VoIP problems are frustrating. They're often intermittent, difficult to reproduce, and always urgent because they affect the phone system. If you're experiencing issues like handsets failing to register, calls not connecting, one-way audio, or BLF keys behaving erratically — SIP ALG should be the first thing you check.

What is SIP ALG?

SIP ALG stands for SIP Application Layer Gateway. It's a feature built into many commercial routers that's designed to help VoIP traffic pass through NAT (Network Address Translation) firewalls.

The idea was sensible when VoIP was new: SIP packets carry IP addresses inside the packet body, not just in the headers. A standard NAT router doesn't modify those embedded addresses, which can cause issues when the device is behind a firewall. SIP ALG was designed to inspect and rewrite those embedded addresses.

The problem is that modern VoIP providers have developed far more reliable methods of handling NAT traversal. SIP ALG doesn't just fail to help — it actively interferes, mangling packets in ways that break calls.

Common symptoms of SIP ALG interference

  • Handsets fail to register (or register intermittently)
  • Incoming calls don't ring, or only ring some handsets
  • BLF (Busy Lamp Field) keys don't update or behave unpredictably
  • One-way audio — caller can hear you but you can't hear them, or vice versa
  • Audio drops out mid-call
  • Calls work fine for a while, then stop working after a router reboot

How to disable SIP ALG on common routers

Cisco / Meraki

Under Security & SD-WAN → Firewall → navigate to the Layer 7 firewall settings and disable SIP inspection.

FortiGate

Via CLI: navigate to system session-helper, locate the SIP entry, and delete it. Additionally, configure VoIP profile to set sip-helper disable and sip-nat-trace disable, then reboot.

Draytek

Go to NAT → ALG in the web interface and disable SIP ALG.

Mikrotik

Navigate to IP → Firewall → Service Ports and disable SIP.

Ubiquiti / UniFi

In the UniFi controller, go to Settings → Firewall → Routing & Firewall → Conntrack Modules and disable both SIP and H.323.

TP-Link

Go to Network → ALG Settings and disable the SIP option.

D-Link

Navigate to Advanced → Firewall Settings and uncheck both SIP and "Enable SPI."

Billion

Go to Advanced Setup → NAT → ALG and disable SIP.

After disabling SIP ALG: Once disabled, reboot the router and test the phone system. In most cases where SIP ALG was the culprit, the issues resolve immediately. If problems persist, the next things to check are: firewall rules blocking UDP traffic on port 5060, QoS settings deprioritising VoIP traffic, and whether the router is the only device between the VoIP phones and the internet. If you're not confident making these changes yourself — call our team. Diagnosing VoIP problems is something we do regularly.