What is SIP ALG and Why You Need to Disable It?

Last updated 8 months ago

Was this helpful?

SIP ALG is the Session Initiation Protocol Application Layer Gateway feature that many routers have enabled by default.

You've successfully set up your VoIP phone system, but you're encountering issues such as dropped calls, absence of incoming calls, or persistent ringing even after answering the call and no voice. The solution to these Voice over IP problems could be as simple as disabling SIP ALG.

In this comprehensive guide, we'll delve into why it's crucial to turn off SIP ALG and provide practical tips to optimize your network for VoIP phone service. This guide is designed to be user-friendly for beginners while still offering valuable insights for advanced users. Let's dive in!

What is SIP ALG?

SIP ALG stands for Session Initiation Protocol Application Layer Gateway. This technology, which is also called an application-level gateway, is available on most commercial routers, and it helps users more reliably initiate SIP calls, even when behind a LAN with a secure firewall configuration. The ALG is a network address translation (NAT) tool that changes private IP addresses and ports into public IP addresses and ports.

The SIP ALG acts as an independent firmware program to prevent firewall-related issues on the router. It inspects the SDP portion of data packets and modifies them so that they send correctly. Remember, all VoIP changes audio data (voice) into packets that are then sent over the net, so theoretically, this should ensure call quality.

Unfortunately, the technology often ends up hindering the quality of SIP calls due to the multi-process nature of SIP and the delicateness of data packets. This is why many VoIP service providers tell you to disable the feature on your router.

The problem with SIP ALG is the packet rewriting aspect of it. SIP ALG can be useful to mitigate multiple NATs, but it doesn’t help the vast majority. Let’s take a more in-depth look at what’s happening with these data packets.

The diagram above shows that the Application Layer Gateway changes the destination public IPs in SIP packets. Certain commercial routers are smart enough to inspect the SIP messages themselves to leave private IP addresses alone.

Today’s Unified Communication PBX systems, conference calls, and even audio/video conferencing rely on SIP. Signaling protocols like SDP, RTP, and RTSP all face the same issues because they are a subset of SIP packets.

Signs SIP ALG Affects VoIP Calls

There are a few categories of symptoms SIP ALG could affect VoIP calls. It’s not always apparent, especially since these issues often happen silently without users knowing.

One-way audio: Only one party can hear the other during a call.
Unresponsive phones: Phones do not ring when they are called.
Dropped calls: Calls get disconnected after being connected.
Unexplained voicemail: Calls go straight to voicemail without any apparent reason.
Degraded call quality: You may start to experience static, lapses in sound transmission, or echoing. This is due to the modification of the call data during transmission or receipt.
Lost calls: With this router service, it’s easy to lose the call altogether. When data is lost and is unrecoverable, disconnection is likely.
Failed registration: If any acknowledgments fail during a call, the call will fail to connect. This is often a direct result of a SIP ALG operating in the background.

What’s occurring is that some VoIP traffic is getting lost in transit between the phone and the VoIP service provider. This disruption is due to router firewalls. This traffic is crucial for maintaining the phone’s availability and for selecting the appropriate audio codecs.

Why Disable SIP ALG?

Conventional wisdom would suggest that an Application-Level Gateway is supposed to be enabled. After all, many consumer and commercial router settings even default SIP ALG to on.

SIP ALG, a feature in most broadband routers, was introduced with good intentions to address the limitations of Network Address Translation (NAT). However, it unfortunately interferes with the built-in functionality of IP and signaling protocols, rendering it unnecessary for today’s VoIP applications.

Some routers attempt to enhance security by terminating open connections in the firewall, a process known as creating a "firewall pinhole". This allows traffic to function momentarily, but when a SIP proxy drops packets, it can disrupt VoIP calls after they have been established.

How to Disable SIP ALG on Your Router

Many routers have SIP ALG enabled by default within their device’s firmware. Thanks to user-friendly web interfaces, you can easily enable or disable this setting by checking or unchecking a box. An example is provided below:

Accessing your router’s interface is almost always very easy. Each router has the IP address of the router’s interface printed on a decal that also includes the default login information so that you change settings through a browser.

By default, many manufacturers set the login information as “admin” for the user and “password” for the pass – though some may not need a password. For commercial routers, you’ll want to change this login information to something more secure.

Unfortunately, not all router brands provide an easy method to disable certain features. Let’s guide you through some common methods used by the world’s leading router manufacturers. It’s worth noting that Cisco’s process is a bit more complex as it requires access to the command line to modify router settings.