# SIP ALG problems on firewalls and routers Canonical: https://warmtransfer.net/knowledge/sip-alg-problems Last verified: 2026-09-25 RFC 4787 (BCP 127) REQ-10 states that NAT ALGs for UDP-based protocols SHOULD be turned off, so that they do not interfere with UNSAF NAT traversal mechanisms and so that integrity protection of UDP communications is possible[^32]. RFC 6314 builds its SIP NAT traversal practices on the assumption that NATs do not contain SIP-aware ALGs[^36]. ## How it works On Palo Alto Networks NGFWs, the SIP ALG is used to open dynamic pinholes in the firewall where NAT is enabled[^26]. Similarly, the Junos OS SIP ALG monitors SIP transactions to dynamically create pinholes for RTP and RTCP, based on the addresses and ports it extracts from the SDP[^21]. In Cisco environments, the Cisco IOS XE SIP ALG reads the Via, Contact, and Record-Route headers to create firewall pinholes and NAT translation doors[^16]. RFC 4787 warns that NAT ALGs may interfere with UNSAF methods or protocols that try to be NAT-aware and must be used with extreme caution[^31]. Practical limitations listed in RFC 6314 note that SIP ALGs require media and signaling to traverse the same device, and they do not work with encrypted signaling or payload[^35]. Under RFC 3261, a server that receives a request whose top Via sent-by host is a domain name, or an IP address that differs from the packet's source address, adds a received parameter carrying the actual source address to that Via[^30]. ## SIP ALG failure modes RFC 6314 notes that experience shows SIP ALGs can have an adverse impact on SIP functionality[^36]. Palo Alto Networks states that when a VoIP client application has NAT intelligence embedded, the firewall's SIP ALG can interfere with signaling and cause the client application to stop working[^25]. RingCentral says SIP ALG can contribute to one-way audio and audio quality issues on its service[^38]. WarmTransfer's reading of the sources is that one-way or no audio is a plausible result of an ALG that rewrites the SDP c= or m= values incorrectly, or opens RTP pinholes for the wrong address or port, causing the far end to send RTP to a destination that does not reach the phone[^24]. WarmTransfer's reading of the sources is that registration failures attributed to SIP ALG plausibly come from Contact or Via rewriting that conflicts with the endpoint's own NAT handling, though collected vendor sources state interference in general terms but do not document a registration-specific mechanism[^29]. With PAT on the Cisco Secure Firewall ASA, a SIP header field that contains an internal IP address without a port might not be translated, leaking the internal address outside[^2]. If a SIP device sends SDP whose o= (owner/creator) IP differs from the c= (connection) IP, the ASA with PAT may not translate the o= address properly because the o= field has no port[^3]. Cisco suggests NAT instead of PAT to avoid this[^2]. ## Cloud calling and Direct Routing impacts Cisco recommends turning off SIP ALG or similar SIP-aware functionality on routers and firewalls in the path of Webex Calling traffic[^46]. Cisco states that, although all Webex Calling traffic is encrypted, certain SIP ALG implementations can still cause firewall traversal issues[^45]. The Webex Calling port reference gives no device-specific steps for disabling SIP ALG and directs administrators to the relevant manufacturer's documentation[^44]. For Teams Direct Routing, every incoming OPTIONS and INVITE to the Microsoft SIP proxy must carry the paired SBC's FQDN, not an IP address, in the Contact header URI hostname[^40]. Teams Direct Routing refuses an incoming INVITE or OPTIONS whose Contact hostname is an IP address rather than an FQDN, with a 403 Forbidden[^41]. Teams Direct Routing supports only an FQDN matching the SBC certificate in Record-Route or Contact; if an IP address appears in either header, the certificate check and the call fail[^42]. Microsoft does not support a third-party SIP proxy or user agent server