--- title: What Is SIP ALG and How to Turn It Off (Huawei and ZTE Fibre Routers) description: >- SIP ALG causes one-way audio, calls that drop after 30 seconds and phones that won't register. What it does and how to turn it off on common routers. summary: >- SIP ALG is a router feature that rewrites call signalling and breaks VoIP: one-way audio, 30-second drops, failed registration. Here is how to find it and switch it off. date: 2026-11-05T00:00:00.000Z type: blog --- ## Summary SIP ALG (Application Layer Gateway) is a router feature that tries to help phone calls pass through NAT by rewriting the addresses inside SIP messages. On most modern setups it does the opposite: it rewrites the wrong fields, so audio is sent to the wrong place. The typical signs are one-way audio, no audio at all, calls that hang up after about 30 seconds, and desk phones or PBX trunks that register and then drop off. The fix is to turn SIP ALG off on the router (often under **Security > ALG** or **NAT > ALG** on Huawei and ZTE units), restart the router, and re-register your phones. If the router's ALG menu is locked, put it in bridge mode behind a router you control, or use a SIP port other than 5060. ## What SIP ALG does A SIP call has two parts: signalling (the SIP messages that set the call up) and audio (RTP packets). The SIP messages carry the IP address and port where each side wants to receive audio. Behind a home or office router, those are private addresses such as `192.168.100.20`, which the outside world cannot reach. SIP ALG inspects SIP traffic on port 5060 and swaps the private addresses for the router's public one. The idea is sound. In practice: - Many ALGs only rewrite some headers, so the call ends up with a mix of public and private addresses. - Phones, apps and PBXs already handle NAT themselves (with STUN, `rport` and keep-alives). When the router rewrites what they already fixed, the addresses are wrong twice. - Some ALGs change the source port, which breaks registration on providers that expect replies on the same port. A veteran on the 3CX community forum summed up years of one-way-audio threads: in almost every case "it is not the 3cx but the consumer router" ([3CX community](https://www.3cx.com/community/threads/public-ip-problem.4274/)). ## Signs SIP ALG is on | Symptom | Why it happens | |---|---| | You hear the caller but they cannot hear you (or the reverse) | The audio address in the SIP message was rewritten wrongly | | Calls connect, then hang up after about 30 seconds | The ACK that confirms the call never reaches the far end | | Phone or trunk shows registered, then unregistered every few minutes | The router changed the port and the provider's replies go nowhere | | Calls drop after about 15 minutes | The mid-call refresh (re-INVITE) is mangled or blocked | | 3CX Firewall Checker reports "SIP ALG detected" | The checker sees its test messages rewritten | ## How to turn off SIP ALG Menus vary by model and firmware, and your internet provider may have set its own admin password. Before you start, note the router's address (often `192.168.100.1`, `192.168.1.1` or `192.168.8.1`) and the admin login printed on the label or supplied by your provider. ### Huawei fibre ONTs (EchoLife HG8145V5 and similar) Many Kenyan fibre installs use Huawei EchoLife ONTs. On most Huawei firmware: 1. Log in at the router's address. 2. Open **Security** (on some firmware, **Forward Rules** or **Network Application**). 3. Find **ALG** or **Application Layer Gateway** and untick **SIP ALG**. 4. Click **Apply** and restart the router. On some provider-locked firmware the ALG page is hidden from the normal user account. Ask your provider to turn SIP ALG off, or ask for the unit to be put in bridge mode so your own router handles NAT. ### ZTE fibre routers (F670L and similar) 1. Log in at the router's address. 2. Open **Internet > Security** or **Application > ALG** (the wording varies by firmware). 3. Untick **SIP ALG** and apply. 4. Restart the router. ### MikroTik Run this from the terminal, then reboot or re-register your phones: ```bash /ip firewall service-port disable sip ``` On the 3CX forum, MikroTik users report the 3CX Firewall Checker keeps failing until the SIP service port is disabled. ### Other routers Look for **SIP ALG**, **SIP Helper**, **SIP Passthrough**, **VoIP ALG** or **SIP Transformations** (Fortinet calls it the session helper; Cisco ASA calls it `inspect sip`). Turn it off, save and restart. ## After you turn it off 1. Restart the router so it clears its existing NAT table. 2. Reboot desk phones and restart softphone apps so they register fresh. 3. Place a test call from a mobile to your number, and from your number to a mobile, and talk for at least a minute to rule out the 30-second drop. If the problem is still there, check the next layer: - **Port forwarding for an on-site PBX.** 3CX on a local server needs UDP 5060 (SIP), 5090 (3CX tunnel for remote apps) and UDP 9000-10999 (audio) forwarded to it, without the router changing the port numbers ([3CX firewall docs](https://www.3cx.com/docs/manual/firewall-router-configuration/)). - **The public IP.** If your fibre line's public IP changed since the PBX was installed, the PBX may still advertise the old one. - **Codecs.** Put G.711 (PCMU, PCMA) first on both ends. ## When you can't change the router Some provider routers lock the ALG setting. Three options, from simplest: 1. **Use a SIP port other than 5060.** Most ALGs only inspect port 5060. Sautikit's SIP service listens on port **5080**, so phones and PBXs registering to `sip.sautikit.com:5080` are usually not touched by an ALG that only watches 5060. 2. **Bridge mode.** Ask your provider to bridge the ONT and put your own router behind it, with SIP ALG off. 3. **Skip the office PBX.** A cloud phone system has no PBX in the office to port-forward. Sautikit's phone apps for iPhone, Android and desktop register straight to the cloud, and calls to your Kenyan number ring them wherever staff are. ## FAQ ### Should SIP ALG be on or off? Off, for almost every modern setup. Phones, apps, PBXs and SIP providers handle NAT themselves, and SIP ALG's rewriting usually breaks it. ### Does SIP ALG cause one-way audio? Yes, it is the most common cause. It rewrites the address where audio should be sent, so one side's audio goes to the wrong place. ### Why do my VoIP calls drop after 30 seconds? The far end never received the ACK that confirms the call, so it gives up after about 30 seconds. A router rewriting SIP messages (SIP ALG) or a NAT problem is the usual cause. ### Where is SIP ALG on a Huawei router? On most Huawei firmware it is under Security, then ALG. Some provider firmware hides it; in that case ask your internet provider to turn it off or to put the router in bridge mode. ### Which port does Sautikit use for SIP? UDP 5080 at `sip.sautikit.com`. Because it is not 5060, routers whose ALG only watches port 5060 usually leave it alone.