01268 330123Mon - Fri: 9:00 - 17:30
Fix SIP ALG problems in 5 minutes for UK VoIP admins

Fix SIP ALG problems in 5 minutes for UK VoIP admins

7 October 2026

← Back to the blog

Fix SIP ALG problems in 5 minutes for UK VoIP admins

Administrator testing VoIP phone after router change

If your VoIP calls drop, go silent on one side, or fail to register, check SIP ALG on your router first and turn it off, then reboot your phones and make a two-way test call. If the fault clears, you have your answer; if it persists, the cause sits elsewhere in your NAT or firewall setup.

TL;DR:

  • Disabling SIP ALG is crucial because most implementations cause call issues by incorrectly rewriting IP addresses or ports, especially with encrypted signaling.
  • Confirm SIP ALG is active by testing on different networks or checking router logs and module status before disabling it to avoid unnecessary configuration changes.
  • Proper port forwarding, enabling STUN or outbound proxies, and configuring keepalives are essential post-disabling steps to ensure reliable SIP traffic flow.
  • Many routers hide the SIP ALG setting under various menus, so identifying and turning off the feature requires careful navigation and verifying it survives updates.
  • Persistent issues after disabling SIP ALG often stem from deeper network misconfigurations, such as firewall session timeouts or missing SIP-aware rules, requiring expert help.
Essextelephonesystems
Keep Your Business Calls Connected
Essex Telephone Systems provides tailored VoIP telephony and UK-based support for businesses dealing with persistent connectivity issues.
Explore VoIP solutions

Table of Contents

What SIP ALG is and why it sometimes breaks SIP

A Session Initiation Protocol Application Layer Gateway, or SIP ALG, is a router feature meant to help SIP traffic pass through network address translation and firewalls without you having to open ports manually, while preventing attacks like IP spoofing. In theory, it rewrites parts of the SIP signalling so your phone’s private address matches what the outside world sees.

In practice, many implementations do this badly. The NAT traversal problem that ALGs try to solve is genuinely complex, and a poorly written ALG often causes more harm than the NAT issue it was meant to fix.

Common failure points include:

  • Incorrect rewriting of IP addresses or ports inside SIP headers.
  • Mismatched port mapping between signalling and media streams.
  • Breakage when signalling is encrypted, since the ALG cannot read or safely alter it.

Common symptoms that point to SIP ALG problems

SIP ALG issues tend to produce a recognisable pattern of faults rather than random glitches, which makes them easier to isolate.

  • One-way audio: you hear the caller but they cannot hear you, or vice versa, because the ALG mangled the RTP media path.
  • Calls dropping the moment they’re answered: the signalling handshake completes but the ALG corrupts the follow-up packets.
  • Registration failures or missed inbound calls: the phone cannot maintain its session with the SIP provider, so it silently falls offline.
  • Broken hold or transfer: these features rely on mid-call re-negotiation, which is exactly where ALG rewriting tends to fail.

One-way audio and immediate drops are the strongest signals of ALG interference. Persistent choppy audio on otherwise stable calls points more towards bandwidth or codec mismatches, and a fault on a single handset but not others usually means a device problem rather than ALG.

How to check whether SIP ALG is the cause

Before changing router settings, confirm the diagnosis with a few quick tests.

  1. Swap the network path. Connect a phone to a mobile hotspot or a different router. If calls behave normally, the fault sits with your original router, not the SIP provider or handset.
  2. Isolate Wi-Fi from wired. Disable Wi-Fi on a softphone or move a desk phone to a wired port. If symptoms change, rule out Wi-Fi interference before blaming ALG.
  3. Check the router’s SIP handling directly. On Ubiquiti’s USG, admins have historically run commands such as lsmod | grep sip over SSH to confirm whether the SIP conntrack module is loaded, since a loaded module usually means ALG is active. On consumer routers, look in Firewall, NAT, or Advanced settings for a toggle labelled SIP ALG, SIP Passthrough, or SIP Fixup.
  4. Capture logs when the toggle alone doesn’t fix it. A packet capture (pcap) on the router or a SIP trace from your phone system can show whether headers are being rewritten mid-call. If you cannot read the trace confidently, this is the point to escalate to your installer or provider rather than keep guessing.

How to disable SIP ALG on common router platforms

Most routers hide the SIP ALG toggle inside Firewall, NAT, or Advanced settings, sometimes under a heading like Application Layer Gateway or VoIP Passthrough. The exact wording varies by manufacturer and firmware version, so a search through every security-related menu is worth the five minutes it takes.

  1. Log into the router’s admin interface, usually via its local IP address.
  2. Navigate to Firewall, NAT, or Advanced Settings.
  3. Find the SIP ALG, SIP Passthrough, or SIP Fixup toggle and switch it off.
  4. Save the configuration and reboot the router.
  5. Reboot your SIP phones and force re-provisioning if your phone system supports it.

Platform notes worth knowing:

  • UniFi/USG: older controller software required editing config.properties or using SSH commands, with entries such as config.ugw.voip.sip_alg_disable=true, while newer UniFi controllers expose a direct toggle under firewall settings.
  • Asus and Netgear: the option usually sits under WAN or Firewall settings, often labelled simply “SIP Passthrough”; some firmware versions reset the setting after an update, so check again after any firmware upgrade.
  • TP-Link: look under NAT Forwarding or Security, and expect similar naming inconsistencies between firmware revisions.
  • ISP-supplied broadband hubs: some, including certain BT Business Hub models, ship with SIP ALG disabled by default, while others hide the setting entirely, meaning a call to your ISP may be the only route to turning it off.