between the Microsoft SIP proxy and the paired SBC that might modify the Request-URI created by the SBC[^43]. WarmTransfer's reading of the sources is that if a device between a Direct Routing SBC and Microsoft could read and rewrite the Contact or Record-Route host to an IP address, Microsoft's documented rules would reject or fail the call, but because Direct Routing signaling runs over TLS, a firewall without TLS interception cannot normally rewrite it in the first place[^39]. ## Diagnosing it WarmTransfer's reading of the sources is that an ALG can be detected by capturing the same SIP message on both sides of the NAT device[^5]. WarmTransfer's reading of the sources is that if Via, Contact, Record-Route or the SDP c= and m= values differ between the two captures, the device has rewritten the SIP payload, beyond translating the IP and UDP headers[^5]. WarmTransfer's reading of the sources is that if a capture on the public side of a Cisco Secure Firewall ASA performing PAT shows a private address still present in a SIP header or in the SDP o= field while other fields were translated, that pattern matches documented partial-translation limits of SIP inspection and is not proof that no ALG is present[^6]. ## Platform differences RFC 4787 observes that some NATs keep ALGs such as the SIP ALG permanently on, some turn them on by default but allow them to be turned off, and some leave them off by default but allow them to be turned on[^33]. RFC 4787 REQ-10 a) recommends that a NAT that includes ALGs let the administrator enable or disable each ALG separately[^34]. | Platform | Default State | Header and Payload Rewriting | | --- | --- | --- | | Cisco IOS / IOS XE | Enabled by default on port 5060[^14] | Translates embedded IPv4 addresses in SDP connection and media lines[^13]; reads Via, Contact, and Record-Route[^16] | | Cisco Secure Firewall ASA | Enabled by default through default inspection policy[^4] | Default inspection does not inspect encrypted SIP without TLS proxy[^1]; leaks unported IP addresses under PAT[^2] | | Juniper Junos OS | Operates per security alg configuration[^20] | Modifies Via, Contact, Route, and Record-Route headers, plus SDP c= and m= fields[^22] | | Fortinet FortiGate | Proxy-based SIP ALG handles all SIP traffic by default from FortiOS 5.2[^7] | Managed via system settings and session helpers[^12][^9] | Cisco states that the IOS XE SIP ALG does not provide any security features[^17]. Cisco documents the `no ip nat service sip` command for disabling NAT support for SIP on IOS XE[^15]. To disable the SIP ALG on a Palo Alto Networks NGFW, go to Objects > Applications and select the sip application, choose Customize for ALG in the Options section, check Disable ALG, click OK, and commit[^27]. Prisma Access does not support disabling the ALG on the predefined sip application; Palo Alto Networks recommends an application override policy for the SIP ports instead[^28]. According to Fortinet, in FortiOS 5.0 the SIP session helper applied when no VoIP profile was applied, while from FortiOS 5.2 the proxy-based SIP ALG handles all SIP traffic by default[^7]. In the Fortinet technical tip, setting `default-voip-alg-mode` under `config system settings` to `kernel-helper-based` disables the FortiGate SIP ALG[^12]. The same Fortinet tip removes the SIP session helper under `config system session-helper` by deleting the entry that handles SIP (which is 13 in the tip's example and varies by device)[^9], and clearing existing SIP sessions filtering on destination port 5060 or rebooting the unit[^8]. The Fortinet tip states that re-enabling the FortiGate SIP ALG requires a restart[^10]. On Junos OS, `show security alg status` in operational mode shows whether the SIP ALG is enabled[^23]. On Junos OS, the SIP ALG is disabled with `set security alg sip disable`[^20]. RingCentral's D-Link procedure goes to ADVANCED > FIREWALL SETTINGS, unchecks Enable SPI, sets UDP and TCP endpoint filtering to Endpoint Independent, unchecks SIP under APPLICATION LEVEL