How VoIP profile settings determine the firewall policy inspection mode

When upgrading, all firewall policies with a VoIP profile selected will be converted to proxy-based inspection. All firewall policies that do not have a VoIP profile selected will remain in the same inspection mode after upgrading.

In the case when customers are using the following settings in 6.4:

config system settings
    set default-voip-alg-mode proxy-based
end

config firewall policy
    edit 0
        set inspection-mode flow
        unset voip-profile
    next
end

In 6.4, by default, SIP traffic is handled by proxy-based SIP ALG even though no VoIP profile is specified in a firewall policy.

After upgrading, the firewall policy will remain in inspection-mode flow but handled is by flow-based SIP inspection.

Due to the difference in which the SIP traffic is handled by flow-based SIP versus proxy-based SIP ALG inspection in 7.0.0 and later, if customers want to maintain the same behavior after upgrading, they can manually change the firewall policy's inspection-mode to proxy:

config firewall policy
    edit 0
        set inspection-mode proxy
        unset voip-profile
    next
end

Or prior to upgrading, they can assign a voip-profile to the firewall policies that are processing SIP traffic to force the conversion to inspection-mode proxy after upgrading.