Call quality transfer, ring and audio issue troubleshooting.

Often times if phones wont register or calls are not ringing phones properly, failed call transfers, phone continues to ring after another phone has picked up, or issues with audio setting up properly during a call is due to SIP ALG on the client Lan being enabled and not implemented properly. UGS recomends that SIP ALG be disabled on all isp and customer lan equipment (Modem, router, firewall, layer 3 switch) for best voice experience.  

How can it affect VoIP?

Even though SIP ALG is intended to assist users who have phones on private IP addresses (Class C 192.168.X.X), in many cases it is implemented poorly and actually causes more problems than it solves. SIP ALG modifies SIP packets in unexpected ways, corrupting them and making them unreadable. This can give you unexpected behaviour, such as phones not registering and incoming calls failing.

 Lack of incoming calls: When a UA is switched on it sends a REGISTER request to the proxy in order to be localisable and receive any incoming calls. This REGISTER is modified by the ALG feature (if not the user wouldn't be reachable by the proxy since it indicated a private IP in REGISTER "Contact" header). Common routers just maintain the UDP "connection" open for a while (30-60 seconds) so after that time the port forwarding is ended and incoming packets are discarded by the router. Many SIP proxies maintain the UDP keepalive by sending OPTIONS or NOTIFY messages to the UA, but they just do it when the UA has been detected as NAT'd during the registration. A SIP ALG router rewrites the REGISTER request to the proxy doesn't detect the NAT and doesn't maintain the keepalive (so incoming calls will be not possible).

Breaking SIP signalling: Many of the actual common routers with inbuilt SIP ALG modify SIP headers and the SDP body incorrectly, breaking SIP and making communication just impossible. Some of them do a whole replacing by searching a private address in all SIP headers and body and replacing them with the router public mapped address (for example, replacing the private address if it appears in "Call-ID" header, which makes no sense at all). Many SIP ALG routers corrupt the SIP message when writing into it (i.e. missed semi-colon ";" in header parameters). Writing incorrect port values greater than 65536 is also common in many of these routers.

Disallows server-side solutions: Even if you don't need a client-side NAT solution (your SIP proxy gives you a server NAT solution), if your router has SIP ALG enabled that breaks SIP signalling, it will make communication with your proxy impossible.


Therefore if you are experiencing problems we recommend that you check your router settings and turn SIP ALG off if it is enabled.


Below are the steps to disable SIP ALG on common Vendor Hardware. 

Most home/residential routers have a web interface. Typically this is but you just check your default gateway by typing ipconfig in Windows command prompt or ifconfig on Linux systems from any connected device on the same LAN.
If your router does not have a web interface you will most likely need a Telnet client to login.
If you don't have a telnet client installed we recommend PUTTY (
Connect in telnet to the IPv4 address of your gateway and hit enter again.

Asus Routers


Disable the option SIP Passthrough under Advanced Settings / WAN -> NAT Passthrough.
If your router doesn't have this option SIP ALG may be disabled via Telnet.

nvram get nf_sip 
(It should return a "1")

nvram set nf_sip=0 
nvram commit

AVM Fritz!Box


SIP ALG cannot be disabled. (See above on how to get around this)

Barracuda Firewalls


Go to Firewall > Firewall Rules > Custom FirewallAccess Rules
Click the "Disabled" check box next to any rules named LAN-2-INTERNET-SIP and INTERNET-2-LAN-SIP
This disables SIP ALG.

Belkin F5D, F6D, F7D, FDS, F9K Series 

Thesee Routers dont support disabling sip alg. UGS suggest replacing with a higher quality router capable of handling sip traffic. 



Navigate to the web interface
-> Select Configuration
-> Select NAT
-> Select ALG
-> Disable SIP ALG


Log onto the router's terminal (command line interface) via telnet, SSH or serial console


configure terminal

no ip nat service sip udp port 5060
For TCP also run no ip nat service sip tcp port 5060



In 'Advanced' settings --> 'Application Level Gateway (ALG) Configuration' un-tick the 'SIP' option.




Disabling the SIP ALG in a VoIP profile
SIP is enabled by default in a VoIP profile. If you are just using the VoIP profile for SCCP you can use the following command to disable SIP in the VoIP profile.

config voip profile
edit VoIP_Pro_2
config sip
set status disable



The SIP ALG setting is usually found in the Security menu.

  1. Vodafone / Huawei (HHG2500)
  2. TalkTalk / Huawei (HG633)
  3. EE / Huawei (E5330)



Type the following into the CLI
To check if currently enabled or disabled run show security alg status | match sip
To disable run:

set security alg sip disable



Check for a SIP ALG option in the Administration tab under 'Advanced'.
You should also disable the SPI Firewall option.



Mikrotik SIP ALG is called a SIP Helper and is located under /IP>Firewall>Service ports

To disable, run this command from the terminal:

/ip firewall service-port disable sip

Or from winbox just navigate to IP>Firewall and then click on the Service Ports tab and disable it through the GUI.



Look for a 'SIP ALG' checkbox in 'WAN' settings.

Under 'NAT Filtering' uncheck the option 'SIP ALG'
Port Scan and DoS Protection should also be disabled.
Disable STUN in VoIP phone's settings.

SonicWALL Firewall


Under the VoIP tab, the option 'Enable Consistent NAT' should be enabled and 'Enable SIP Transformations' unchecked.
Detailed instructions can be found here:

Technicolor / Thompson


TG588 TG589 TG582


Open Command Prompt – “Start” → “Run” → type “cmd” and press “Enter”.
In Command Prompt, type “telnet” and press enter. is the default IP address of the router. If you are running on Windows 7/8/8.1/10, you might need to install the telnet client from “Control Panel” → “Programs and Features” → “Turn Windows features on and off”.
The default username is “Administrator”, and there is no default password, leave blank.
Type “connection unbind application=SIP port=5060” and press “Enter”.
Type “ saveall ” and press “Enter”.
Type “exit” and press “Enter” to exit the telnet session.



Depending on the version of Tomato, SIP ALG can be found under Advanced then Conntrack/Netfilter in the Tracking/NAT Helpers section. If you find SIP checked then SIP ALG is enabled. Uncheck it to disable it.



Navigate to your routers web interface.
The default username is admin and the default password is admin.
On the left, click on Advanced Setup and then click on NAT and then click on ALG.
Uncheck the box by SIP Enabled. (Some TP firmware shows this as SIP Transformations which is the same thing).
Click Save/Apply.

UBEE Gateways


Go to Advanced > Options.
Disable (uncheck) SIP.
Disable (uncheck) RTSP.
Click Apply.



Use the configuration tree if supported: system -> conntrack -> modules -> sip -> disable

Alternatively, you can SSH into the device and run the following commands:

set system conntrack modules sip disable

Virgin SuperHub


SIP ALG cannot be disabled in the settings of SuperHubs.
Please see our workarounds at the top of the page.

Watchguard Firewall


Detailed instructions can be found here:



Under Network or Advanced -> ALG un-tick the options Enable SIP ALG and Enable SIP Transformations.
Telnet commands must be used to disable SIP ALG with some other Zyxel routers.

  1. Telnet into the router.
  2. Select menu items 24 then 8.
  3. To display the current SIP ALG status run the following command:
  4. ip nat service sip active
  5. To turn off SIP ALG:
  6. ip nat service sip active 0

ZyXEL (ZyWALL USG Routers)


Go to Settings > Configuration > Network > ALG.
Disable SIP ALG.
Turn ON Enable SIP Transformations.
Turn OFF Enable Configure SIP Inactivity Timeout.