Contact us Partner portal
Work with us

SIP ALG Test

Find out whether a router or firewall is rewriting your VoIP calls, and turn SIP ALG off on the makes we see most. SIP ALG is a common cause of one-way audio, phones dropping their registration and calls that cut off at the same point every time.

What Is SIP ALG?

SIP is the protocol that phones and phone systems use to set up calls. A SIP ALG (application layer gateway) is a feature built into many routers and firewalls that reads SIP messages as they pass through and rewrites the addresses inside them, typically swapping a phone’s private address, such as 192.168.1.20, for the router’s public one. It was meant to help calls cross NAT.

In practice it often gets in the way. Hosted phone systems and SIP trunks already allow for NAT themselves, and an ALG that rewrites the messages again, or only rewrites some of them, leaves the phone and the phone system disagreeing about where to send audio and how to reach the phone. How well an ALG works also varies widely between makes and firmware versions.

Common Symptoms

  • One-way audio, or no audio, on some or all calls.
  • Phones losing their registration, showing as offline, or not ringing for incoming calls.
  • Calls dropping at the same point every time, for example about 32 seconds after answering (when the phone’s confirmation that it answered never reaches the other end) or after the same number of minutes on every call (when the call is refreshed partway through).
  • Transfers, holds or call forwarding failing.

Should SIP ALG Be On or Off?

Off, for almost every hosted phone system and SIP trunk, including Netavo’s. If calls already work well, there is no need to change anything.

There are exceptions. An older phone system or phone that cannot handle NAT itself, used with a provider that does not allow for it, may rely on the ALG. Some business firewalls use their SIP inspection to open the ports for the audio, so turning it off there may also need a rule allowing those ports. If your phone provider asks for it to be on, follow their advice.

Test Your Connection

The test sends a real SIP message (an OPTIONS request, the kind phones send to check that a server is there) from your computer to our test server on the standard SIP port, 5060, and on 5062. Our server records exactly what arrived and sends it back. If a router or firewall rewrote anything on the way, the two copies differ, and the test shows which lines changed. It also shows whether the router kept the same public port for each destination, which matters for incoming calls.

Comparing what was sent with what arrived is the only way to be certain: routers rarely say whether their ALG is active, and some have no setting for it at all. A browser cannot run the test. It cannot send a SIP message, and since late 2020 browsers have also refused web requests to the SIP ports, to block an attack called NAT Slipstreaming that abused SIP ALG. So the test runs in our NetavoCheck app.

The SIP test on its own takes about five seconds. Nothing is shared unless you agree to it. Windows may warn that NetavoCheck is not yet code-signed; see how to run it.

Windows (Intel and AMD)

For most Windows PCs.

Download (8.7 MB)

Double-click the downloaded file. It runs the SIP test on its own, in about five seconds.

File
NetavoCheck-SIP-windows-x64.exe
SHA-256
80bfd7d06dc737714810724253c11813762bdc46238de881a16231bfe84f7f29

macOS

For Apple silicon and Intel Macs.

Download (20.3 MB)

Open the disk image and double-click Netavo SIP Test. It runs the SIP test on its own, in about five seconds.

File
NetavoCheck-macos.dmg
SHA-256
087228dcfccfaf2b760a4e005c5b23994208374ccdcf349c611d8d373640d7cb

What the Result Looks Like

If nothing changed the message, the result says it arrived exactly as sent. If a SIP ALG rewrote it, you see the message as your computer sent it beside the message as our server received it, with the changed lines marked. In this example the router swapped the computer’s private address in the Via and Contact lines for its own public one:

As sent by your computer
As received by Netavo
OPTIONS sip:echo@check.netavo.com SIP/2.0
OPTIONS sip:echo@check.netavo.com SIP/2.0
Via: SIP/2.0/UDP 192.168.1.20:52100;rport
Via: SIP/2.0/UDP 203.0.113.7:40712;rport
From: <sip:netavocheck@192.168.1.20>
From: <sip:netavocheck@192.168.1.20>
Contact: <sip:netavocheck@192.168.1.20:52100>
Contact: <sip:netavocheck@203.0.113.7:40712>
An illustration with documentation addresses; your result shows your own.

The full Connection Health Check includes the same SIP test alongside IPv4 and IPv6, DNS, packet size, latency and website checks, and produces a report you can share with your provider or IT support.