GATEWAY (ALG) CONFIGURATION, and saves[^37]. ## See also See also [Firewall ports and IP ranges for cloud calling](https://warmtransfer.net/knowledge/firewall-ports-uc). See also [Choppy and robotic audio on calls](https://warmtransfer.net/knowledge/choppy-audio-troubleshooting). See also [SIP early offer and delayed offer](https://warmtransfer.net/knowledge/sip-early-delayed-offer). See also [SIP trunk redundancy and failover design](https://warmtransfer.net/knowledge/sip-trunk-redundancy-design). ## Applicability Applies to: IETF NAT devices, IETF SIP NAT traversal, Palo Alto Networks NGFW (PAN-OS), Juniper Networks Junos OS SRX Series, Cisco IOS XE NAT, IETF SIP, RingCentral RingEX, SIP through NAT, Cisco Secure Firewall ASA, Cisco Webex Calling, Microsoft Teams Phone Direct Routing, Cisco IOS, Cisco IOS NAT, Fortinet FortiGate (FortiOS), Palo Alto Networks Prisma Access, and RingCentral RingEX with D-Link routers. Deployments: on-premises, hybrid, and multi-tenant. Sources checked 2026-09-25. Fortinet session helper and ALG procedures reflect documentation from FortiOS 5.0 and FortiOS 5.2[^7]. ## What remains uncertain FortiOS 7.x and 8.x SIP ALG and session helper admin guide is not covered by the sources below. Consumer and SMB router SIP ALG defaults and disable paths (Netgear TP-Link Ubiquiti SonicWall pfSense) are not covered by the sources below. Microsoft first-party statement on SIP ALG for Teams Phone or Direct Routing is not covered by the sources below. Resolve Juniper SRX SIP ALG default by model and release is not covered by the sources below. Registration-failure mechanism caused by SIP ALG is not covered by the sources below. Cisco Meraki MX SIP ALG behaviour is not covered by the sources below. Cisco IOS per-transport disable syntax no ip nat service sip udp port 5060 is not covered by the sources below. ## Sources [^1]: The ASA default SIP inspection does not inspect encrypted SIP. A TLS proxy must be configured for that. Source: [CLI Book 2: Cisco Secure Firewall ASA Firewall CLI Configuration Guide 9.23 - Inspection for Voice and Video Protocols](https://www.cisco.com/c/en/us/td/docs/security/asa/asa923/configuration/firewall/asa-923-firewall-config/inspect-voicevideo.html), SIP Inspection > Default SIP Inspection. Checked 2026-09-25. [^2]: With PAT on the ASA, a SIP header field that contains an internal IP address without a port might not be translated, leaking the internal address outside. Cisco suggests NAT instead of PAT to avoid this. Source: [CLI Book 2: Cisco Secure Firewall ASA Firewall CLI Configuration Guide 9.23 - Inspection for Voice and Video Protocols](https://www.cisco.com/c/en/us/td/docs/security/asa/asa923/configuration/firewall/asa-923-firewall-config/inspect-voicevideo.html), SIP Inspection > PAT Limitations for SIP Inspection. Checked 2026-09-25. [^3]: If a SIP device sends SDP whose o= (owner/creator) IP differs from the c= (connection) IP, the ASA with PAT may not translate the o= address properly because the o= field has no port. Source: [CLI Book 2: Cisco Secure Firewall ASA Firewall CLI Configuration Guide 9.23 - Inspection for Voice and Video Protocols](https://www.cisco.com/c/en/us/td/docs/security/asa/asa923/configuration/firewall/asa-923-firewall-config/inspect-voicevideo.html), SIP Inspection > PAT Limitations for SIP Inspection. Checked 2026-09-25. [^4]: On Cisco Secure Firewall ASA, SIP inspection is enabled by default through the default inspection policy. Source: [CLI Book 2: Cisco Secure Firewall ASA Firewall CLI Configuration Guide 9.23 - Inspection for Voice and Video Protocols](https://www.cisco.com/c/en/us/td/docs/security/asa/asa923/configuration/firewall/asa-923-firewall-config/inspect-voicevideo.html), SIP Inspection > Default SIP Inspection. Checked 2026-09-25. [^5]: An ALG can be detected by capturing the same SIP message on both sides of the NAT device. If Via, Contact, Record-Route or the SDP c= and m= values differ between the two captures, the device has rewritten the SIP payload, beyond