SIP ALG problems on firewalls and routers

See also

Sources

1. 1
   The ASA default SIP inspection does not inspect encrypted SIP. A TLS proxy must be configured for that.

   CLI Book 2: Cisco Secure Firewall ASA Firewall CLI Configuration Guide 9.23 - Inspection for Voice and Video Protocols · SIP Inspection > Default SIP Inspection · Checked 2026-09-25
2. 2
   With PAT on the ASA, a SIP header field that contains an internal IP address without a port might not be translated, leaking the internal address outside. Cisco suggests NAT instead of PAT to avoid this.

   CLI Book 2: Cisco Secure Firewall ASA Firewall CLI Configuration Guide 9.23 - Inspection for Voice and Video Protocols · SIP Inspection > PAT Limitations for SIP Inspection · Checked 2026-09-25
3. 3
   If a SIP device sends SDP whose o= (owner/creator) IP differs from the c= (connection) IP, the ASA with PAT may not translate the o= address properly because the o= field has no port.

   CLI Book 2: Cisco Secure Firewall ASA Firewall CLI Configuration Guide 9.23 - Inspection for Voice and Video Protocols · SIP Inspection > PAT Limitations for SIP Inspection · Checked 2026-09-25
4. 4
   On Cisco Secure Firewall ASA, SIP inspection is enabled by default through the default inspection policy.

   CLI Book 2: Cisco Secure Firewall ASA Firewall CLI Configuration Guide 9.23 - Inspection for Voice and Video Protocols · SIP Inspection > Default SIP Inspection · Checked 2026-09-25
5. 5
   An ALG can be detected by capturing the same SIP message on both sides of the NAT device. If Via, Contact, Record-Route or the SDP c= and m= values differ between the two captures, the device has rewritten the SIP payload, beyond translating the IP and UDP headers.inferred

   SIP ALG | Junos OS · section listing rewritten headers and SDP fields · Checked 2026-09-25
6. 6
   If a capture on the public side of a PAT device shows a private address still present in a SIP header or in the SDP o= field while other fields were translated, that pattern matches documented partial-translation limits of SIP inspection. It is not proof that no ALG is present.inferred

   CLI Book 2: Cisco Secure Firewall ASA Firewall CLI Configuration Guide 9.23 - Inspection for Voice and Video Protocols · PAT Limitations for SIP Inspection · Checked 2026-09-25
7. 7
   According to Fortinet, from FortiOS 5.2 the FortiOS proxy-based SIP ALG handles all SIP traffic by default. In FortiOS 5.0 the SIP session helper applied when no VoIP profile was applied.

   Technical Tip: Disabling VoIP Inspection · version note in article body · Checked 2026-09-25
8. 8
   After changing FortiGate SIP handling, the tip says to clear existing SIP sessions (filter on destination port 5060 and clear) or reboot the unit.

   Technical Tip: Disabling VoIP Inspection · Step 3 Clear Sessions or Reboot · Checked 2026-09-25
9. 9
   The same Fortinet tip also removes the SIP session helper. You list entries under config system session-helper and delete the entry that handles SIP. The entry number, 13 in the tip's example, varies by device.

   Technical Tip: Disabling VoIP Inspection · Step 1 Disable SIP Session Helper · Checked 2026-09-25
10. 10
    The Fortinet tip states that re-enabling the FortiGate SIP ALG requires a restart.

    Technical Tip: Disabling VoIP Inspection · warning notes · Checked 2026-09-25
11. 11
    Fortinet's 2015 technical tip says the FortiGate SIP ALG should be disabled only for troubleshooting, to isolate a problem. Cisco instead recommends switching SIP ALG off for Webex Calling as standing practice.disputed

    Technical Tip: Disabling VoIP Inspection · warning notes · Checked 2026-09-25
12. 12
    In the Fortinet technical tip, default-voip-alg-mode under config system settings defaults to proxy-based. Setting it to kernel-helper-based disables the FortiGate SIP ALG.

    Technical Tip: Disabling VoIP Inspection · Step 2 Disable SIP-ALG · Checked 2026-09-25
13. 13
    The Cisco IOS NAT SIP ALG translates embedded addresses including the SDP connection and media lines, but only embedded IPv4 addresses.

    IP Addressing: NAT Configuration Guide, Cisco IOS Release 15M&T - NAT TCP SIP ALG Support · Restrictions for NAT TCP SIP ALG Support; debug output example · Checked 2026-09-25
14. 14
    On Cisco IOS and IOS XE NAT, NAT support for SIP (the SIP ALG) is enabled by default on port 5060.

    IP Addressing: NAT Configuration Guide, Cisco IOS XE Release 3S - SIP ALG Hardening for NAT and Firewall · Information About SIP ALG Hardening for NAT and Firewall · Checked 2026-09-25
15. 15
    Cisco documents the no ip nat service sip command for disabling NAT support for SIP on IOS XE.