How to Turn Off SIP ALG

Make the change at a quiet time: calls in progress may drop, and some makes need a restart. Afterwards, restart the phones or wait for them to register again, then run the test again to confirm. Menus differ between models and firmware versions, so each guide says what it covers and links the vendor’s own instructions.

ASUS

ASUS routers with the ASUSWRT web interface. Screens differ between models and firmware versions.

ASUS calls the setting SIP Passthrough, one of its NAT Passthrough options.

  1. Connect a computer to the router by cable or Wi-Fi and go to http://www.asusrouter.com, or the router’s address.
  2. Log in with the router’s username and password.
  3. Go to WAN › NAT Passthrough.
  4. Turn SIP Passthrough off, then click Apply.

Source: ASUS: WAN – NAT Passthrough introduction

BT Business Hub

BT Business Hub 5 and BT Business Smart Hub, as BT documents for Cloud Voice and Digital Voice.

BT turns SIP ALG off on these hubs, but resetting the hub turns it back on.

  1. On a computer connected to the hub, go to 192.168.1.254 or businesshub.home.
  2. Select Advanced Settings and enter the admin password, printed on the hub or on its pull-out card.
  3. Select Continue to Advanced Settings.
  4. Go to Firewall › Configuration and scroll down to Application Layer Gateway.
  5. Select Yes next to Disable SIP ALG, then Apply.

BT does not document a SIP ALG setting for its home Smart Hubs.

Sources: BT Business: switch off SIP ALG for Cloud Voice; BT Business: switch off SIP ALG for Digital Voice

BT 4G Home Hub

BT 4G Home Hub.

  1. Connect to the hub by cable or Wi-Fi and go to http://192.168.1.1/.
  2. Select LOG IN HERE and enter the username and password.
  3. Go to Security › SIP ALG Settings.
  4. Untick Enable SIP ALG, then select Apply.

Source: BT: getting started with your BT 4G Home Hub

Cisco ASA

Cisco ASA software using the default global policy. Firepower Threat Defense (FTD) is configured differently and is not covered here.

Cisco calls it SIP inspection, and turns it on by default. Turn it off in configuration mode, then save the configuration.

  1. Enter the global policy, then its inspection_default class.
  2. Turn off SIP inspection.
  3. Save the configuration.
policy-map global_policy
 class inspection_default
  no inspect sip

Cisco warns that turning SIP inspection off breaks SIP if NAT is applied to SIP traffic, or if the ports SIP needs are not allowed through an access list.

Sources: Cisco security advisory: SIP inspection workaround; Cisco ASA 9.19 firewall configuration guide: inspection

Cisco Meraki MX

All Meraki MX security appliances.

There is nothing to turn off: Meraki says the MX does not include ALG functionality. If a phone system relies on an ALG, Meraki notes the MX may drop its traffic in one direction, so check the phone system’s own NAT settings instead.

Source: Meraki: VoIP F.A.Q. and troubleshooting tips

DrayTek Vigor

DrayTek Vigor routers running DrayOS. Vigor 2960, 3900 and 300B use a different menu, below.

DrayTek leaves SIP ALG off by default, so it is only on if someone turned it on.

  1. In the web interface, go to NAT › ALG, untick SIP and click OK.
  2. Or, with firmware 3.8.0 or later, click Web Console at the top right and run the commands below: the first shows the current setting, the second turns SIP ALG off. Up to firmware 3.7.9, run the same commands over Telnet.
sys sip_alg ?
sys sip_alg 0

Vigor 2960, 3900 and 300B: go to NAT › ALG, open the SIP ALG tab, untick Enable SIP ALG and click Apply.

DrayTek says the command takes effect immediately.

Source: DrayTek: SIP ALG on DrayTek routers

Fortinet FortiGate

FortiGate running FortiOS 7.4, 7.6 or 8.0; Fortinet’s technical tip applies to any supported version. With VDOMs, the session helper is a global setting.

FortiOS handles SIP with its SIP ALG by default, for policies without a VoIP profile. Turning it off is done in the CLI.

