SIP ALG 101: Easy Steps to Disable SIP ALG On Any Router | Nextiva
Subscribe to the Nextiva blog newsletter for the latest content on Customer Service, Productivity, Marketing and VoIP.

SIP ALG 101: Easy Steps to Disable SIP ALG On Any Router

Have questions regarding your SIP ALG? You're not alone. That's why we've build this comprehensive guide to explain what SIP ALG is and how to disable it. To quickly find an answer to your question click any of the links in the table of contents below. Or continue reading to learn everything there is to know about SIP ALGs.

Table of Contents


If you own a commercial VoIP telephony system, you can thank SIP (Session Initiation Protocol) for you being able to run your office communications from a single computer. Having all local and international calls, chat boxes, and video or audio conferencing options accessible with a touch of a button from your desktop is a super-efficient way to communicate at work.

SIP phones, or if we use the more generic term SIP endpoints, are intelligent with their own computer language in which they communicate, using various protocols as grammar rules. SIP is only one of them.

Your VoIP PBX uses over 65 protocols to enable smooth communication across all devices.

RTP, used for audio and video, and FTP, used for standard file transfers, are two major protocols that play a role in how you are able to hear a voice from a long-distance call.

Although SIP-based networks are solving many former business communication problems, those solutions are not perfect.

SIP lines are like bottlenecks that connect your LAN (Local Area Network) to the public Internet. The point of connection between public and the private network is vulnerable. If you combine this weakness with the variety of routers, softphones, and servers  in your office, you can end up with “crossed wires”.

Diagram of sip lines connecting the LAN and internet

This is not a rule, but it happens, especially when the network is engaged in full force on a busy day.

SIP is critical for your local network security because it enables different data packets to enter from the outside to your local network. However, not all data that comes from public networks is friendly; this is why SIP lines cannot be left without a security support mechanism. SIP ALG (Application Layer Gateway) is the mechanism that helps secure sessions between local and public networks.

What is SIP ALG

SIP ALG (Application Layer Gateway) is a security component of most commercial routers. Used as a support for router firewalls, it modifies fax and audio data packets, helping your LAN let the right packets pass while keeping the hazardous data files at bay.

SIP ALG solves NAT-related issues of older commercial router models. Both security components, NAT (Network Address Translation) and SIP ALG can coexist in the same router, sometimes creating mixed signals in how or if data packets from the public telephony can reach your local devices.

Although NAT and SIP-ALG share the same purpose, they don’t necessarily speak the same language. If you have the SIP ALG on, which most routers do by default, some of the voice files won’t ever reach your office phones. This will result in missing calls, broken lines, and sudden session endings.

Brief History of SIP ALG

SIP ALG was first created as a solution to the security issues of older VoIP telephones. Most older IP-based phones couldn’t use firewalls, such as the NAT (Network Address Translation) and had to rely on SIP ALG to re-write or modify audio and data, making it readable by a public IP address.

how sip alg works on a grand scale

In a similar way, but using a bit different technology, NAT firewalls of advanced routers translate between public and private Internet addresses, letting the right devices get registered by the VoIP network, and preventing someone else from using your Internet connection while making phone calls at your expense.

When it’s on, SIP ALG creates problems because the data and voice packets sent from your local servers access the public Internet with removed private IP addresses. When a return message needs to get back to your local phone, it can’t recognize the original device where it came from because its IP address has been removed by SIP ALG.

In a way, SIP ALG can backfire, causing more issues than it solves while acting as an unreliable traffic inspector.

What is NAT Filtering?

Your router’s firewall is based on NAT filtering.

NAT was developed in 1994 as a solution to the lack of public IP addresses. It changed the nature of the early-age Internet from a peer-to-peer network model to a closed-network model. NAT devices were used to set up gateways for closed network circles, create scalable LANs as we know them today, and use them at home or at work.

A NAT (Network Address Translation) filter is very important for SIP.  Local VoIP devices have their own private IP addresses and cannot communicate with the public Internet unless there is a translation component.

NAT routers act as translators, enabling communications between public and private IP addresses by translating the private IP addresses from multiple devices into one shared public IP address or vice versa.

  • Outbound messages are translated to the public IP address.
  • Inbound messages are translated to the private IP address.

how NAT enables communication between devices

How NAT and SIP ALG Work Together

Messages sent by using NAT and SIP ALG at the same time get lost in translation because SIP (Session Initiation Protocol) contains IP addresses in the message header and in the message body.

The SIP message header contains information about the caller and the receiver. The SIP message body contains another protocol information – SDP or Session Description Protocol.

SDP, in turn, contains information about IP addresses and port numbers used for media transmission. When NAT gets into the game and translates only bits of the message, such as the IP addresses, other resources, such as the media, can become unrecognizable.     

Should I Disable SIP ALG?

