Enable Panasonic SIP on FortiGate -- 2

My Panasonic NX500 PBX sits on 192.168.1.0 but cannot “see” the rest of my network. Everything else flows through a FortiGate 60F firewall, a FortiSwitch 424E-Fiber core, and a FortiSwitch 124F-FPOE at the edge. I need someone to shape the network so this Panasonic box can handle VoIP communication smoothly.

What I already know
• The PBX will run pure SIP.
• Dedicated VoIP rules on the FortiGate are required; simple, generic access is not enough.

What I need from you
• Review the current FortiGate policy set, VLAN layout, and switch port profiles.
• Create or adjust firewall rules, NAT, and any SIP ALG or helper settings so that SIP registration, signalling, and RTP streams pass without one-way audio or dropped calls.
• Tag or untag the appropriate switch ports and trunks on the 424E-Fiber and 124F-FPOE so the PBX shares the correct voice VLAN with the rest of the phones.
• Verify end-to-end connectivity by placing at least one successful internal and one external call.

I can provide remote GUI/CLI access to the FortiGate and both switches, current config backups, and a quick diagram of the network. Once the PBX and phones talk happily, the job is done.