Have questions regarding your SIP ALG? You’re not alone. That’s why we’ve build this comprehensive guide to explain what SIP ALG is and how to disable it. To quickly find an answer to your question click any of the links in the table of contents below. Or continue reading to learn everything there is to know about SIP ALGs.
Table of Contents
- What is SIP ALG?
- What is NAT filtering?
- Should I disable SIP ALG?
- How do I troubleshoot SIP ALG?
- How do I disable SIP ALG?
If you own a commercial VoIP telephony system, you can thank SIP (Session Initiation Protocol) for you being able to run your office communications from a single computer. Having all local and international calls, chat boxes, and video or audio conferencing options accessible with a touch of a button from your desktop is a super-efficient way to communicate at work.
SIP phones, or if we use the more generic term SIP endpoints, are intelligent with their own computer language in which they communicate, using various protocols as grammar rules. SIP is only one of them.
Your VoIP PBX uses over 65 protocols to enable smooth communication across all devices.
RTP, used for audio and video, and FTP, used for standard file transfers, are two major protocols that play a role in how you are able to hear a voice from a long-distance call.
Although SIP-based networks are solving many former business communication problems, those solutions are not perfect.
SIP lines are like bottlenecks that connect your LAN (Local Area Network) to the public Internet. The point of connection between public and the private network is vulnerable. If you combine this weakness with the variety of routers, softphones, and servers in your office, you can end up with “crossed wires”.
This is not a rule, but it happens, especially when the network is engaged in full force on a busy day.
SIP is critical for your local network security because it enables different data packets to enter from the outside to your local network. However, not all data that comes from public networks is friendly; this is why SIP lines cannot be left without a security support mechanism. SIP ALG (Application Layer Gateway) is the mechanism that helps secure sessions between local and public networks.
SIP ALG (Application Layer Gateway) is a security component of most commercial routers. Used as a support for router firewalls, it modifies fax and audio data packets, helping your LAN let the right packets pass while keeping the hazardous data files at bay.
SIP ALG solves NAT-related issues of older commercial router models. Both security components, NAT (Network Address Translation) and SIP ALG can coexist in the same router, sometimes creating mixed signals in how or if data packets from the public telephony can reach your local devices.
Although NAT and SIP-ALG share the same purpose, they don’t necessarily speak the same language. If you have the SIP ALG on, which most routers do by default, some of the voice files won’t ever reach your office phones. This will result in missing calls, broken lines, and sudden session endings.
Brief History of SIP ALG
SIP ALG was first created as a solution to the security issues of older VoIP telephones. Most older IP-based phones couldn’t use firewalls, such as the NAT (Network Address Translation) and had to rely on SIP ALG to re-write or modify audio and data, making it readable by a public IP address.
In a similar way, but using a bit different technology, NAT firewalls of advanced routers translate between public and private Internet addresses, letting the right devices get registered by the VoIP network, and preventing someone else from using your Internet connection while making phone calls at your expense.
When it’s on, SIP ALG creates problems because the data and voice packets sent from your local servers access the public Internet with removed private IP addresses. When a return message needs to get back to your local phone, it can’t recognize the original device where it came from because its IP address has been removed by SIP ALG.
In a way, SIP ALG can backfire, causing more issues than it solves while acting as an unreliable traffic inspector.
Your router’s firewall is based on NAT filtering.
NAT was developed in 1994 as a solution to the lack of public IP addresses. It changed the nature of the early-age Internet from a peer-to-peer network model to a closed-network model. NAT devices were used to set up gateways for closed network circles, create scalable LANs as we know them today, and use them at home or at work.
A NAT (Network Address Translation) filter is very important for SIP. Local VoIP devices have their own private IP addresses and cannot communicate with the public Internet unless there is a translation component.
NAT routers act as translators, enabling communications between public and private IP addresses by translating the private IP addresses from multiple devices into one shared public IP address or vice versa.
- Outbound messages are translated to the public IP address.
- Inbound messages are translated to the private IP address.
How NAT and SIP ALG Work Together
Messages sent by using NAT and SIP ALG at the same time get lost in translation because SIP (Session Initiation Protocol) contains IP addresses in the message header and in the message body.
The SIP message header contains information about the caller and the receiver. The SIP message body contains another protocol information – SDP or Session Description Protocol.
SDP, in turn, contains information about IP addresses and port numbers used for media transmission. When NAT gets into the game and translates only bits of the message, such as the IP addresses, other resources, such as the media, can become unrecognizable.
If you are wondering whether you should turn your SIP ALG (Application Layer Gateway) on or off, the short answer is – keep it off. Since this is not the conventional factory setting for a router, you need to disable SIP ALG by either getting in touch with your VoIP provider or following a set of instructions developed for your specific router model.
If you leave the SIP ALG on, it can create problems when you least expect, cutting off important business conversations, stopping important calls from reaching to your office or being unable to establish two-way audio transmissions.
How Can SIP ALG Negatively Affect VoIP?
