Disabling SIP ALG & Fixing NAT
Diagnose and eliminate the most destructive network element in modern voice deployments to permanently cure one-way audio and call dropping issues.
What SIP ALG Is and Why It Exists
SIP ALG (Application Layer Gateway) is a security component built into most commercial routers. Because standard Network Address Translation (NAT) only maps Layer 3 and Layer 4 headers (IPs and Ports), it breaks protocols like SIP that embed routing addresses directly inside the Layer 7 application payload (the SDP body).
SIP ALG was designed to be 'helpful.' It actively inspects outbound SIP packets, reads the internal private IP addresses embedded in the Via, Contact, and SDP headers, and dynamically rewrites them to public IP addresses before pushing the packet to the WAN.
Why It Almost Always Breaks Carrier-Grade SIP
In modern carrier-grade deployments, your Session Border Controller (SBC) or Cloud PBX is already fully aware of its public IP configuration. It handles its own NAT traversal perfectly. When SIP ALG interferes, it blindly rewrites headers that were already correct.
Worse, low-end ALG implementations frequently fail to adjust the Content-Length header after changing character strings, resulting in malformed packets. They sever SRTP streams, break SIP over TLS hashes, and destroy SBC topology hiding parameters.
The Golden Rule of VoIP Engineering
If you take one action after reading this document, ensure you explicitly disable SIP ALG on the edge device protecting your voice infrastructure.
The Symptom Signature
SIP ALG interference is highly predictable. The most common symptom is one-way audio, or no audio at all, because the SDP connection parameters were corrupted and the media gateway doesn't know where to send the RTP stream.
Another classic signature is calls dropping precisely at the 32-second mark. This occurs when the SIP 200 OK reaches the caller, but the subsequent ACK cannot route back because the ALG mangled the Contact header. The SIP proxy assumes the connection failed and tears down the session upon timer expiration.
How to Confirm SIP ALG is the Culprit
Do not guess—verify. Execute a packet capture (PCAP) on your PBX edge interface, and ask your upstream carrier to run a simultaneous capture on their ingress proxy. Compare the SIP INVITEs side-by-side. If the internal private IP in the SDP `c=` line leaves your building, but the carrier receives a public IP they didn't map, an unseen ALG is mutating your traffic mid-flight.
How to Disable ALG on Common Routers
- FortiGate: Must be disabled via CLI. You must configure the `system settings` to change the `sip-helper` and `sip-nat-trace` flags, then flush the active session table.
- Ubiquiti UniFi: Located in the primary Network application under Settings > Security > Threat Management > Advanced. Toggle 'SIP' off under Conntrack Modules.
- pfSense: Operates via the 'siproxd' package. Ensure this package is not installed or enabled in the Services menu. Adjust firewall optimization to 'Conservative' to prevent UDP state drops.
- SonicWall: Navigate to VoIP > Settings. Disable 'Enable SIP Transformations'.
- Netgear / TP-Link: Usually found under Advanced Setup > WAN Setup. Uncheck 'Enable SIP ALG'.
What To Do Instead: Proper NAT Handling
Instead of relying on fragile router ALGs, handle NAT at the application layer. Configure your PBX with static mapping of its true public WAN IP. Ensure you open a wide, symmetric UDP port range (e.g., 10000–20000) for incoming RTP media, and implement QoS prioritizing UDP traffic tagged with DSCP 46 (Expedited Forwarding) directly to the PBX MAC address.
Field Diagnostics & Resolutions
If you have definitively disabled ALG but anomalies persist, consult these common field diagnostic causes.
| Symptom | Likely Causes | Resolution |
|---|---|---|
| One-Way or No Audio | NAT translating the SDP connection data improperly, RTP port range mismatch, firewall blocking UDP media traffic, or SIP ALG interfering with headers. | Ensure your PBX's external IP is correctly mapped in the SIP config. Open the full negotiated RTP port range on edge firewalls. Explicitly disable SIP ALG on the edge router. |
| SIP ALG Interference | Consumer routers or firewalls (e.g., FortiGate, pfSense, Netgear, UniFi) attempting to 'helpfully' rewrite SIP and SDP packets but corrupting the payloads. | Disable the SIP ALG/Helper service on the firewall. Alternatively, shift signaling to SIP over TLS, which encrypts the payload and prevents ALG inspection. |
| Outbound Calls Fail with 403 Forbidden | The source IP of the PBX is not whitelisted, the outbound Caller ID is unauthorized/spoofed, or the destination rate center is disabled in the ACL. | Verify the PBX is sending from the correct WAN IP. Ensure the Caller ID matches an owned DID. Check international or premium-rate dialing permissions. |
| Outbound Calls Fail with 404 Not Found | Dial string format mismatch. Typically, the PBX is sending local 7-digit or 10-digit formats without the required E.164 country code. | Adjust the PBX dial plan / outbound route rules to prepend '+1' to 10-digit North American numbers before passing to the wholesale trunk. |
| High Post-Dial Delay (PDD) | Excessive LRN dip latency, complex multi-hop route hunting, or failed upstream carriers timing out before falling back to subsequent routes. | Investigate SIP trace for delayed 100 Trying or 183 Session Progress responses. Review LRN provider response times. Simplify upstream LCR tables. |
| Choppy or Robotic Audio | Network packet loss, high jitter, or insufficient upstream bandwidth on the local internet circuit. | Implement Quality of Service (QoS) tagging (DSCP 46/EF) on the LAN. Run sustained ping/MTR tests to the upstream gateway to identify latency spikes. |
| Fax Transmission Failures | Attempting to send fax tones over a compressed codec (G.729), T.38 relay failing to negotiate, or ECM (Error Correction Mode) sensitivity. | Force the route to G.711u only. Disable VAD and echo cancellation on the ATA. Alternatively, verify T.38 is explicitly enabled on both endpoints. |
| Rising 603 Declines / 'Spam Risk' Labels | Poor outbound traffic velocity patterns, C-level attestation due to unverified Caller ID, or numbers flagged by terminating analytics engines (Hiya, TNS, FirstOrion). | Ensure proper STIR/SHAKEN A-level signing by registering DID ownership. Register legitimate business numbers with the Free Caller Registry. Reduce dialer CPS. |
Frequently Asked Questions
Ready to Connect?
Experience enterprise-grade wholesale termination and origination with transparent pricing and real-time control.