    IP Addressing: NAT Configuration Guide, Cisco IOS XE Release 3S - SIP ALG Hardening for NAT and Firewall · Information About SIP ALG Hardening for NAT and Firewall · Checked 2026-09-25
16. 16
    The Cisco IOS XE SIP ALG reads the Via, Contact and Record-Route headers to create firewall pinholes and NAT translation doors.

    IP Addressing: NAT Configuration Guide, Cisco IOS XE Release 3S - SIP ALG Hardening for NAT and Firewall · Information About SIP ALG Hardening > Via header and Record-Route handling · Checked 2026-09-25
17. 17
    Cisco states that the IOS XE SIP ALG does not provide any security features.

    IP Addressing: NAT Configuration Guide, Cisco IOS XE Release 3S - SIP ALG Hardening for NAT and Firewall · Restrictions for SIP ALG Hardening for NAT and Firewall · Checked 2026-09-25
18. 18
    Juniper's sip (Security) statement reference states that the SIP ALG is disabled by default on SRX5600 and SRX5800 devices, implying other SRX models default to enabled.disputed

    sip (Security) | Junos OS · Description / default note · Checked 2026-09-25
19. 19
    Juniper's SIP ALG topic page states that the SIP ALG is disabled by default on SRX devices and enabled by default on other devices.disputed

    SIP ALG | Junos OS · SIP ALG overview default-state note · Checked 2026-09-25
20. 20
    On Junos OS, the SIP ALG is disabled with set security alg sip disable (the general form is set security alg alg-name disable).

    sip (Security) | Junos OS · Options > disable · Checked 2026-09-25
21. 21
    The Junos SIP ALG monitors SIP transactions and dynamically creates pinholes for RTP and RTCP, based on the addresses and ports it extracts from the SDP.

    SIP ALG | Junos OS · SIP ALG overview > pinhole creation · Checked 2026-09-25
22. 22
    Juniper documents that the Junos SIP ALG modifies the Via, Contact, Route and Record-Route headers and the SDP c= and m= fields.

    SIP ALG | Junos OS · SIP ALG overview and NAT sections · Checked 2026-09-25
23. 23
    On Junos OS, show security alg status in operational mode shows whether the SIP ALG is enabled.

    SIP ALG | Junos OS · verification section · Checked 2026-09-25
24. 24
    One-way or no audio is a plausible result of an ALG that rewrites the SDP c= or m= values incorrectly, or opens RTP pinholes for the wrong address or port. The far end then sends RTP to a destination that does not reach the phone.inferred

    SIP ALG | Junos OS · pinhole creation and SDP field rewriting sections · Checked 2026-09-25
25. 25
    Palo Alto Networks states that when a VoIP client application has NAT intelligence embedded, the firewall's SIP ALG can interfere with signaling and cause the client application to stop working.

    Disable the SIP Application-level Gateway (ALG) · page introduction · Checked 2026-09-25
26. 26
    On Palo Alto Networks NGFWs, the SIP ALG is used to open dynamic pinholes in the firewall where NAT is enabled.

    Disable the SIP Application-level Gateway (ALG) · page introduction · Checked 2026-09-25
27. 27
    To disable the SIP ALG on a Palo Alto Networks NGFW, go to Objects > Applications and select the sip application. Choose Customize for ALG in the Options section, check Disable ALG, click OK, and commit.

    Disable the SIP Application-level Gateway (ALG) · procedure steps 1 to 5 · Checked 2026-09-25
28. 28
    Prisma Access does not support disabling the ALG on the predefined sip application. Palo Alto Networks recommends an application override policy for the SIP ports instead.

    How to disable SIP ALG in Prisma Access · article body · Checked 2026-09-25
29. 29
    Registration failures attributed to SIP ALG plausibly come from Contact or Via rewriting that conflicts with the endpoint's own NAT handling. The collected vendor sources state interference in general terms but do not document a registration-specific mechanism.inferred

    Disable the SIP Application-level Gateway (ALG) · page introduction · Checked 2026-09-25
30. 30
    Under RFC 3261, a server that receives a request whose top Via sent-by host is a domain name, or an IP address that differs from the packet's source address, adds a received parameter carrying the actual source address to that Via.

