Simple definition
SIP ALG (Application Layer Gateway) is a feature in some routers and firewalls that inspects and modifies SIP signaling in an attempt to help it traverse NAT.
Technical definition
A SIP ALG parses SIP messages and may rewrite IP addresses or ports carried in SIP headers and SDP. Some implementations also create temporary pinholes for the related RTP media. The exact behavior depends heavily on the router or firewall implementation.
How it works / role
The SIP ALG sits between the endpoint or PBX and the remote SIP peer. It tries to make the addressing carried inside the signaling match the NAT translation performed by the network device. If the ALG misinterprets the protocol or conflicts with NAT handling already performed by a PBX or SBC, it can break registration, signaling, or media instead of helping.
What is it used for?
Support some legacy SIP deployments behind NAT and identify a common cause of VoIP issues when the PBX already manages NAT traversal itself.
Practical example
A phone registers successfully but calls have one-way audio. A packet capture shows that the firewall rewrites an SDP address that the PBX had already corrected; disabling the SIP ALG restores the RTP media path.
Common issues
- Incorrect rewriting of SIP or SDP addresses and ports
- One-way audio or missing RTP media
- Unstable SIP registrations or dropped calls
- Behavior changes after a firewall firmware update
Key takeaway: On a modern VoIP architecture, verify whether the PBX or SBC already handles NAT before allowing a SIP ALG to rewrite signaling.