If you are wondering whether you should turn your SIP ALG (Application Layer Gateway) on or off, the short answer is – keep it off. Since this is not the conventional factory setting for a router, you need to disable SIP ALG by either getting in touch with your VoIP provider or following a set of instructions developed for your specific router model.

If you leave the SIP ALG on, it can create problems when you least expect, cutting off important business conversations, stopping important calls from reaching to your office or being unable to establish two-way audio transmissions.

How Can SIP ALG Negatively Affect VoIP?

Your office VoIP phones have unique IP addresses. IP addresses are strings of numbers that serve as digital IDs for computer devices. This is how your business partner from another city knows it is you making the call – his or her VoIP phone display will present the information not as the string of numbers but by identifying your profile details.

In a similar way you are able to recognize your partner by their name or picture on the phone display because your device uses their IP address as a digital identifier.

The problem is that SIP ALG must change your softphone’s private IP address to make it readable by the public Internet system and by the cloud servers included in the SIP network.

disable sip alg so it doesn't cause IP changing issues

What happens when SIP ALG is turned on on your router?

  1. The private IP address from a specific phone is modified into a public IP address by SIP ALG.

  2. Phone data is sent to the cloud VoIP servers in a public IP address format.

  3. Cloud VoIP server uses the public IP address to return the message back to the caller.

  4. Caller’s phone system is not able to recognize the exact phone it needs to deliver the return message to, since SIP ALG removed its private IP address.  

  5. Your router will receive all return messages as coming from one device with an identical IP address and won’t be able to distribute the inbound message to the right device.   

Since office phone systems based on VoIP typically include more than one phone or fax machine, each with a separate IP address, SIP can create multiple problems in this back and forth call retrieval.

Problems Caused by the SIP ALG

Most SIP ALG problems are noticed on calls and faxes and can start as early as the call is initiated. Below are the most common issues that can occur:

1. Call Registration, Dropped Calls, and Failed Call Transfers

Once you pick up a phone call, the call gets dropped. You won’t be able to transfer calls, put calls on or off hold, or park calls. Being unable to park calls takes away a key feature of VoIP phones – the possibility to transfer calls between devices.

2. Non-Functioning Hunt Groups

Certain devices fail to register in the cloud SIP network or are just incapable of receiving data. Phones in hunt groups (groups with automatic call distribution) won’t ring as required.

3. Direct-to-Voicemail

Some inbound calls can go straight to voicemail and some will get cut off with an error message being returned to the caller.

4. Fax Issues

Fax machines are unable to receive faxes, falling at the moment of transmission.

fax machine that's susceptible to sip alg issues

5. Audio Fails

SIP ALG will create one-way audio only, preventing audio data from reaching your network.

Why Incoming Calls Fail

Problems with incoming calls show up due to the ‘Register’ request in the UA feature of SIP proxies. This request is used to localize and reach the user who needs to receive the incoming call.

The problem starts when the SIP ALG rewrites the ‘Register’ request. This results in the proxy being unable to detect the NAT, in turn preventing incoming calls from reaching the desired destination.

Troubles in SIP Signalling  

Breaks in SIP signalling arise because of incorrect modification of SIP message headers and SDP message bodies. A SIP ALG built-in feature can create problems by:

  • Partially modifying the private IP address
  • Missing or skipping parameters in the SIP message
  • Rewriting the message with incorrect port values

When Will Problems Arise?

SIP ALG (Application Layer Gateway) is unpredictable. It follows its own set of rules and makes independent decisions about the point at which it will activate to inspect SIP packets from the incoming traffic.

This can really happen at any point: once you set up your office PBX phone system or later when the SIP ALG algorithm is triggered by a certain traffic pattern.

The trouble is that most routers with factory settings come with the SIP ALG on and are incapable of supporting the complex instructions of multiple protocols in a VoIP network. Your router can ignore the ‘disable SIP ALG’ option altogether unless it’s properly configured by following a strict set of instructions. Still, unless you want to wait for a professional, there is always something you can do about it.

 

 

 

 

 

 

The Easiest Way to Troubleshoot SIP ALG

The easiest way to handle SIP ALG issues is by switching ports.

In a way, ports are for protocols what protocols are for routers (and for other SIP devices). A port is a 16-bit number for identifying specific applications, for example, FTP or HTTP servers that use open ports on local computers to track connection requests.

If you switch from port 5060 to port 5062, you will be able to circumvent the router’s built-in SIP ALG, which, as a general rule, affects only port 5060.

 router with built-in sip alg

Nextiva routers have this feature preemptively configured for its customers, thus saving you a lot of missed, failed, and poorly distributed calls.

How to Disable SIP ALG

If your business VoIP telephony is provided by Nextiva, our support team is ready to help you prevent SIP ALG from interfering with your phone calls. If not, we recommend consulting with your provider before configuring any device.

Most commercial router configurations have their own set of rules for configuring SIP ALG.

To disable SIP ALG on a specific brand, locate your router model in the alphabetical table below and follow the instructions.

