Using the MGCP predefined service

[#1]

Article

Description	The MGCP pre-defined firewall service can be used by call agents and media gateways in distributed Voice Over IP (VoIP) systems. The MGCP pre-defined service is compliance with RFC 3435 and can be used for MGCP calls through a FortiGate unit.
Components	FortiOS v3.0 MR6
Steps or Commands	In a typical MGCP scenario, an MGCP phone connected to the Internet can communicate with an IP phone on a private network. The FortiGate unit needs to be operating in NAT/Route mode with NAT enabled. You need to configure a virtual IP and create two firewall policies to allow calls from the MGCP phone on the Internet to the IP phone on the internal network. Configure a Virtual IP First, create a virtual IP address for the MGCP call agent, which you will use in the firewall policies. To configure a virtual IP for the MGCP call agent on the FortiGate external interface Go to Firewall> Virtual IP> Virtual IP. Select Create New. Configure the virtual IP address: Name Name of the MGCP call agent. External Interface External Type Static NAT External IP Address The external IP address that you want to map to an address on the destination network. This will be the virtual IP for the call agent. Map to IP The real IP address on the destination network to which the external IP address is mapped. Select OK. Add Firewall Policies You need to add two firewall policies for the MGCP phone traffic. One will enable the MGCP phone to contact the MGCP call agent, the second will allow an IP phone on the internal network to call the MGCP phone. To add a firewall policy for the MGCP phone to register with the MGCP call agent Go to Firewall> Policy and select Create New. Configure the policy using the following settings: Source Interface External Source Address IP of the MGCP phone. Destination Interface Internal Destination Address The virtual IP for the MGCP call agent. Schedule Always Service MGCP Action ACCEPT NAT Enable Select OK. To add a firewall policy that allows calls from the IP phone on the internal network to the MGCP phone. Go to Firewall> Policy and select Create New. Configure the policy with the following settings: Source Interface Internal Source Address IP of the IP phone. Destination Interface External Destination Address The virtual IP for the MGCP call agent. Schedule Always Service MGCP Action ACCEPT NAT Enable Select OK.