SIP ALG (and why you should disable it)

Posted Sep 10, 2026 Updated Sep 10, 2026 8 views

Overview

A SIP ALG (Application Layer Gateway) is a feature included in many firewalls, routers, and security appliances that attempts to help SIP-based telephone traffic pass through Network Address Translation (NAT).

Although SIP ALG was originally intended to solve NAT-related problems with older VoIP systems, it can interfere with modern cloud-based IP phone systems and cause unpredictable calling or registration issues.

For most hosted VoIP deployments, including RTC Voice Cloud, SIP ALG should be disabled.

What Does SIP ALG Do?

SIP, or Session Initiation Protocol, is commonly used to establish and manage telephone calls.

Unlike many application protocols, SIP messages can contain IP addresses and port numbers inside the application data itself. For example, a phone may include information identifying where it expects to receive RTP audio.

A SIP ALG inspects these messages as they pass through the firewall and attempts to rewrite the embedded addresses or port numbers to account for NAT.

For example:

IP Phone
192.168.1.50
    |
    | SIP signaling
    v
Firewall / NAT
Public IP: 203.0.113.25
    |
    | SIP ALG may rewrite
    | addresses and ports
    v
Cloud Phone System

In theory, this helps the remote phone system communicate with a device located behind NAT.

In practice, modern cloud phone systems and IP phones already include mechanisms for handling NAT. When the firewall also attempts to modify the SIP traffic, the two mechanisms conflict and create inconsistent and unpredictable issues.

Symptoms of SIP ALG Problems

SIP ALG problems are not always obvious and may appear intermittently.

Common symptoms include:

  • Phones failing to register

  • Phones periodically becoming unregistered

  • Inbound calls failing while outbound calls work

  • Outbound calls failing while inbound calls work

  • One-way audio

  • No audio

  • Calls dropping after approximately 30 to 60 seconds

  • Calls connecting but failing shortly afterward

  • Intermittent call failures

  • Phones requiring frequent reboots

  • Only some phones at a location experiencing problems

Because SIP signaling and RTP audio normally use different network flows, it is possible for a call to successfully connect while the audio path fails.

Why SIP ALG Causes Problems

A SIP ALG may interfere with a cloud phone system by:

  • Rewriting SIP headers incorrectly

  • Changing IP addresses or port numbers unexpectedly

  • Modifying SDP information used to establish RTP audio

  • Creating dynamic firewall pinholes that conflict with normal NAT behavior

  • Expiring SIP or NAT sessions prematurely

  • Mishandling fragmented or unusually formatted SIP messages

  • Applying inconsistent behavior to different phones or calls

The result can be a call where SIP signaling succeeds but the firewall sends RTP audio to the wrong address or UDP port.

Other Names for SIP ALG

Different firewall manufacturers use different terminology for this feature.

Look for settings such as:

  • SIP ALG

  • SIP Helper

  • SIP Inspection

  • SIP Transformation

  • SIP Fixup

  • SIP Protocol Handler

  • SIP Application Helper

  • VoIP ALG

  • VoIP Helper

Disabling SIP ALG does not normally mean disabling all application-layer inspection features on the firewall. Only the SIP-related functionality should be changed unless otherwise directed.

Recommended Configuration

For RTC Voice Cloud, a the firewall or router should generally use normal stateful NAT without modifying SIP application data.

Unless otherwise instructed by RTC:

  1. Log in to the site's firewall or router.

  2. Locate the SIP ALG, SIP Helper, SIP Inspection, or equivalent setting.

  3. Disable the SIP-related ALG functionality.

  4. Save or apply the configuration.

  5. Clear existing SIP/NAT sessions if the firewall provides that capability.

  6. Reboot the affected IP phones, or allow them to re-register.

Existing firewall sessions may continue using the previous ALG behavior until those sessions expire. Restarting the phones after the configuration change helps establish new connections using the corrected firewall behavior.

Important

The exact procedure for disabling SIP ALG varies by firewall manufacturer and software version.

If you are unsure whether SIP ALG is enabled, or if call problems continue after disabling it, contact RTC support with the make and model of the site's firewall or router.

SIP ALG is one of the first firewall features that should be investigated when a cloud IP phone deployment experiences registration failures, intermittent calling problems, one-way audio, or unexplained dropped calls.

Was this article helpful?