translating the IP and UDP headers (inferred). Source: [SIP ALG | Junos OS](https://www.juniper.net/documentation/us/en/software/junos/alg/topics/topic-map/security-sip-alg.html), section listing rewritten headers and SDP fields. Checked 2026-09-25. [^6]: If a capture on the public side of a PAT device shows a private address still present in a SIP header or in the SDP o= field while other fields were translated, that pattern matches documented partial-translation limits of SIP inspection. It is not proof that no ALG is present (inferred). Source: [CLI Book 2: Cisco Secure Firewall ASA Firewall CLI Configuration Guide 9.23 - Inspection for Voice and Video Protocols](https://www.cisco.com/c/en/us/td/docs/security/asa/asa923/configuration/firewall/asa-923-firewall-config/inspect-voicevideo.html), PAT Limitations for SIP Inspection. Checked 2026-09-25. [^7]: According to Fortinet, from FortiOS 5.2 the FortiOS proxy-based SIP ALG handles all SIP traffic by default. In FortiOS 5.0 the SIP session helper applied when no VoIP profile was applied. Source: [Technical Tip: Disabling VoIP Inspection](https://community.fortinet.com/t5/FortiGate/Technical-Tip-Disabling-VoIP-Inspection/ta-p/194131), version note in article body. Checked 2026-09-25. [^8]: After changing FortiGate SIP handling, the tip says to clear existing SIP sessions (filter on destination port 5060 and clear) or reboot the unit. Source: [Technical Tip: Disabling VoIP Inspection](https://community.fortinet.com/t5/FortiGate/Technical-Tip-Disabling-VoIP-Inspection/ta-p/194131), Step 3 Clear Sessions or Reboot. Checked 2026-09-25. [^9]: The same Fortinet tip also removes the SIP session helper. You list entries under config system session-helper and delete the entry that handles SIP. The entry number, 13 in the tip's example, varies by device. Source: [Technical Tip: Disabling VoIP Inspection](https://community.fortinet.com/t5/FortiGate/Technical-Tip-Disabling-VoIP-Inspection/ta-p/194131), Step 1 Disable SIP Session Helper. Checked 2026-09-25. [^10]: The Fortinet tip states that re-enabling the FortiGate SIP ALG requires a restart. Source: [Technical Tip: Disabling VoIP Inspection](https://community.fortinet.com/t5/FortiGate/Technical-Tip-Disabling-VoIP-Inspection/ta-p/194131), warning notes. Checked 2026-09-25. [^11]: Fortinet's 2015 technical tip says the FortiGate SIP ALG should be disabled only for troubleshooting, to isolate a problem. Cisco instead recommends switching SIP ALG off for Webex Calling as standing practice (disputed). Source: [Technical Tip: Disabling VoIP Inspection](https://community.fortinet.com/t5/FortiGate/Technical-Tip-Disabling-VoIP-Inspection/ta-p/194131), warning notes. Checked 2026-09-25. [^12]: In the Fortinet technical tip, default-voip-alg-mode under config system settings defaults to proxy-based. Setting it to kernel-helper-based disables the FortiGate SIP ALG. Source: [Technical Tip: Disabling VoIP Inspection](https://community.fortinet.com/t5/FortiGate/Technical-Tip-Disabling-VoIP-Inspection/ta-p/194131), Step 2 Disable SIP-ALG. Checked 2026-09-25. [^13]: The Cisco IOS NAT SIP ALG translates embedded addresses including the SDP connection and media lines, but only embedded IPv4 addresses. Source: [IP Addressing: NAT Configuration Guide, Cisco IOS Release 15M&T - NAT TCP SIP ALG Support](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/15-mt/nat-15-mt-book/nat-tcp-sip-alg.html), Restrictions for NAT TCP SIP ALG Support; debug output example. Checked 2026-09-25. [^14]: On Cisco IOS and IOS XE NAT, NAT support for SIP (the SIP ALG) is enabled by default on port 5060. Source: [IP Addressing: NAT Configuration Guide, Cisco IOS XE Release 3S - SIP ALG Hardening for NAT and Firewall](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-3s/nat-xe-3s-book/iadnat-fw-sip-alg-hardng.html), Information About SIP ALG Hardening for NAT and Firewall. Checked 2026-09-25. [^15]: Cisco documents the no ip nat service sip command for disabling NAT support for SIP on IOS XE. Source: [IP