  1. List the session helpers and note the number of the SIP entry (name sip, protocol 17, port 5060). The number varies between units.
  2. Delete that entry, and any other SIP entries on other ports.
  3. Set the default VoIP ALG mode to kernel-helper-based.
  4. If a firewall policy has a VoIP profile, remove it from the policy or turn SIP off in that profile.
  5. Clear the existing SIP sessions, or restart the FortiGate.
show system session-helper
config system session-helper
    delete 13
end
config system settings
    set default-voip-alg-mode kernel-helper-based
end
diagnose sys session filter dport 5060
diagnose sys session clear
diagnose sys session filter sport 5060
diagnose sys session clear

Replace 13 with the number of the SIP entry on your FortiGate.

Clearing the sessions on port 5060 ends every SIP call passing through the FortiGate. Without a filter, the clear command ends all sessions, so set the filter first.

Sources: Fortinet: SIP ALG and SIP session helper; Fortinet technical tip: disabling VoIP inspection

MikroTik

MikroTik routers running RouterOS.

RouterOS handles SIP with a NAT helper, managed under /ip firewall service-port. Turn the sip service port off.

/ip firewall service-port disable sip

MikroTik’s documentation names the menu; the command is as 3CX gives it in its MikroTik guide.

Sources: MikroTik: NAT helpers; 3CX: MikroTik firewall configuration

NETGEAR

NETGEAR routers with the web interface (NETGEAR genie), including the Nighthawk models listed in NETGEAR’s article. The Nighthawk app does not document this setting.

NETGEAR turns SIP ALG on by default.

  1. Connect to the router by cable or Wi-Fi and go to http://www.routerlogin.net.
  2. Log in. Unless it has been changed, the username is admin and the password is password.
  3. Go to ADVANCED › Setup › WAN Setup.
  4. Select Disable SIP ALG, then click Apply.

Source: NETGEAR: how do I disable SIP ALG using the router web interface?

Netgate pfSense

Netgate pfSense software.

pfSense has no SIP ALG to turn off. It does rewrite the source port of all outbound traffic by default, which can cause one-way audio with some phone systems; Netgate’s fix is manual or hybrid outbound NAT with Static Port for the phones’ or phone system’s traffic. Netgate advises against the siproxd package when the phone system is on site.

Sources: Netgate: configuring NAT for VoIP phones; Netgate: configuring NAT for a VoIP PBX

Palo Alto Networks

PAN-OS firewalls (PAN-OS 6.0 and later). It is a device-wide setting, not available from Panorama.

Turning off the SIP ALG keeps App-ID and threat detection for SIP traffic.

  1. Select Objects › Applications, then the sip application.
  2. In the Options section, select Customize… for ALG.
  3. Select the Disable ALG check box and click OK.
  4. Close the Application dialog box and Commit the change.
set shared alg-override application sip alg-disabled yes
commit

The two commands do the same from the CLI, in configure mode.

Sources: Palo Alto Networks: disable the SIP application-level gateway; Palo Alto Networks knowledge base: disable SIP ALG

Sophos Firewall

Sophos Firewall (SFOS) v19 to v21.5, on XG and XGS appliances. There is no setting for it in the web admin console.

Sophos Firewall loads its SIP module by default. Unload it from the command line.

  1. Open the command line over SSH, or from admin › Console at the top right of the web admin console.
  2. Choose 4. Device Console.
  3. Unload the SIP module, then check that it shows as not loaded.
system system_modules sip unload
system system_modules show

The change survives a restart. To turn it back on, run system system_modules sip load.

Sophos notes that phones may keep registering through the firewall’s address until their existing connections are cleared.

Sources: Sophos Firewall: turn the SIP module on or off; Sophos Firewall: VoIP troubleshooting

SonicWall

SonicOS 7 and 6.5 (TZ, NSa and SuperMassive). Menus differ on SonicOS 6.2 and earlier.

SonicWall calls its SIP ALG “SIP Transformations”. SonicOS 7 leaves it off unless someone turned it on.

  1. Go to Network › VoIP › Settings.
  2. Turn on Enable Consistent NAT.
  3. Turn off Enable SIP Transformations.

On SonicOS 6.5 the same options are under Manage › VoIP: tick Enable consistent NAT and untick Enable SIP Transformations.

SonicWall notes that consistent NAT slightly reduces security, and suggests raising the UDP timeout on the phones’ LAN to WAN rule from 30 to 120 seconds.

Sources: SonicWall: how and when to disable SIP ALG; SonicOS 7 VoIP: SIP settings

TP-Link Archer routers, Archer VR modem routers and Deco mesh systems. Menus vary by model and firmware.

