SIP ALG (Application Layer Gateway) is a router feature that tries to help phone calls pass through NAT by rewriting the addresses inside SIP messages. On most modern setups it does the opposite: it rewrites the wrong fields, so audio is sent to the wrong place. The typical signs are one-way audio, no audio at all, calls that hang up after about 30 seconds, and desk phones or PBX trunks that register and then drop off. The fix is to turn SIP ALG off on the router (often under Security > ALG or NAT > ALG on Huawei and ZTE units), restart the router, and re-register your phones. If the router's ALG menu is locked, put it in bridge mode behind a router you control, or use a SIP port other than 5060.
A SIP call has two parts: signalling (the SIP messages that set the call up) and audio (RTP packets). The SIP messages carry the IP address and port where each side wants to receive audio. Behind a home or office router, those are private addresses such as 192.168.100.20, which the outside world cannot reach.
SIP ALG inspects SIP traffic on port 5060 and swaps the private addresses for the router's public one. The idea is sound. In practice:
Many ALGs only rewrite some headers, so the call ends up with a mix of public and private addresses.
Phones, apps and PBXs already handle NAT themselves (with STUN, rport and keep-alives). When the router rewrites what they already fixed, the addresses are wrong twice.
Some ALGs change the source port, which breaks registration on providers that expect replies on the same port.
A veteran on the 3CX community forum summed up years of one-way-audio threads: in almost every case "it is not the 3cx but the consumer router" (3CX community).
Menus vary by model and firmware, and your internet provider may have set its own admin password. Before you start, note the router's address (often 192.168.100.1, 192.168.1.1 or 192.168.8.1) and the admin login printed on the label or supplied by your provider.
Many Kenyan fibre installs use Huawei EchoLife ONTs. On most Huawei firmware:
Log in at the router's address.
Open Security (on some firmware, Forward Rules or Network Application).
Find ALG or Application Layer Gateway and untick SIP ALG.
Click Apply and restart the router.
On some provider-locked firmware the ALG page is hidden from the normal user account. Ask your provider to turn SIP ALG off, or ask for the unit to be put in bridge mode so your own router handles NAT.
Look for SIP ALG, SIP Helper, SIP Passthrough, VoIP ALG or SIP Transformations (Fortinet calls it the session helper; Cisco ASA calls it inspect sip). Turn it off, save and restart.
Restart the router so it clears its existing NAT table.
Reboot desk phones and restart softphone apps so they register fresh.
Place a test call from a mobile to your number, and from your number to a mobile, and talk for at least a minute to rule out the 30-second drop.
If the problem is still there, check the next layer:
Port forwarding for an on-site PBX. 3CX on a local server needs UDP 5060 (SIP), 5090 (3CX tunnel for remote apps) and UDP 9000-10999 (audio) forwarded to it, without the router changing the port numbers (3CX firewall docs).
The public IP. If your fibre line's public IP changed since the PBX was installed, the PBX may still advertise the old one.
Codecs. Put G.711 (PCMU, PCMA) first on both ends.
Some provider routers lock the ALG setting. Three options, from simplest:
Use a SIP port other than 5060. Most ALGs only inspect port 5060. Sautikit's SIP service listens on port 5080, so phones and PBXs registering to sip.sautikit.com:5080 are usually not touched by an ALG that only watches 5060.
Bridge mode. Ask your provider to bridge the ONT and put your own router behind it, with SIP ALG off.
Skip the office PBX. A cloud phone system has no PBX in the office to port-forward. Sautikit's phone apps for iPhone, Android and desktop register straight to the cloud, and calls to your Kenyan number ring them wherever staff are.
The far end never received the ACK that confirms the call, so it gives up after about 30 seconds. A router rewriting SIP messages (SIP ALG) or a NAT problem is the usual cause.
On most Huawei firmware it is under Security, then ALG. Some provider firmware hides it; in that case ask your internet provider to turn it off or to put the router in bridge mode.