Addressing: NAT Configuration Guide, Cisco IOS XE Release 3S - SIP ALG Hardening for NAT and Firewall](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-3s/nat-xe-3s-book/iadnat-fw-sip-alg-hardng.html), Information About SIP ALG Hardening for NAT and Firewall. Checked 2026-09-25. [^16]: The Cisco IOS XE SIP ALG reads the Via, Contact and Record-Route headers to create firewall pinholes and NAT translation doors. Source: [IP Addressing: NAT Configuration Guide, Cisco IOS XE Release 3S - SIP ALG Hardening for NAT and Firewall](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-3s/nat-xe-3s-book/iadnat-fw-sip-alg-hardng.html), Information About SIP ALG Hardening > Via header and Record-Route handling. Checked 2026-09-25. [^17]: Cisco states that the IOS XE SIP ALG does not provide any security features. Source: [IP Addressing: NAT Configuration Guide, Cisco IOS XE Release 3S - SIP ALG Hardening for NAT and Firewall](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-3s/nat-xe-3s-book/iadnat-fw-sip-alg-hardng.html), Restrictions for SIP ALG Hardening for NAT and Firewall. Checked 2026-09-25. [^18]: Juniper's sip (Security) statement reference states that the SIP ALG is disabled by default on SRX5600 and SRX5800 devices, implying other SRX models default to enabled (disputed). Source: [sip (Security) | Junos OS](https://www.juniper.net/documentation/us/en/software/junos/alg/topics/ref/statement/security-edit-sip.html), Description / default note. Checked 2026-09-25. [^19]: Juniper's SIP ALG topic page states that the SIP ALG is disabled by default on SRX devices and enabled by default on other devices (disputed). Source: [SIP ALG | Junos OS](https://www.juniper.net/documentation/us/en/software/junos/alg/topics/topic-map/security-sip-alg.html), SIP ALG overview default-state note. Checked 2026-09-25. [^20]: On Junos OS, the SIP ALG is disabled with set security alg sip disable (the general form is set security alg alg-name disable). Source: [sip (Security) | Junos OS](https://www.juniper.net/documentation/us/en/software/junos/alg/topics/ref/statement/security-edit-sip.html), Options > disable. Checked 2026-09-25. [^21]: The Junos SIP ALG monitors SIP transactions and dynamically creates pinholes for RTP and RTCP, based on the addresses and ports it extracts from the SDP. Source: [SIP ALG | Junos OS](https://www.juniper.net/documentation/us/en/software/junos/alg/topics/topic-map/security-sip-alg.html), SIP ALG overview > pinhole creation. Checked 2026-09-25. [^22]: Juniper documents that the Junos SIP ALG modifies the Via, Contact, Route and Record-Route headers and the SDP c= and m= fields. Source: [SIP ALG | Junos OS](https://www.juniper.net/documentation/us/en/software/junos/alg/topics/topic-map/security-sip-alg.html), SIP ALG overview and NAT sections. Checked 2026-09-25. [^23]: On Junos OS, show security alg status in operational mode shows whether the SIP ALG is enabled. Source: [SIP ALG | Junos OS](https://www.juniper.net/documentation/us/en/software/junos/alg/topics/topic-map/security-sip-alg.html), verification section. Checked 2026-09-25. [^24]: One-way or no audio is a plausible result of an ALG that rewrites the SDP c= or m= values incorrectly, or opens RTP pinholes for the wrong address or port. The far end then sends RTP to a destination that does not reach the phone (inferred). Source: [SIP ALG | Junos OS](https://www.juniper.net/documentation/us/en/software/junos/alg/topics/topic-map/security-sip-alg.html), pinhole creation and SDP field rewriting sections. Checked 2026-09-25. [^25]: Palo Alto Networks states that when a VoIP client application has NAT intelligence embedded, the firewall's SIP ALG can interfere with signaling and cause the client application to stop working. Source: [Disable the SIP Application-level Gateway (ALG)](https://docs.paloaltonetworks.com/ngfw/administration/app-id/disable-the-sip-application-level-gateway-alg), page introduction. Checked 2026-09-25. [^26]: On Palo Alto Networks NGFWs, the SIP ALG is used to open