  1. Archer routers: log in to the web interface, go to Advanced › NAT Forwarding, untick Enable SIP ALG and click Save.
  2. Modem routers: log in to the web interface, go to Advanced › NAT Forwarding › ALG and turn SIP ALG off.
  3. Deco: in the Deco app, go to More › Advanced › NAT Forwarding › SIP ALG and turn it off.

Sources: TP-Link: Wi-Fi calling troubleshooting (Archer); TP-Link: SIP ALG on modem routers; TP-Link: SIP ALG on Deco

Ubiquiti UniFi

UniFi Cloud Gateways.

There is nothing to turn off: Ubiquiti says UniFi Cloud Gateways do not apply SIP ALG. If a UniFi gateway sits behind a provider’s router (double NAT), turn SIP ALG off on that router instead.

Source: Ubiquiti: UniFi Talk network and firewall requirements

Virgin Media and Sky Hubs

Virgin Media Hub 3, 4 and 5; Sky Broadband hubs.

Neither Virgin Media nor Sky documents a SIP ALG setting for its hubs. If the test shows one of these hubs rewriting calls, ask the provider. Another route is to put the hub into modem mode and use your own router, whose SIP ALG can be turned off: Virgin Media documents modem mode for Hub 3, 4 and 5, though not Hub 5x.

Source: Virgin Media: Hub modem mode

WatchGuard Firebox

Fireboxes managed locally with Fireware Web UI or Policy Manager.

A Firebox has no SIP-ALG unless someone added a SIP-ALG policy, so look for one and disable or delete it.

  1. Select Firewall › Firewall Policies.
  2. Double-click the SIP-ALG policy.
  3. Clear the Enable check box and click Save.

In Policy Manager, right-click the policy and select Disable Policy, then save the configuration to the Firebox.

Calls already in progress carry on through the old policy until they end or the Firebox restarts.

Sources: WatchGuard: disable SIP-ALG on the Firebox; WatchGuard: disable or delete a policy

3CX Phone Systems

3CX phone systems.

3CX advises turning SIP ALG off on the router or firewall, and its Firewall Checker tests for it by comparing a message 3CX sent with what arrived.

  1. In the 3CX Admin Console, go to Dashboard › Firewall Checker and click Start. The phone system’s services stop and restart during the test.

Source: 3CX: Firewall Checker

If Your Router Is Not Listed

Look in the router’s NAT, firewall, VoIP or advanced settings for an option called SIP ALG, SIP Passthrough, SIP Helper or SIP Transformations, and search the maker’s support site for its instructions. Some routers supplied by broadband providers have no setting for it; your provider’s support team can tell you how theirs behaves, and the test above shows whether it is rewriting calls.

Frequently Asked Questions

What Is SIP ALG?

SIP ALG (a SIP application layer gateway) is a router or firewall feature that rewrites the addresses inside SIP messages as calls cross NAT. With hosted phone systems it often causes one-way audio, phones losing registration and dropped calls, which is why Netavo recommends turning it off.

Should SIP ALG Be On or Off?

Off, for almost every hosted phone system and SIP trunk, including Netavo’s. Leave it on only if your phone provider asks you to, usually because an older phone system cannot handle NAT itself.

How Can I Tell Whether SIP ALG Is On?

Netavo’s SIP ALG test sends a real SIP message to Netavo’s server and compares what arrived with what was sent; if a router rewrote it, the test shows the changed lines. Router menus are not a reliable guide, because some routers have no setting for it.

Why Does the SIP ALG Test Need an App?

A browser cannot send a SIP message, and since late 2020 browsers have also refused web requests to the SIP ports to block the NAT Slipstreaming attack. Netavo’s NetavoCheck app sends the SIP message itself instead.

How Do I Disable SIP ALG on a FortiGate?

In the FortiGate CLI, delete the SIP entry from the session helper list, set the default VoIP ALG mode to kernel-helper-based, then clear existing SIP sessions or restart. The FortiGate guide on this Netavo page lists the commands and links Fortinet’s instructions.

Can Turning Off SIP ALG Stop Calls Working?

Occasionally. If a phone system relied on the ALG, or a firewall used it to open the ports for the audio, calls may also need a firewall rule or a change to the phone system. Netavo’s test shows straight away whether the change worked.

Supporting Phones for Your Customers?

We provide hosted voice and SIP trunks on our own network, with diagnostics your engineers can use on site.

Hosted Voice Work With Us