Table of Contents
Scope:
Intended Audience: All End Users
This article will provide several steps for disabling SIP ALG on different firewalls. SIP ALG modifies SIP packets in unexpected ways, corrupting them and making them unreadable. This can give you unexpected behavior, such as phones not registering and incoming calls failing. You will need access to the firewall to make these changes.
Signs of SIP ALG or Double NAT
How to disable SIP ALG #
| Router Manufacturer | Steps to disable SIP ALG |
|---|---|
| Actiontec | Select Advanced, click Yes to accept the warning, then click ALG’s.Ensure SIP ALG is disabled by removing the check.Click Apply.Select Advanced, click Yes to accept the warning, then click Remote Administration.Click the checkbox to Allow Incoming WAN ICMP Echo Requests (for traceroute and ping), then click Apply. |
| Adtran | Under Firewall, go to Firewall / ACLs.Click on ALG Settings.Uncheck the box labeled SIP ALGClick Apply.If you are using the terminal, issue the following command:no ip firewall alg sip |
| Arris | Most Arris broadband gateways:Navigate to the gateway’s IP (192.168.0.1).Username: admin Password: motorolaNavigate to Advanced, then Options.Uncheck the SIP box.Click Apply.Arris BGW210Navigate to 192.168.1.254. Authenticate without a username, and use the password located on the unit’s sticker.Under the Firewall section, click on Advanced Firewall.Change the Set SIP ALG setting to off.Turn off the Authentication Header Forwarding.Turn off ESP Header Forwarding.Click Save. |
| Asus | Under the Advanced Settings section, click WAN.Click the NAT Passthrough tab.Change the SIP Passthrough setting to “Disable.”Click Apply. |
| AT&T | U-Verse Pace 5268AC GatewayThis broadband gateway does not support disabling SIP ALG. We recommend configuring your gateway to function only as a modem, not a router (Bridge Mode). You will need to use another router that supports disabling SIP ALG. |
| Cisco | Cisco General and Enterprise-Class routers:no ip nat service sip tcp port 5060no ip nat service sip udp port 5060Cisco PIX routers:no fixup protocol sip 5060no fixup protocol sip udp 5060Cisco ASA routers:Locate ‘Class inspection_default’ under ‘Policy-map global_policy’. Execute this command: no inspect sip |
| D-Link | Click on Advanced Settings.Locate the Application Level Gateway (ALG) Configuration.Uncheck the SIP option.Click Save.DIR-655:Click Advanced, located along the top.Click Firewall Settings on the left side of the screen.Uncheck Enable SPISet both UDP and TCP Endpoint Filtering to Endpoint Independent.Uncheck SIP from Application Level Gateway Configuration.Click Save. |
| Fortinet | Use the following commands from the CLI interface:config system session-helpershow system session-helperFind the SIP session instance, typically indicated by #12Delete #12 or the appropriate numberConfirm its deletion by executing this command:show system session-helper |
| Linksys | Linksys Smart Wi-Fi (E-series):On the left side of the screen, click on Connectivity.Click the Administration tab.Under Application Layer Gateway, verify SIP is unchecked.Click Apply or Save.Older Linksys models:Go to the ‘Advanced’ section on the Admin pageDisable the SIP ALG feature.Linksys BEFSR41 routers:Click on Applications and Gaming on the Admin page.Click on Port Triggering. Type in ‘TCP’ as the application.Type in ‘5060’ into the Start Port and End Port for the ‘Triggering Range’ and ‘Forwarded Range’ fields.Check ‘Enable’.Click on Save and Reboot. |
| Mikrotik | For Mikrotik routers, SIP ALG is known as SIP Helper.Use the company’s winbox software.Navigate to IP, then Firewall.Click on the Service Ports tab and disable it through the GUI.You may also run this command from the terminal:/ip firewall service-port disable sip |
| Netgear | For Netgear routers with the Genie interface:Select the Advanced tab at the top.Expand the Setup menu on the left side of the screen.Click WAN Setup.Check the box labeled Disable SIP ALG.Other Netgear routers:Under the Security/Firewall, click on Advanced Settings.Disable SIP ALG.Locate Session Limit under Security/Firewall.Increase the UDP timeout to 300 sec. |
| SonicWall | Under System Setup on the left side of the screen, click on VoIP.Check ‘Enable Consistent NAT’Uncheck ‘Enable SIP Transformations’.Click Accept.To increase UDP timeouts, navigate to the Firewall Settings, then Flood Protection.Click on the UDP tab and modify the default UDP connection timeout to 300 seconds.Click the Accept button to save the changes. |
| TP-Link | Newer TP-Link routers (Archer series):Click on the Advanced Tab.Expand the NAT Forwarding menu on the left side of the screen.Uncheck SIP ALG, RTSP ALG, and H323 ALG checkboxes.Click Save.Older TP-Link routers:Use the Telnet client from the Command Prompt.Apply the following command:ip nat service sip sw off |
| UBEE | Go to Advanced, then Options.Uncheck the SIP and the RTSP checkboxes.Click Apply. |
| Ubiquiti | UniFi Security GatewaySign in to your UniFi security gateway.Click on Routing & Firewall along the left side.Click the Firewall tab at the top and click Settings from the sub-menu.Toggle H.323 and SIP to off.Click the Apply Changes button.EdgeRouters (ER-x)Access the router’s administrative interface, typically at 192.168.1.1.Use the Config Tree or a command-line interface to disable SIP ALG.Config Tree:Select config tree in the top right-hand corner.Expand system, conntrack, modules, and sip.Click the plus sign next to disable.Click the Preview option.Click Apply.Command Line Interface:From the administrative interface, choose CLI located at the top right corner of the screen.From here, we can also increase UDP timeouts as well.Enter these commands into the terminal:configureset system conntrack modules sip disableset system conntrack timeout udp stream 300set system conntrack timeout udp other 300commitsaveexit |
| Verizon FiOS | G1100This broadband gateway does not support disabling SIP ALG. We recommend configuring your gateway to function only as a modem, not a router. You will need to use another router that supports disabling SIP ALG. |
| ZyXEL | ZyXEL ZyWALL/USG60:Click on Configuration and expand the Network settings.Click ALG along the left side.Uncheck all the checkboxes on the right side:Uncheck Enable SIP ALG.Uncheck Enable SIP Transformations.Click Apply.ZyXEL C1000Z/C1100Z (CenturyLink):Click on Advanced Setup.Click on SIP ALG along the left side.Toggle the SIP ALG setting to Disable.Click Apply.ZyXEL P600:Telnet to the router (192.168.1.1) and enter the password.The default password is 1234. Type “24” and press enter.Then “8” and press enter.Provide this command:ip nat service sip active 0When done, press Enter |
