SIP ALG: definition and a practical example
Short answer: SIP ALG (Application Layer Gateway) is a feature of routers and firewalls that rewrites addresses inside SIP messages to get through NAT, often breaking the audio on calls.
In Portuguese: SIP ALG
What is SIP ALG?
SIP ALG (Application Layer Gateway) is a feature of routers and firewalls that opens SIP messages and replaces the private IP addresses inside them with the connection’s public IP. The idea is to help the call get through NAT. In practice, many implementations rewrite the wrong fields, leave others uncorrected or break messages that the PBX or the SBC had already adjusted. The classic result is one-way silent audio, calls that drop on their own and extensions that lose their registration.
SIP ALG often comes enabled out of the box on home and small-business routers. When IP telephony starts failing after a router or link change, the ALG is one of the first suspects.
NAT
NAT (Network Address Translation) is what lets several devices with private IPs, such as 192.168.0.20, reach the internet through a single public IP. The router swaps the address in the packet header. The problem is that SIP repeats addresses inside the message itself, in the Via and Contact headers and in the SDP, which says where to send the RTP. If those internal addresses reach the carrier uncorrected, it sends the audio to a private IP that does not exist on the internet.
In practice
| Symptom | Likely cause |
|---|---|
| Call answered, one side cannot hear | Private IP or wrong port in the SDP |
| Call drops after about 32 seconds | ACK does not arrive; the destination gives up after 64 × T1 (RFC 3261) |
| Extension loses registration from time to time | ALG closes or alters the REGISTER session |
| Works on one link and fails on another | Different routers, one with ALG enabled |
To disable it, look on the router’s or firewall’s page for SIP ALG, SIP Helper or SIP inspection, turn it off and restart. On Linux-based devices, the feature is usually the SIP conntrack module.
How Monitor uses this
A test call that connects but has no audio in one direction is detected as one-way audio and counts as a failure, even with a SIP 200 OK response. See SIP trunk monitoring.
Frequently asked questions
How do I disable SIP ALG on my router?
Open the router's or firewall's admin page and look under NAT, firewall or advanced settings for SIP ALG, SIP Helper, SIP Passthrough or SIP inspection. Uncheck the option, save and restart the device. If the router was supplied by the carrier and the option does not appear, ask their support to turn it off or to set bridge mode. Then make a test call in both directions.
Should I always disable SIP ALG?
In most cases, yes, as long as something else handles NAT correctly: the PBX configured with the public IP, phones using STUN or an SBC. Without any of these, disabling the ALG can leave phones behind NAT with no audio. Test before and after the change.