What Is SIP ALG and Why Does It Break VoIP?

SIP ALG (Application Layer Gateway) is a feature built into many firewalls, including FortiGate, that attempts to inspect and modify SIP (Session Initiation Protocol) packets as they pass through NAT. The idea sounds helpful — SIP carries internal IP addresses inside the packet payload, and NAT normally only rewrites the outer IP header, leaving those internal addresses exposed and unroutable.

In practice, SIP ALG on FortiGate is notoriously unreliable. It modifies SIP headers incorrectly, rewrites SDP (Session Description Protocol) bodies that contain media negotiation, and often corrupts the very packets it's supposed to fix. Modern VoIP platforms — 3CX, Microsoft Teams Phone (Direct Routing), Zoom Phone, and hosted PBX providers — all handle NAT traversal themselves using STUN, ICE, and TURN. When FortiGate's SIP ALG interferes, it breaks this process.

⚠️

Common symptoms of SIP ALG interference: one-way audio (you can hear caller but they can't hear you, or vice versa), calls dropping after exactly 30 or 60 seconds, phones failing to register or re-register randomly, incoming calls going straight to voicemail, and DTMF tones not working correctly.

Disabling SIP ALG via FortiGate CLI

The CLI method is the most reliable way to disable SIP ALG on FortiGate. There are two components to disable: the SIP helper (a session helper built into the kernel) and the SIP application layer gateway in system settings. You need to disable both.

Step 1 — Disable the SIP helper and SIP NAT trace in system settings:

config system settings
    set sip-helper disable
    set sip-nat-trace disable
end

Step 2 — Disable the SIP session helper:

FortiGate has a built-in session helper for SIP running on UDP port 5060. You need to find its index number and delete it. First, list all session helpers:

config system session-helper
    show

Look through the output for the entry with name sip and port 5060. It will look similar to this:

edit 13
    set name sip
    set protocol 17
    set port 5060
next

Note the edit number (13 in this example — it may differ on your unit). Delete it:

config system session-helper
    delete 13
end

ℹ️

The session helper index number varies between FortiGate models and firmware versions. Always check with show first before deleting. If you accidentally delete the wrong entry, you can re-add it.

Step 3 — Disable SIP in VoIP profile (FortiOS 6.x and later):

On FortiOS 6.0 and above, there is also a VoIP profile applied to firewall policies. Check whether any VoIP profile is active:

show voip profile

If a default profile exists, edit it to disable SIP inspection:

config voip profile
    edit default
        config sip
            set status disable
        end
    next
end

Disabling SIP ALG via the FortiGate GUI

If you prefer the web interface, follow these steps. Note that the GUI does not expose all SIP ALG settings — you will still need the CLI to remove the session helper.

Log in to your FortiGate web GUI (typically https://192.168.1.1 or your management IP).
Go to Network > Interfaces — this is not where you disable SIP ALG, just confirming you're logged in correctly.
Navigate to Security Profiles > VoIP.
If a VoIP profile exists (commonly named default), click to edit it.
Under the SIP tab, change Status to Disable.
Click OK to save.
Go to Policy & Objects > Firewall Policy and confirm your internet-bound policies are not referencing a VoIP profile. If they are, edit each policy and set the VoIP profile to None.

⚠️

The GUI alone is not sufficient. You must also run the CLI commands to disable sip-helper and remove the session helper. The GUI does not expose these options on most FortiOS versions.

Verifying the Change

After making changes, verify that SIP ALG is disabled using the following commands:

Check system settings:

get system settings | grep sip

You should see output similar to:

sip-helper                : disable
sip-nat-trace             : disable
sip-expectation           : disable

Confirm the session helper is gone:

config system session-helper
    show

There should be no entry with name sip and port 5060 in the output.

Check active SIP sessions:

diagnose sys session filter proto 17
diagnose sys session filter dport 5060
diagnose sys session list

SIP sessions should now pass through as normal UDP sessions without ALG intervention.

Platform-Specific Notes

VoIP Platform	SIP ALG Impact	Additional FortiGate Steps
3CX	One-way audio, registration failures, random disconnects	Disable SIP ALG, allow UDP 5060 and RTP range (default 9000–9499)
Microsoft Teams Phone	Call setup failures, media issues	Disable SIP ALG, allow UDP/TCP to Microsoft SIP addresses, QoS tagging recommended
Zoom Phone	Choppy audio, dropped calls	Disable SIP ALG, allow UDP 8801–8802 for media
Hosted PBX (generic)	Varies — registration drops, no inbound audio	Disable SIP ALG, confirm RTP ports are open to provider IP ranges

After Disabling SIP ALG

Once SIP ALG is disabled, your VoIP platform's own NAT traversal mechanism takes over. For most hosted systems this is STUN. For 3CX, ensure your 3CX server's external IP and FQDN are correctly configured in the 3CX management console. For Microsoft Teams Direct Routing, your Session Border Controller (SBC) handles all NAT requirements.

You may need to reboot affected phones or restart your PBX service for changes to take effect. On FortiGate, the change applies immediately without a reboot, but existing SIP sessions may need to be re-established.

Need Help?

Melbits provides managed IT support for Melbourne businesses, including FortiGate firewall configuration and VoIP troubleshooting. If your phones are still dropping calls after disabling SIP ALG, there may be additional firewall policy or NAT configuration issues we can diagnose remotely. Call us on 1800 635 248 or contact us online.

Disabling SIP ALG on a FortiGate Firewall