    RFC 3261 — SIP: Session Initiation Protocol · Section 18.2.1 Receiving Requests · Checked 2026-09-25
31. 31
    RFC 4787 warns that NAT ALGs may interfere with UNSAF methods or protocols that try to be NAT-aware and must be used with extreme caution.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 7 third paragraph · Checked 2026-09-25
32. 32
    RFC 4787 (BCP 127) REQ-10 states that NAT ALGs for UDP-based protocols SHOULD be turned off, so that they do not interfere with UNSAF NAT traversal mechanisms and so that integrity protection of UDP communications is possible.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 7 REQ-10 · Checked 2026-09-25
33. 33
    RFC 4787 observes that some NATs keep ALGs such as the SIP ALG permanently on, some turn them on by default but allow them to be turned off, and some leave them off by default but allow them to be turned on.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 7 second paragraph · Checked 2026-09-25
34. 34
    RFC 4787 REQ-10 a) recommends that a NAT that includes ALGs let the administrator enable or disable each ALG separately.

    RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127) · Section 7 REQ-10 item a) · Checked 2026-09-25
35. 35
    RFC 6314 lists practical limitations of SIP ALGs: they require media and signaling to traverse the same device, and they do not work with encrypted signaling or payload.

    RFC 6314: NAT Traversal Practices for Client-Server SIP · Section 3 Problem Statement · Checked 2026-09-25
36. 36
    RFC 6314 builds its SIP NAT traversal practices on the assumption that NATs do not contain SIP-aware ALGs. It notes that experience shows such ALGs can have an adverse impact on SIP functionality.

    RFC 6314: NAT Traversal Practices for Client-Server SIP · Section 3 Problem Statement · Checked 2026-09-25
37. 37
    RingCentral's D-Link procedure goes to ADVANCED > FIREWALL SETTINGS, unchecks Enable SPI, and sets UDP and TCP endpoint filtering to Endpoint Independent. It then unchecks SIP under APPLICATION LEVEL GATEWAY (ALG) CONFIGURATION and saves.

    Network - Disable SIP ALG on a D-Link Router · procedure steps 3 to 7 · Checked 2026-09-25
38. 38
    RingCentral says SIP ALG can contribute to one-way audio and audio quality issues on its service.

    Network - Disable SIP ALG on a D-Link Router · article introduction · Checked 2026-09-25
39. 39
    If a device between a Direct Routing SBC and Microsoft could read and rewrite the Contact or Record-Route host to an IP address, Microsoft's documented rules would reject or fail the call. Because Direct Routing signaling runs over TLS, a firewall without TLS interception cannot normally rewrite it in the first place.inferred

    Teams Phone System Direct Routing: SIP protocol · Use of FQDN name in Contact or Record-Route; Contact header · Checked 2026-09-25
40. 40
    For Teams Direct Routing, every incoming OPTIONS and INVITE to the Microsoft SIP proxy must carry the paired SBC's FQDN, not an IP address, in the Contact header URI hostname.

    Teams Phone System Direct Routing: SIP protocol · Detailed requirements for Contact header and Request-URI > Contact header · Checked 2026-09-25
41. 41
    Teams Direct Routing refuses an incoming INVITE or OPTIONS whose Contact hostname is an IP address rather than an FQDN, with a 403 Forbidden.

    Teams Phone System Direct Routing: SIP protocol · Detailed requirements for Contact header and Request-URI > Contact header last paragraph · Checked 2026-09-25
42. 42
    Teams Direct Routing supports only an FQDN matching the SBC certificate in Record-Route or Contact. If an IP address appears in either header, the certificate check and the call fail.

    Teams Phone System Direct Routing: SIP protocol · Contact and Record-Route headers considerations > Use of FQDN name in Contact or Record-Route · Checked 2026-09-25
43. 43
    Microsoft does not support a third-party SIP proxy or user agent server between the Microsoft SIP proxy and the paired SBC that might modify the Request-URI created by the SBC.

    Teams Phone System Direct Routing: SIP protocol · Processing the incoming request: finding the tenant and user, step 5 · Checked 2026-09-25
44. 44
    The Webex Calling port reference gives no device-specific steps for disabling SIP ALG. It directs administrators to the relevant manufacturer's documentation.

    Port Reference Information for Webex Calling · section 'SIP Application Layer Gateway' last sentence · Checked 2026-09-25
45. 45
    Cisco states that, although all Webex Calling traffic is encrypted, certain SIP ALG implementations can still cause firewall traversal issues.

    Port Reference Information for Webex Calling · section 'SIP Application Layer Gateway' · Checked 2026-09-25
46. 46
    Cisco recommends turning off SIP ALG or similar SIP-aware functionality on routers and firewalls in the path of Webex Calling traffic.

    Port Reference Information for Webex Calling · section 'SIP Application Layer Gateway' · Checked 2026-09-25

Documents

Cite this page

WarmTransfer. (2026, September 25). SIP ALG problems on firewalls and routers. WarmTransfer. https://warmtransfer.net/knowledge/sip-alg-problems

@misc{warmtransfer-sip-alg-problems,
  title  = {SIP ALG problems on firewalls and routers},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sip-alg-problems},
  note   = {Verified 2026-09-25}
}