Even though SIP ALG is intended to assist users who have phones on private IP addresses (Class C 192.168.X.X), in many cases it is implemented poorly and actually causes more problems than it solves. SIP ALG modifies SIP packets in unexpected ways, corrupting them and making them unreadable. This can give you unexpected behaviour, such as phones not registering and incoming calls failing.

Therefore if you are experiencing problems we recommend that you check your router settings and turn SIP ALG off if it is enabled.

  • Lack of incoming calls: When a UA is switched on it sends a REGISTER request to the proxy in order to be localisable and receive any incoming calls. This REGISTER is modified by the ALG feature (if not the user wouldn’t be reachable by the proxy since it indicated a private IP in REGISTER “Contact” header). Common routers just maintain the UDP “connection” open for a while (30-60 seconds) so after that time the port forwarding is ended and incoming packets are discarded by the router. Many SIP proxies maintain the UDP keepalive by sending OPTIONS or NOTIFY messages to the UA, but they just do it when the UA has been detected as NAT’d during the registration. A SIP ALG router rewrites the REGISTER request to the proxy doesn’t detect the NAT and doesn’t maintain the keepalive (so incoming calls will be not possible).
  • Breaking SIP signalling: Many of the actual common routers with inbuilt SIP ALG modify SIP headers and the SDP body incorrectly, breaking SIP and making communication just impossible. Some of them do a whole replacing by searching a private address in all SIP headers and body and replacing them with the router public mapped address (for example, replacing the private address if it appears in “Call-ID” header, which makes no sense at all). Many SIP ALG routers corrupt the SIP message when writing into it (i.e. missed semi-colon “;” in header parameters). Writing incorrect port values greater than 65536 is also common in many of these routers.
  • Disallows server-side solutions: Even if you don’t need a client-side NAT solution (your SIP proxy gives you a server NAT solution), if your router has SIP ALG enabled that breaks SIP signalling, it will make communication with your proxy impossible.


To disable this


Disabling the SIP ALG in a VoIP profile
SIP is enabled by default in a VoIP profile. If you are just using the VoIP profile for SCCP you can use the following command to disable SIP in the VoIP profile.

config voip profile
edit VoIP_Pro_2
config sip
set status disable

The SIP ALG setting is usually found in the Security menu.

  1. Vodafone / Huawei (HHG2500)
  2. TalkTalk / Huawei (HG633)
  3. EE / Huawei (E5330)
Type the following into the CLI
To check if currently enabled or disabled run show security alg status | match sip
To disable run:

set security alg sip disable


On Cisco devices, SIP-ALG is referred to as SIP Fixup and is enabled by default on both routers and Pix devices. Because this is a default setting, no indication of it being “on” or “off” is visible in the configuration.

To disable SIP Fixup, issue the no ip nat service sip commands:

no ip nat service sip tcp port 5060
no ip nat service sip udp port 5060