SIP ALG: What It Is and Why You Should Usually Disable It

Updated 18 October 2026 · 3 min read

SIP ALG (Application Layer Gateway) is a router or firewall feature that inspects SIP traffic and rewrites the IP addresses and ports inside SIP messages, to help VoIP work through NAT. It sounds helpful. In practice it's one of the most common causes of broken VoIP, and most VoIP providers tell you to switch it off.

What SIP ALG is supposed to do

NAT rewrites the IP addresses in packet headers, but SIP also carries addresses inside the message: in Via, Contact and the SDP. A phone behind NAT announces its private address there, so the far end doesn't know where to reach it. SIP ALG tries to fix this by rewriting those internal addresses to the router's public IP and opening firewall pinholes for the audio.

Why it causes problems

Inconsistent implementations. Many ALGs only rewrite some headers, or handle UDP but not TCP, leaving messages that contradict themselves.
It fights with proper NAT handling. Modern PBXs, phones and SBCs already handle NAT (rport, symmetric RTP, STUN, external address settings). Double-fixing breaks things.
It can corrupt messages. Wrong Content-Length after rewriting, mangled SDP, or changed ports can cause 400 Bad Request errors.
It can't see encrypted SIP. With SIP over TLS the ALG can't read anything, so it's useless at best.

Symptoms that point to SIP ALG

One-way audio, or no audio, on some calls (see fixing one-way audio).
Calls dropping after about 30 seconds.
Phones randomly unregistering, or registering but not receiving inbound calls.
Transfers or hold failing, with 481 errors.
Problems that disappear when the phone is moved to a different network, such as a mobile hotspot.

How to tell for sure

Capture the same SIP message on both sides of the router, for example on the phone (or a PC on the LAN) and on the PBX or provider side. If the Contact header or SDP c= line has been changed in transit and your PBX isn't doing it, an ALG is rewriting the packets.

How to disable SIP ALG

The setting lives in different places on different devices. Common locations:

MikroTik: IP → Firewall → Service Ports → disable sip. From the terminal: /ip firewall service-port disable sip
pfSense / OPNsense: no SIP ALG by default, but use static outbound NAT port mapping for the PBX so source ports stay the same.
Fortinet FortiGate: the SIP session helper and VoIP profile. Removing the session helper (config system session-helper) and setting default-voip-alg-mode kernel-helper-based under config system settings are the usual steps. Check Fortinet's docs for your firmware version.
Cisco ASA: no inspect sip under the global policy-map.
Consumer and ISP routers: look under Advanced, NAT, Firewall or ALG for "SIP ALG", "SIP helper" or "SIP passthrough". Some ISP-supplied routers hide it, so ask your ISP or replace the router.

After disabling it, reboot the router (or clear connection tracking) so old SIP sessions are dropped, then re-register the phones.

When SIP ALG might help

Very occasionally, with simple old devices that have no NAT support of their own and a router whose ALG works correctly, it can help. If everything works with it switched on, leave it. But if you see any of the symptoms above, turning it off is the first thing to try.

Try the SIP Response Codes

Every SIP status code from 100 to 608, with plain-English meanings, common causes and fixes.