topic Re: Disable SIP ALG in General Topics

Disable SIP ALG

sunilsadanandan — Fri, 22 Jul 2011 13:02:21 GMT

Hi,

Is there any way of disabling the PAN SIP (Session Initiation Protocol) application ? My Voip provider has asked to turn SIP ALG off as they think its interfereing with the headers.

https://live.paloaltonetworks.com/docs/DOC-1216 This article says the PAN SIP app acts as a Application Layer Gateway.

Regards,

Sunil

Re: Disable SIP ALG

sunilsadanandan — Fri, 22 Jul 2011 13:11:10 GMT

Hi,

Would increasing the time outs on the SIP protocol help , like stated in the article referenced in the previous post ? How do I know that is the defualt values ? When I cliked on customise , it just gave me the range of values I could provide , and not what the defualt value is.

What I would really like is to disable the Application Layer Gateway feature itself as the VOIP provider uses stun servers.

Regards,

Sunil

Re: Disable SIP ALG

James — Fri, 22 Jul 2011 13:24:25 GMT

Hi Sunil,

The ALG element is for NAT - are you running NAT on the SIP?

Thanks

James

Re: Disable SIP ALG

sunilsadanandan — Fri, 22 Jul 2011 13:38:09 GMT

Hi James,

We are running the voip phones behind a NAT , so they have to get translated to reach the Internet. But the Voip provider says that SIP ALG interferes with their implementation as they use STUN servers to work around NAT , so the funtionality of a SIPALG is not needed.

And since Palo's SIP decoder acts like a ALG it seems to be curropting the packets send from the phones.

Regards,

Sunil

Re: Disable SIP ALG

James — Fri, 22 Jul 2011 14:20:11 GMT

Hi Sunil,

I cannot see a way to disable the ALG - I'll ask around.

Another alternative is to use an application override

Thanks

James

Re: Disable SIP ALG

mrajdev — Fri, 22 Jul 2011 14:24:08 GMT

Sunil,

App override is the way to turn off SIP alg. You will have to open up ports for return traffic as there will be no pin holes opened for the media session of the SIP call (this is one of the functionality of the ALG).

Hope this helps.

Re: Disable SIP ALG

sunilsadanandan — Mon, 25 Jul 2011 14:01:19 GMT

Hi James/Rajdev,

Thanks, I am using the App override feature to work around this. Are there any other application decoder that perform additional functions other than APP Identification ?

Could I submit a feature request to have option to disable any additonal features, so that I am certain that APP ID is not "modifying" the communication logic used in the network without me specifically asking it to ?

e.g.

Device > AppID > features

1. SIP ALG > enable/disable

2. .............

Regards,

Sunil