SIP ALG Explained: Why It Breaks VoIP Calls and How to Fix It (UK 2026)

By Andy Pickett · Managing Director

Published 17 April 2026 · About the author

What is SIP ALG, in plain English?

SIP ALG stands for Session Initiation Protocol Application Layer Gateway. It’s a router feature that:

1. Watches outgoing VoIP packets,
2. Looks at the IP addresses inside the SIP messages,
3. Rewrites them so they appear to come from your public IP rather than your private LAN IP,
4. And opens the necessary ports for the return audio.

The intention is good — help VoIP traffic survive NAT (Network Address Translation). The reality is that it was designed in the early 2000s for a SIP world that no longer exists, it’s poorly implemented in most consumer-grade routers, and modern VoIP providers handle NAT traversal far better themselves.

SIP PhoneHosted PBXPSTN / SIP Trunk

When SIP ALG mangles a packet, the audio path between phone and PBX is broken — even though signalling looks fine.

The symptoms — does this sound like your office?

• VoIP phones lose registration every 60 seconds and re-register, then drop again.
• You can dial out but nobody can call in — phones don’t ring on inbound calls.
• One-way audio — you can hear them, they can’t hear you, or vice versa.
• Calls drop after 30 seconds — exactly when SIP “session refresh” times out.
• Transferring calls fails — when you press transfer, the call disconnects entirely.
• DTMF tones (press 1 for sales) don’t reach the IVR — your menu choices are ignored.
• Inbound CLI shows wrong number — caller ID is mangled.
• “Connection lost” errors in your softphone every few minutes.

If you tick three or more of those, SIP ALG is almost certainly the culprit.

How to disable SIP ALG — by router brand

BT Smart Hub 2 (most BT Business Broadband customers)

1. Browse to http://192.168.1.254/ and log in (default password is on the back of the hub).
2. Go to Advanced Settings → Firewall → SIP ALG.
3. Uncheck “Enable SIP ALG”, click Save.
4. Reboot the hub from the same admin page.

Draytek Vigor (2762, 2865, 2927)

1. Log in to the Vigor’s web UI (default 192.168.1.1).
2. Go to NAT → ALG.
3. Untick “Enable SIP ALG”, click OK.
4. Reboot from System Maintenance → Reboot System.

Cisco Meraki MX (any model)

1. In the Meraki dashboard, open Security & SD-WAN → Firewall.
2. Scroll to SIP ALG, set to Disabled.
3. Click Save — it takes effect within seconds, no reboot required.

FortiGate (60F, 100F, etc.)

1. SSH or use the GUI to access the FortiGate.
2. Run config system settings then set sip-helper disable and set sip-nat-trace disable.
3. Run config system session-helper, find the SIP entry (show), and delete [number].
4. Save with end. Reboot recommended.

Ubiquiti UniFi / EdgeRouter

1. SSH into the EdgeRouter / UniFi gateway.
2. Run configure then delete system conntrack modules sip.
3. Commit and save: commit then save then exit.

MikroTik RouterOS

1. In WinBox or the web UI, go to IP → Firewall → Service Ports.
2. Find sip, double-click, untick Enabled, click Apply.

Netgear (Nighthawk, Orbi)

1. Log in at http://routerlogin.net.
2. Go to Advanced → Setup → WAN Setup.
3. Scroll to “Disable SIP ALG” and tick the checkbox.
4. Apply — reboot if prompted.

Sky Q hub / Sky Broadband router

Sky disables SIP ALG by default on modern hubs. If you’re on an older hub, the only fix is to replace it with a third-party router (Draytek 2865 is the go-to for UK SMBs).

How to verify SIP ALG is really off

Why VoIP providers don’t need SIP ALG anymore

SIP ALG was designed for an era when every SIP endpoint had to manage its own NAT traversal. In 2026, modern hosted VoIP services use:

• STUN — endpoints discover their public IP themselves, so the SIP messages already contain the right addresses.
• ICE — endpoints negotiate the best media path automatically (works through almost any NAT).
• Symmetric RTP — providers send audio to whichever IP/port the audio came from, NAT just-works.
• Far-end NAT detection — the SBC at the carrier figures out NAT without help from your router.

Result: SIP ALG is at best redundant, at worst actively destructive. Every major UK VoIP provider (hypercloud, RingCentral, 8×8, Vonage Business, Microsoft Teams Phone direct routing) explicitly recommends turning it off.

Written by

Andy Pickett

CTO and AI Champion

Andrew is a Chief Technology Officer with over 15 years’ experience in IT and telecommunications, leading the design and delivery of robust, scalable technology solutions.

IT StrategyCloudCybersecurityAIDigital Transformation

View Full Profile