dynamic pinholes in the firewall where NAT is enabled. Source: [Disable the SIP Application-level Gateway (ALG)](https://docs.paloaltonetworks.com/ngfw/administration/app-id/disable-the-sip-application-level-gateway-alg), page introduction. Checked 2026-09-25. [^27]: To disable the SIP ALG on a Palo Alto Networks NGFW, go to Objects > Applications and select the sip application. Choose Customize for ALG in the Options section, check Disable ALG, click OK, and commit. Source: [Disable the SIP Application-level Gateway (ALG)](https://docs.paloaltonetworks.com/ngfw/administration/app-id/disable-the-sip-application-level-gateway-alg), procedure steps 1 to 5. Checked 2026-09-25. [^28]: Prisma Access does not support disabling the ALG on the predefined sip application. Palo Alto Networks recommends an application override policy for the SIP ports instead. Source: [How to disable SIP ALG in Prisma Access](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OKsCAM), article body. Checked 2026-09-25. [^29]: Registration failures attributed to SIP ALG plausibly come from Contact or Via rewriting that conflicts with the endpoint's own NAT handling. The collected vendor sources state interference in general terms but do not document a registration-specific mechanism (inferred). Source: [Disable the SIP Application-level Gateway (ALG)](https://docs.paloaltonetworks.com/ngfw/administration/app-id/disable-the-sip-application-level-gateway-alg), page introduction. Checked 2026-09-25. [^30]: Under RFC 3261, a server that receives a request whose top Via sent-by host is a domain name, or an IP address that differs from the packet's source address, adds a received parameter carrying the actual source address to that Via. Source: [RFC 3261 — SIP: Session Initiation Protocol](https://www.rfc-editor.org/rfc/rfc3261.html), Section 18.2.1 Receiving Requests. Checked 2026-09-25. [^31]: RFC 4787 warns that NAT ALGs may interfere with UNSAF methods or protocols that try to be NAT-aware and must be used with extreme caution. Source: [RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127)](https://www.rfc-editor.org/rfc/rfc4787.html), Section 7 third paragraph. Checked 2026-09-25. [^32]: RFC 4787 (BCP 127) REQ-10 states that NAT ALGs for UDP-based protocols SHOULD be turned off, so that they do not interfere with UNSAF NAT traversal mechanisms and so that integrity protection of UDP communications is possible. Source: [RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127)](https://www.rfc-editor.org/rfc/rfc4787.html), Section 7 REQ-10. Checked 2026-09-25. [^33]: RFC 4787 observes that some NATs keep ALGs such as the SIP ALG permanently on, some turn them on by default but allow them to be turned off, and some leave them off by default but allow them to be turned on. Source: [RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127)](https://www.rfc-editor.org/rfc/rfc4787.html), Section 7 second paragraph. Checked 2026-09-25. [^34]: RFC 4787 REQ-10 a) recommends that a NAT that includes ALGs let the administrator enable or disable each ALG separately. Source: [RFC 4787: Network Address Translation (NAT) Behavioral Requirements for Unicast UDP (BCP 127)](https://www.rfc-editor.org/rfc/rfc4787.html), Section 7 REQ-10 item a). Checked 2026-09-25. [^35]: RFC 6314 lists practical limitations of SIP ALGs: they require media and signaling to traverse the same device, and they do not work with encrypted signaling or payload. Source: [RFC 6314: NAT Traversal Practices for Client-Server SIP](https://www.rfc-editor.org/rfc/rfc6314.html), Section 3 Problem Statement. Checked 2026-09-25. [^36]: RFC 6314 builds its SIP NAT traversal practices on the assumption that NATs do not contain SIP-aware ALGs. It notes that experience shows such ALGs can have an adverse impact on SIP functionality. Source: [RFC 6314: NAT Traversal Practices for Client-Server SIP](https://www.rfc-editor.org/rfc/rfc6314.html), Section 3 Problem Statement. Checked 2026-09-25. [^37]: RingCentral's D-Link procedure goes to