What is SIP ALG and when to disable it ?

This Knowledge Base (KB) article provides network and security engineers with the technical guidance required to understand, diagnose, and configure SIP Application Level Gateway (SIP ALG) on Palo Alto Networks firewalls to ensure reliable VoIP communications across NAT boundaries.

Specifically, this article will help you:

• Understand SIP ALG Architecture: Learn how PAN-OS inspects Layer 7 SIP signaling, rewrites internal private IP addresses within SDP payloads, and dynamically manages predictive sessions (pinholes) for high UDP media streams (RTP/RTCP).

• Identify Deployment Requirements: Evaluate your network topology to determine whether to enable or disable SIP ALG based on the presence of cloud PBXs (Teams, Zoom, RingCentral), native NAT traversal tools (STUN/TURN/ICE), or encrypted SIP-TLS traffic.

• Diagnose VoIP Issues: Capture and inspect SIP INVITE and 200 OK SDP headers to verify payload translation and resolve common issues such as one-way audio, dropped calls, or registration failures.

• Apply Configuration Methods: Disable or enable SIP ALG globally using the PAN-OS Web UI or CLI, or configure Application Override policies for selective bypass in mixed-traffic environments.

Any NGFW

SIP ALG (Application Level Gateway) on Palo Alto Networks firewalls inspects Layer 7 SIP control traffic passing across NAT boundaries, translating embedded IP addresses inside SDP payloads and dynamically managing RTP media pinholes.

Core Functions of PAN-OS VoIP ALG

• Payload NAT: Replaces internal RFC 1918 private IPs inside SDP headers (Via, Contact, c=connection) with the firewall's egress public IP.

• Predictive Sessions (Pin-holing): Dynamically allocates temporary firewall pinholes for dynamic high UDP ports (RTP/RTCP) communicated during signaling exchanges, allowing inbound audio without wide static inbound rules.

• Policy Enforcement: Predict sessions manage state tracking, but firewall Security Policies must still explicitly permit the media application traffic (e.g., rtp).

Explanation using a Traffic Flow Diagram

1. Outbound SIP INVITE Initiation (Internal Network)

• Signaling Transport: The SIP client (192.168.1.10) initiates a call by sending a SIP INVITE targeted at UDP port 5060 toward the remote VoIP server (203.0.113.50).

• Layer 7 SDP Payload: Deep within the packet body, the Session Description Protocol (SDP) defines call parameters. The Connection line (c=) explicitly advertises IN IP4 192.168.1.10, while the Media line (m=) specifies the dynamic high UDP port allocated by the phone for receiving audio (e.g., audio 10000 RTP/AVP).

• Routing Headers: The Via and Contact headers embed 192.168.1.10:5060, instructing intermediate proxies and the remote party where to send return signaling and future direct messages.

2. App-ID Inspection & ALG Payload Translation (Palo Alto Networks Firewall)

• App-ID Classification: The ingress packet triggers policy evaluation, where PAN-OS classifies the control session as the sip application.

• Standard L3/L4 NAT: The firewall translates the Layer 3 source IP in the IP header from internal 192.168.1.10 to the egress interface's public NAT address (203.0.113.1).

• Layer 7 Payload Modification: The SIP ALG decoder parses the application payload. It locates internal RFC 1918 addresses within the c=, Via, and Contact headers, rewriting 192.168.1.10 to 203.0.113.1 (updating the media connection line to c=IN IP4 203.0.113.1).

• Egress Forwarding: The firewall recalculates packet checksums and forwards the modified SIP INVITE out the egress interface to the public VoIP server.

3. Predictive Session Allocation (Dynamic Pinhole Creation)

• SDP Parameter Extraction: As the signaling exchange progresses (including parsing the returning SIP 200 OK from the provider), the ALG decoder extracts negotiated RTP media ports for both call endpoints.

• Predict Session Entry: PAN-OS programmatically populates a temporary "predict session" (pinhole) into its state table. This entry pre-authorizes incoming high UDP port traffic originating from 203.0.113.50 directed toward 203.0.113.1.

• Security Boundary Control: The dynamic pinhole allows inbound media streams to pass without exposing the network through broad, permanently open inbound security rules on high UDP ranges.

4. Bidirectional RTP/RTCP Audio Stream Flow

• Pinhole Activation: When the initial RTP media packet arrives at the firewall, it matches the pre-allocated predict session and instantiates an active state table entry.

• Media NAT Translation: The firewall applies standard L3/L4 NAT to incoming audio packets, translating the destination address (203.0.113.1) back to the internal phone (192.168.1.10).

• Active Media Stream: Bi-directional RTP audio flows continuously between the internal client and remote server. Firewall Security Policies still perform standard policy lookups to ensure the underlying media application (e.g., rtp) is explicitly permitted.

Decision Matrix: Enable vs. Disable ALG

How to Disable SIP ALG

Option A: Disable Globally via Web UI

1. Navigate to Objects > Applications and search for sip.

2. Click the sip application to open the Application configuration modal.

3. In the Options section on the right, locate ALG and click Customize... to toggle to Disabled.

4. Click OK and Commit changes.

Option B: Selective Bypass via Application Override

To bypass ALG for specific trunk paths or subnets without disabling ALG globally:

1. Navigate to Policies > Application Override > Add.

2. Under Configuration, assign a custom name (e.g., Bypass-SIP-ALG).

3. Under Protocol/Port, specify UDP or TCP port 5060-5061.

4. Under Payload Override, select a custom application or set it to custom-sip