topic Re: Disabling ALGs other than SIP? in General Topics

Disabling ALGs other than SIP?

rvandegrift — Tue, 09 Dec 2014 19:09:55 GMT

Hello,

We're having a few issues with predict sessions begin created erroneously and unnecessarily. The SIP ALG can be disabled, but when I tried the same process for other applications (ftp, skype, rtmpe, etc), there was no ALG option. How can these ALGs be disabled?

Thanks,

Ross

Re: Disabling ALGs other than SIP?

dmaynard — Tue, 09 Dec 2014 19:19:16 GMT

Hello rvandergrift,

You would need to apply an application override.

How to Create an Application Override Policy

How to create an application override for FTP

Re: Disabling ALGs other than SIP?

rvandegrift — Tue, 16 Dec 2014 21:41:13 GMT

I'm not authorized to view the second link. Is there a public version?

It looks like creating an App override requires either specifies static ports & protocol, or writing signatures. Specific ports won't work, since apps like Skype dynamically choose them - hence why there's an ALG! But it also isn't practical for me to write signatures for all of the protocols that have an ALG implemented.

Ross

Re: Disabling ALGs other than SIP?

pulukas — Sat, 20 Dec 2014 13:33:21 GMT

With sip and other voice protocols that use the ALG there is always an initial communication port to setup the call that is known by the system. This is the port you use in your application override. Once you have a session recognized as an override none of the ALG will be applied to that session.