ADVANCED > FIREWALL SETTINGS, unchecks Enable SPI, and sets UDP and TCP endpoint filtering to Endpoint Independent. It then unchecks SIP under APPLICATION LEVEL GATEWAY (ALG) CONFIGURATION and saves. Source: [Network - Disable SIP ALG on a D-Link Router](https://support.ringcentral.com/article-v2/How-to-disable-Sip-ALG-on-a-D-link-Router.html?brand=RC_US&product=RingEX&language=en_US), procedure steps 3 to 7. Checked 2026-09-25. [^38]: RingCentral says SIP ALG can contribute to one-way audio and audio quality issues on its service. Source: [Network - Disable SIP ALG on a D-Link Router](https://support.ringcentral.com/article-v2/How-to-disable-Sip-ALG-on-a-D-link-Router.html?brand=RC_US&product=RingEX&language=en_US), article introduction. Checked 2026-09-25. [^39]: If a device between a Direct Routing SBC and Microsoft could read and rewrite the Contact or Record-Route host to an IP address, Microsoft's documented rules would reject or fail the call. Because Direct Routing signaling runs over TLS, a firewall without TLS interception cannot normally rewrite it in the first place (inferred). Source: [Teams Phone System Direct Routing: SIP protocol](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-protocols-sip), Use of FQDN name in Contact or Record-Route; Contact header. Checked 2026-09-25. [^40]: For Teams Direct Routing, every incoming OPTIONS and INVITE to the Microsoft SIP proxy must carry the paired SBC's FQDN, not an IP address, in the Contact header URI hostname. Source: [Teams Phone System Direct Routing: SIP protocol](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-protocols-sip), Detailed requirements for Contact header and Request-URI > Contact header. Checked 2026-09-25. [^41]: Teams Direct Routing refuses an incoming INVITE or OPTIONS whose Contact hostname is an IP address rather than an FQDN, with a 403 Forbidden. Source: [Teams Phone System Direct Routing: SIP protocol](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-protocols-sip), Detailed requirements for Contact header and Request-URI > Contact header last paragraph. Checked 2026-09-25. [^42]: Teams Direct Routing supports only an FQDN matching the SBC certificate in Record-Route or Contact. If an IP address appears in either header, the certificate check and the call fail. Source: [Teams Phone System Direct Routing: SIP protocol](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-protocols-sip), Contact and Record-Route headers considerations > Use of FQDN name in Contact or Record-Route. Checked 2026-09-25. [^43]: Microsoft does not support a third-party SIP proxy or user agent server between the Microsoft SIP proxy and the paired SBC that might modify the Request-URI created by the SBC. Source: [Teams Phone System Direct Routing: SIP protocol](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-protocols-sip), Processing the incoming request: finding the tenant and user, step 5. Checked 2026-09-25. [^44]: The Webex Calling port reference gives no device-specific steps for disabling SIP ALG. It directs administrators to the relevant manufacturer's documentation. Source: [Port Reference Information for Webex Calling](https://help.webex.com/article/b2exve/port-reference-information-for-cisco-webex-calling), section 'SIP Application Layer Gateway' last sentence. Checked 2026-09-25. [^45]: Cisco states that, although all Webex Calling traffic is encrypted, certain SIP ALG implementations can still cause firewall traversal issues. Source: [Port Reference Information for Webex Calling](https://help.webex.com/article/b2exve/port-reference-information-for-cisco-webex-calling), section 'SIP Application Layer Gateway'. Checked 2026-09-25. [^46]: Cisco recommends turning off SIP ALG or similar SIP-aware functionality on routers and firewalls in the path of Webex Calling traffic. Source: [Port Reference Information for Webex Calling](https://help.webex.com/article/b2exve/port-reference-information-for-cisco-webex-calling), section 'SIP Application Layer Gateway'. Checked 2026-09-25.