Disclaimer: Please consult with an IT or a network professional before making any changes to your router to avoid additional problems.

 

Model

How to Disable SIP ALG

Adtran

 

  • Use the following command: no ip firewall alg sip

Arris Gateway

  • Locate ‘Options’ under ‘Advance’ and uncheck the SIP box.
  • Apply the following credentials:

     

    • UN: admin
    • Password: motorola

ASA

  • Locate ‘Class inspection_default’ under ‘Policy-map global_policy’.
  • Use the following command: no inspect sip

Asus

  • Locate ‘WAN/ NAT Passthrough’ under ‘Advanced Settings’
  • Disable ‘Passthrough’.

AVM Fritz!Box

  • No option to disable SIP ALG.

Billion

  • Locate the SIP ALG feature under NAT or router firewall settings.

BT

  • Disable SIP ALG option is only available on BT Business Hub versions 3 and higher.

Cisco (non-ASA)

  • Locate SIP Fixup
  • On General Routers, apply the following:

     

    • no ip nat service sip tcp port 5060
    • no ip nat service sip udp port 5060
  • On Enterprise-Class Routers, apply the following:

     

    • no ip nat service sip tcp port 5060
    • no ip nat service sip udp port 5060
  • On Pix Devices, apply the following:

     

    • no fixup protocol sip 5060
    • no fixup protocol sip udp 5060

D-Link

  • Locate 'Application Level Gateway (ALG) Configuration' under 'Advanced  settings
  • Uncheck the 'SIP' option.

DrayTek

  • For Vigor2760 devices use the ALG feature located under Network/NAT.
  • For other devices use a Telnet client.
  • On Windows systems:

     

    • Find the Windows Start button.
    • Search for cmd: hit enter.
    • Type in telnet 192.168.1.1: hit enter.

(Note: Unless you have the Windows telnet client installed, you will need to do that now by locating the Telnet Client in the Windows Programs and Features, and turning it on.)

  • Type in the username and the password in the credentials prompt.
  • Apply the following commands:

     

    • sys sip_alg 0
    • sys commit
  • For Draytek Vigor2750 and Vigor2130 devices apply the following commands:

     

    • kmodule_ctl nf_nat_sip disable
    • kmodule_ctl nf_conntrack_sip disable

Fortinet

  • Use the following commands from the CLI interface:

     

    • config system session-helper
    • show system session-helper
  • Find the SIP session instance, typically indicated by #12
  • Delete #12 or the appropriate number
  • Confirm deletion by re-running ‘show system session-helper’.

Huawei

  • Locate SIP ALG in the Security menu.

Linksys

  • Go to the ‘Advanced’ section on the Admin page and disable the SIP ALG feature. This instruction can be used as a general Linksys router guidance.  
  • For Linksys BEFSR41 routers, go to ‘Port Triggering’ under ‘Applications and Gaming’ on the Admin page.

     

    • Type in ‘TCP’ as the application.
    • Type in ‘5060’ into the Start Port and End Port for the ‘Triggering Range’ and ‘Forwarded Range’ fields.
    • Tick ‘Enable’.
    • Save and Reboot.

Mikrotik

  • Disable SIP Helper.

Netgear

  • Locate the advanced settings under Security/Firewall from the admin interface.
  • Disable SIP ALG.
  • Locate Session Limit under Security/Firewall.
  • Increase the UDP timeout to 300 sec.

      

SonicWall

  • Under the VoIP tab:
  • Check ‘Enable Consistent NAT'
  • Uncheck 'Enable SIP Transformations'.

Speedtouch

  • Check in the user manual for a specific model to see if you need to use Telnet commands to disable SIP ALG.

TP-Link

  • Use the Telnet client by typing cmd in the Windows Start menu.
  • Apply the following command: ip nat service sip sw off

UBEE Gateways

  • Go to ‘Options’ under ‘Advanced’.
  • Uncheck the SIP option.
  • Uncheck the RTSP option.
  • Click Apply.

Virgin SuperHub

  • SIP ALG cannot be disabled.

ZyXEL ZyWALL USG

  • Go to ALG, located under Network/Configuration/Settings.
  • Disable SIP ALG.

Still Having Problems?

 

 

Call Nextiva on (800) 285-7995 to talk to a support agent and to learn how we can improve your VoIP experience. As the top-ranked VoIP provider in the country, our Amazing Service team is ready to can help your business with all its communication needs.

 

 

 

 

 

About the author

Cameron Johnson is a market segment leader at Nextiva. Along with his articles on Nextiva's blog, Cameron has written for a variety of publications including Inc. and Business.com. Cameron was recently recognized as Utah's Marketer of the Year.
 

Contact an Amazing Service
Sales Expert
(800) 799-0600

See how Nextiva will transform
the way you communicate.


Contact an Amazing Service
Sales Expert
(800) 799-0600

See how Nextiva will transform
the way you communicate.