The Short Answer
In virtually all cases, SIP ALG should be turned off. The only exception is if you are using a dedicated Session Border Controller (SBC). For standard routers, modems, and firewalls, SIP ALG causes more problems than it solves and should be disabled as soon as it is identified.
What Is SIP ALG?
SIP ALG stands for Application Layer Gateway. It is a NAT tool built into many commercial and residential firewalls, routers, and modems. Its original purpose was to inspect SIP messages and translate private IP addresses and ports into public ones to help VoIP traffic pass through NAT correctly.
Why Is SIP ALG a Problem?
SIP ALG was designed at a time when many hosted PBX systems had limited NAT handling capabilities. Modern VoIP platforms fully understand NAT and actually prefer to work with private IP addresses in SIP messaging. When SIP ALG intervenes, it creates conflicts rather than resolving them.
The deeper issue is that many routers and modems do not fully understand SIP or SIP routing. The IP replacement done by SIP ALG is typically handled through scripting, which can strip out critical parts of the SIP message. ALG implementations also frequently have problems with their own NAT routing tables, causing SIP messages to be delivered to the wrong endpoint or not delivered at all.
Common Symptoms of SIP ALG
- One-way or no-way audio, either intermittently or consistently.
- Outbound or inbound calls failing to connect.
- Audio cutting out completely during a call and not returning.
- Phones continuing to ring without being answerable.
- Inability to call another extension on the same network.
- BLF or MWI being sent to the wrong extension, responding slowly, or not working at all.
- Phone registration issues.
What SIP ALG Does NOT Affect
- Audio quality after a call has already connected. That is more commonly caused by jitter or packet loss on the local network.
- Echo or static, which are typically associated with an issue at the endpoint device or local network interference.
How to Identify SIP ALG
SIP ALG can exist on a network for months or years before becoming problematic, sometimes triggered by a firmware update or file system corruption on the routing device. A reliable indicator of SIP ALG is seeing a public IP address appearing in the Contact Header or SDP body of a SIP message from a device that should be sending a private IP address. If the public IP appears only in the Received and Via headers, that is normal. Seeing it in the Contact Header or SDP body is a strong sign that SIP ALG is actively modifying your traffic.
How to Turn SIP ALG Off
Disabling SIP ALG is not always straightforward. A few things to keep in mind:
- SIP ALG may be labeled as SIP Transformer, SIP Helper, SIP Guide, or similar names depending on the device manufacturer.
- It is not always accessible through the device’s web interface. In some cases you may need to SSH or Telnet into the device to disable it via command line.
- If you are using a modem in bridge mode, SIP ALG may still be active from before the bridge was configured and can continue intercepting SIP traffic.
- On some devices, SIP ALG simply cannot be disabled and the device will need to be replaced.
- In rare cases, SIP ALG may be operating at the ISP level, in which case you can request that they disable it on their end.