By Manny Fernandez

March 26, 2026

Monkey Bites – SIP Trouble Shooting Commands

Troubleshooting VoIP on a FortiGate can feel like trying to solve a puzzle where the pieces keep moving. If you’ve ever dealt with one-way audio or dropped calls, you’ve likely encountered the SIP ALG (Application Layer Gateway) or the SIP Session Helper.

To peek under the hood and see how FortiOS is actually handling these packets, the diagnose sys sip command is your most powerful tool—specifically when you are using the SIP Session Helper (kernel-helper-based mode).

Here is a deep dive into the diagnose sys sip options and how to use them to fix your voice traffic.

Understanding the Context – Helper vs. ALG

Before running these commands, you must know which “engine” is handling your SIP traffic.
SIP ALG (Proxy-based) – Uses the diagnose sys sip-proxy commands.
SIP Session Helper (Kernel-helper) – Uses the diagnose sys sip commands.

To check which one is active, run:

show full system settings | grep default-voip-alg-mode

If it says kernel-helper-based, the commands below are for you.

Key Command Options & Use Cases

Status

diagnose sys sip status

The “Quick Health Check”

This provides a high-level overview of the SIP helper’s current workload.

What it shows – Total active SIP dialogs, NAT mappings, and hash table usage.
Use Case –  Use this if you suspect the FortiGate is overwhelmed or if you need to confirm that the session helper is actually seeing any traffic. If used=0 across the board while a call is active, your traffic is likely bypassing the helper or hitting a different policy.

Dialog List

diagnose sys sip dialog list

The “Call Tracker”

This is arguably the most important command for troubleshooting active call issues.

What it shows – A detailed list of all current SIP dialogs (calls or registrations) the FortiGate is tracking. It includes the Call-ID, source/destination IPs, and the current state of the transaction.

Use Case –  Essential for diagnosing registration timeouts. If you see a dialog for a phone registration that never clears or shows an incorrect expiration, the helper might be misinterpreting the REGISTER flow.

Mapping List

diagnose sys sip mapping list

The “NAT Checker”

SIP is notoriously bad at handling NAT because the IP addresses are embedded inside the packet payload. The session helper creates “mappings” to translate these.

What it shows –  The table of internal-to-external IP/port mappings the FortiGate is maintaining.
Use Case –  Use this to solve **one-way audio**. If the mapping shows the wrong public IP or an unexpected port, the remote carrier won’t know where to send the audio (RTP) stream.

Debug Level

diagnose sys sip debug-mask <integer>

The “Deep Dive”

This sets the verbosity of SIP-specific logging.

Common Masks –  0: Silent (default).
1 – Basic info.
255 – Detailed debugging (shows packet headers and state changes).
Use Case –  When a call fails to establish entirely. By enabling a debug mask and running `diagnose debug enable`, you can see exactly where the FortiGate decides to drop a packet or if it fails to create a “pinhole” for the audio.

Clear Dialog Tables

diagnose sys sip dialog clear

The “Reset Button”

Use Case – Sometimes SIP states get “stuck” in the kernel. If you’ve changed a firewall policy or a NAT setting and calls are still failing, clearing the dialog table forces all phones to re-register and create fresh sessions.

 

Summary Table: Which Command to Use?
Goal Command
Check if the helper is active diagnose sys sip status
See active calls/registrations diagnose sys sip dialog list
Debug NAT/IP translation issues diagnose sys sip mapping list
Clear all “stuck” SIP sessions diagnose sys sip dialog clear
See real-time packet processing diagnose sys sip debug-mask 255

 

Pro-Tip – Don’t forget the Sniffer

While diagnose sys sip tells you what the FortiGate thinks is happening, a packet sniffer tells you what is actually happening on the wire. Always pair your SIP diagnostics with a sniffer:

diagnose sniffer packet any "port 5060" 4

This ensures that the packets are reaching the interface before you start blaming the SIP helper!

 

Recent posts

  • If you've spent any time configuring user authentication on... Full Story

  • DNS is one of those technologies that quietly underpins... Full Story

  • BGP issues on FortiGate firewalls usually trace back to... Full Story

  • Every time your laptop talks to your router, a... Full Story

  • If you've spent any time configuring NAT on a... Full Story

  • If you have spent any time configuring firewall policies... Full Story

  • High availability on FortiGate is one of those features... Full Story

  • If you've configured SD-WAN on a FortiGate, you've almost... Full Story

  • FortiLink is the management protocol that turns a FortiSwitch... Full Story

  • FortiSwitches are pretty rock solid from Mean Time Between... Full Story

  • This is a quicky tip.  Have you ever gone... Full Story

  • DNS is one of those quiet pieces of internet... Full Story

  • This article is an updated version of the previous... Full Story

  • You will add ns2 as a secondary (slave) BIND9... Full Story

  • In the process of deploying my lab, I needed... Full Story

  • RFC 8805, used to be known as Self-Correcting IP... Full Story

  • Years back, I wrote an article about certificate pinning. ... Full Story

  • FortiGates have the ability to send alerts to Microsoft... Full Story

  • In this post, I am going to walk through... Full Story

  • Troubleshooting VoIP on a FortiGate can feel like trying... Full Story

  • Prior to FortiOS 7.0, there were three commands to... Full Story

  • In this post, I am going to go over... Full Story

  • What we are going to do:  We are going... Full Story

  • Choosing between FGCP (FortiGate Clustering Protocol) and FGSP (FortiGate... Full Story

  • Creating a VLAN on macOS (The "Pro" Move) A... Full Story

  • This blog post explores the logic behind how macOS... Full Story

  • Pretty Fly for a Wi-Fi Tell My Wi-Fi Love... Full Story

  • Part of my daily gig is creating BoMs (Bill-of-Materials)... Full Story

  • ICMP introduces several security risks, but careful filtering, rate... Full Story

  • The command diag debug application dhcps -1 enables full... Full Story

  • In the world of FortiOS, execute tac report is... Full Story

  • LLDP; What is it The Link Layer Discovery Protocol... Full Story

  • What it actually does When you run diagnose fdsm... Full Story

  • Monkey Bites are bite-sized, high-impact security insights designed for... Full Story

  • I have run macOS in macOS with Parallels but... Full Story

  • Don't be confused with my other FortiNAC posts where... Full Story

  • This is the third session in a multi-part article... Full Story

  • Today I was configuring key-based authentication on a FortiGate... Full Story

  • Netcat, often called the "Swiss Army knife" of networking,... Full Story

  • At its core, IEEE 802.1X is a network layer... Full Story

  • In case you did not see the previous FortiNAC... Full Story

  • This is our 5th session where we are going... Full Story

  • Now that we have Wireshark installed and somewhat configured,... Full Story

  • The Philosophy of Packet Analysis Troubleshooting isn't about looking... Full Story

  • 1. High-Level Overview The FortiGate Wireless Intrusion Detection System... Full Story

  • What MIMO Actually Does Multiple Input, Multiple Output (MIMO)... Full Story

  • A practitioner's tour of the diagnose, test, and fnsysctl... Full Story