Your office VoIP phones have unique IP addresses. IP addresses are strings of numbers that serve as digital IDs for computer devices. This is how your business partner from another city knows it is you making the call – his or her VoIP phone display will present the information not as the string of numbers but by identifying your profile details.
In a similar way you are able to recognize your partner by their name or picture on the phone display because your device uses their IP address as a digital identifier.
The problem is that SIP ALG must change your softphone’s private IP address to make it readable by the public Internet system and by the cloud servers included in the SIP network.
What happens when SIP ALG is turned on on your router?
The private IP address from a specific phone is modified into a public IP address by SIP ALG.
Phone data is sent to the cloud VoIP servers in a public IP address format.
Cloud VoIP server uses the public IP address to return the message back to the caller.
Caller’s phone system is not able to recognize the exact phone it needs to deliver the return message to, since SIP ALG removed its private IP address.
Your router will receive all return messages as coming from one device with an identical IP address and won’t be able to distribute the inbound message to the right device.
Since office phone systems based on VoIP typically include more than one phone or fax machine, each with a separate IP address, SIP can create multiple problems in this back and forth call retrieval.
Problems Caused by the SIP ALG
Most SIP ALG problems are noticed on calls and faxes and can start as early as the call is initiated. Below are the most common issues that can occur:
1. Call Registration, Dropped Calls, and Failed Call Transfers
Once you pick up a phone call, the call gets dropped. You won’t be able to transfer calls, put calls on or off hold, or park calls. Being unable to park calls takes away a key feature of VoIP phones – the possibility to transfer calls between devices.
2. Non-Functioning Hunt Groups
Certain devices fail to register in the cloud SIP network or are just incapable of receiving data. Phones in hunt groups (groups with automatic call distribution) won’t ring as required.
Some inbound calls can go straight to voicemail and some will get cut off with an error message being returned to the caller.
4. Fax Issues
Fax machines are unable to receive faxes, falling at the moment of transmission.
5. Audio Fails
SIP ALG will create one-way audio only, preventing audio data from reaching your network.
Why Incoming Calls Fail
Problems with incoming calls show up due to the ‘Register’ request in the UA feature of SIP proxies. This request is used to localize and reach the user who needs to receive the incoming call.
The problem starts when the SIP ALG rewrites the ‘Register’ request. This results in the proxy being unable to detect the NAT, in turn preventing incoming calls from reaching the desired destination.
Troubles in SIP Signalling
Breaks in SIP signalling arise because of incorrect modification of SIP message headers and SDP message bodies. A SIP ALG built-in feature can create problems by:
- Partially modifying the private IP address
- Missing or skipping parameters in the SIP message
- Rewriting the message with incorrect port values
When Will Problems Arise?
SIP ALG (Application Layer Gateway) is unpredictable. It follows its own set of rules and makes independent decisions about the point at which it will activate to inspect SIP packets from the incoming traffic.
This can really happen at any point: once you set up your office PBX phone system or later when the SIP ALG algorithm is triggered by a certain traffic pattern.
The trouble is that most routers with factory settings come with the SIP ALG on and are incapable of supporting the complex instructions of multiple protocols in a VoIP network. Your router can ignore the ‘disable SIP ALG’ option altogether unless it’s properly configured by following a strict set of instructions. Still, unless you want to wait for a professional, there is always something you can do about it.
The easiest way to handle SIP ALG issues is by switching ports.
In a way, ports are for protocols what protocols are for routers (and for other SIP devices). A port is a 16-bit number for identifying specific applications, for example, FTP or HTTP servers that use open ports on local computers to track connection requests.
If you switch from port 5060 to port 5062, you will be able to circumvent the router’s built-in SIP ALG, which, as a general rule, affects only port 5060.
Nextiva routers have this feature preemptively configured for its customers, thus saving you a lot of missed, failed, and poorly distributed calls.
If your business VoIP telephony is provided by Nextiva, our support team is ready to help you prevent SIP ALG from interfering with your phone calls. If not, we recommend consulting with your provider before configuring any device.
Most commercial router configurations have their own set of rules for configuring SIP ALG.
To disable SIP ALG on a specific brand, locate your router model in the alphabetical table below and follow the instructions.
Disclaimer: Please consult with an IT or a network professional before making any changes to your router to avoid additional problems.
How to Disable SIP ALG
(Note: Unless you have the Windows telnet client installed, you will need to do that now by locating the Telnet Client in the Windows Programs and Features, and turning it on.)
ZyXEL ZyWALL USG
Still Having Problems?
Call Nextiva on (800) 285-7995 to talk to a support agent and to learn how we can improve your VoIP experience. As the top-ranked VoIP provider in the country, our Amazing Service team is ready to can help your business with all its communication needs.
Cameron Johnson is a market segment leader at Nextiva. Along with his articles on Nextiva’s blog, Cameron has written for a variety of publications including Inc. and Business.com. Cameron was recently recognized as Utah’s Marketer of the Year.