services

Copy and paste this entire block into your FortiGate CLI. It creates all the necessary service definitions in one go:

🌈 Color Coded for Organization!
Notice the set color commands? They make your objects easier to identify in the GUI. Feel free to adjust the colors to your liking!

🎉 Result: You now have a service group called Osbiz_Services containing all necessary services!

OSBIZ service group example

📍 Create Address Objects

Now let’s create address objects for all the IP ranges and FQDNs. Same drill - copy and paste this entire block:

🎉 Result: You now have an address group called Osbiz_destinations with all destinations!

created_address_group_Osbiz_destinations

🔐 Step 3: Create Firewall Policies

Time to tie it all together with firewall rules! Here’s how to set up your policy correctly:

Example Osbiz Policy

📋 Policy Configuration Checklist

Follow these settings exactly for best results:

SettingValueWhy?
1️⃣ NameSomething descriptive like “Allow_OpenScape_Business”Keep it clear for future you!
2️⃣ Incoming InterfaceYour voice subnet interfaceWhere the telephony devices live
3️⃣ Outgoing InterfaceWAN or SD-WAN virtual interfaceYour internet connection
4️⃣ SourceOpenScape Business system IPSpecific IP of your Telephony system
5️⃣ DestinationOsbiz_destinations groupThe address group you created
6️⃣ ServiceOsbiz_Services groupThe service group you created
7️⃣ ScheduleAlwaysSelf-explanatory!
8️⃣ ActionACCEPTLet the traffic through

⚠️ Security Profiles: Don’t Touch!
Leave all security profiles DISABLED for this rule. UTM inspection isn’t needed for trusted telephony backend connections and can cause issues!

💡 Logging Tip
Enable logging if you want visibility into the traffic. It’s helpful for troubleshooting!

✅ Final Steps

  1. Save the policy
  2. Enable the policy
  3. Move it up in the policy list so it’s evaluated before any broader deny rules
  4. Test your phones - they should work perfectly now! 📞✨
  5. Add a General firewall rule for Https,DNs & NTP as described below

🌐 Generic Voice Subnet Rule

As a final touch, I recommend creating a generic firewall policy for the entire voice subnet. This allows phones to access general internet services while maintaining security.

🎯 What to Allow

Create a rule that permits from your full voice subnet to internet for:

  • 🌍 DNS - Name resolution
  • 🌐 HTTP/HTTPS - Web access
  • ⏰ NTP - Time synchronization

🛡️ Security Difference

🔐 Important Security Note:
ENABLE all security profiles on this generic rule! Unlike the specific OpenScape rule, this one is more broad and needs UTM protection.

This approach gives you:

  • ✅ Specific, trusted connections for OpenScape (no security profile interference)
  • ✅ General internet access for phones with full security scanning
  • ✅ Best of both worlds!

🎊 You’re Done!

That’s it! Your FortiGate is now properly configured to handle Mitel OpenScape Business traffic without any interference. Your phones should be crystal clear, and your users should be happy! 🎉

🆘 Troubleshooting Quick Tips

If something isn’t working:

  • ✅ Double-check that SIP ALG is really disabled (use show to verify)
  • ✅ Verify your firewall policy order (specific rules before generic ones)
  • ✅ Check the logs to see if traffic is being blocked
  • ✅ Make sure you’re using the correct OpenScape Business system IP address

📚 Sources & Additional Resources

Technical References:

Related Downloads:

📄 Download Latest Osbiz Firewall Settings (PDF)

🔜 Coming Soon

Stay tuned for additional guides covering:

  • 🌐 MyPortal@Work configuration
  • 📱 Unify Phone app setup
  • 🎯 Optional OpenScape Business features

Links will be added here once published!

Made with ❤️ for the telephony community. Questions? Feel free to reach out!