Always confirm the setting survives a reboot and a firmware update, since some routers quietly re-enable ALG after either event.

Post-change checklist: ports, STUN and verification

Turning off SIP ALG removes the interference, but your phones still need a correctly configured path for signalling and media.

  • Open the right ports. SIP signalling typically uses port 5060 (or 5061 for encrypted signalling), while RTP media usually needs a range such as 10000 to 20000 forwarded to your phone system or handsets.
  • Configure STUN or an outbound proxy. This lets your phones learn their public-facing address and keep NAT mappings aligned, which matters most on routers without a reliable ALG replacement.
  • Enable rport and keepalives on handsets. These settings keep the NAT binding open between calls so inbound sessions and registrations do not silently expire, an approach backed by standards-based NAT traversal guidance that favours connection reuse over middlebox rewriting.
  • Verify with real tests. Check that registrations stay stable for several hours, run a two-way audio test, and hold a call for longer than five minutes to catch any mid-call renegotiation faults that short tests miss.

Advanced fixes when disabling ALG isn’t enough

On more complex networks, switching off SIP ALG clears the obvious symptoms but leaves deeper issues untouched. Enterprise firewalls such as FortiGate run SIP session helpers that add inspection, rate limiting, and stateful tracking, so simply disabling the feature can remove security controls you still need; a dedicated VoIP security profile is usually the better fix.

Connection tracking, or conntrack, timeouts are another common culprit: if the firewall drops a UDP session before your phone sends its next keepalive, calls and registrations fail even with ALG off. Multi-site deployments, encrypted SIP, or several PBXs behind one firewall often call for a Session Border Controller rather than router-level tweaks.

Pro tip: Pair a disabled ALG with STUN or an outbound proxy and endpoint keepalives. ALG removal fixes the interference; these settings fix the NAT traversal that was the real underlying problem.

SIP ALG and NAT traversal fix relationship

Signs you need professional configuration rather than another router setting: calls fail only on certain routes, encrypted SIP (TLS/SRTP) won’t register at all, or the fault reappears after every firmware update.

When this needs more than a router setting

Paul here. Most SIP ALG cases I see follow the same pattern: a router update silently re-enables ALG, or an office moves to a new router without replicating the old configuration. Rebooting phones after a change and testing with a genuine two-way call catches the majority of these within minutes.

Some faults, particularly recurring ones tied to firmware updates or multi-site setups, need a visit rather than a phone call. Our UK-based support team handles both remotely where possible and on-site when the network itself needs attention.

What the SIP ALG debate gets wrong

The internet’s advice on SIP ALG is mostly right but incomplete: turning it off is the correct first move, yet too many guides stop there and imply the job is done. It rarely is. Disabling ALG removes one source of interference; it does not configure STUN, keepalives, or port forwarding, and it does not touch conntrack timeouts on a business firewall.

What the SIP ALG debate gets wrong — overview diagram

The more useful mental model is that SIP ALG is a symptom-level fix, and the NAT traversal problem underneath it needs its own solution, whether that is endpoint settings on a small network or an SBC on a larger one. Readers who treat the ALG toggle as the whole fix often reintroduce the same fault months later after a firmware update quietly flips it back on.

Prioritise the test before the toggle: confirm ALG is genuinely the cause before changing settings, because chasing the wrong fault wastes time that a five-minute hotspot test would have saved. Then build the post-change checklist into your standard process, not a one-off step, so the fix survives the next router replacement.

— Paul

How we help when SIP ALG keeps coming back

Essextelephonesystems

Persistent SIP ALG faults are often a sign the underlying network wasn’t set up with VoIP in mind, and that’s where we come in. We provide managed VoIP & SIP hosted telephony with the SIP-aware configuration built in from the start, so you’re not relying on a router toggle that firmware updates can quietly undo.

If weak Wi-Fi is adding to the problem, our wifi survey and design service identifies coverage gaps before they cause dropped calls, and our 5G & 4G routers, from £20 per month, give you a managed failover option when the main connection misbehaves. For offices outgrowing their current setup entirely, our broadband plans start from £24 per month. Get in touch and we’ll talk through what’s actually causing the fault.

FAQ

Should SIP ALG be on or off?

For most VoIP setups, SIP ALG should be off, since poorly implemented ALGs are a frequent cause of one-way audio, dropped calls, and registration failures. A small number of routers handle SIP correctly with ALG enabled, so the safest approach is to disable it and test rather than assume.

How do I disable SIP ALG on my Asus router?

On most Asus routers, the setting sits under WAN or Firewall settings, usually labelled “SIP Passthrough” or similar. Switch it off, save the configuration, then reboot both the router and your SIP phones to apply the change fully.

Should I disable SIP ALG for gaming?

SIP ALG only affects SIP-based voice traffic, so it has no direct bearing on most online gaming performance. If you run VoIP and gaming on the same router and experience voice call issues, disabling SIP ALG is still worth doing for the calls, independent of any gaming settings.

How do I disable SIP ALG in UniFi?

Older UniFi/USG controllers required editing config.properties or using an SSH command such as config.ugw.voip.sip_alg_disable=true, while newer controller software includes a direct toggle under firewall settings. After changing it, reboot the gateway and your SIP phones to confirm the setting has taken effect.

What should I check if disabling SIP ALG doesn’t fix the problem?

Confirm your SIP ports (typically 5060 signalling and an RTP range such as 10000 to 20000) are forwarded correctly, and check that your phones have STUN or an outbound proxy configured with rport enabled. If calls still fail on a business firewall, conntrack timeouts or a missing SIP-aware policy are the next likely cause.

Sources