How to Disable SIP ALG

Printer Friendly Page

Overview

The ability to disable SIP ALG was introduced in PAN-OS 6.0.

SIP ALG performs NAT on the payload and opens dynamic pinholes for media ports. This may cause issues for some SIP implementations. This document describes how to disable SIP ALG.

Note: The option to disable SIP ALG is available on the Palo Alto Networks firewall and is a device-wide option. This feature is not supported on Panorama.

 

Steps

Inside of the WebGUI

Disabling this feature will prevent the firewall from translating the payload.

  1. Go to Objects > Applications and perform a search for the SIP application, as shown below:
    Screen Shot 2013-12-17 at 08.30.56.png

  2. Open the SIP application. The ALG setting can be seen in the Options section at the lower right area of the display.
  3. Click on Customize to bring up the settings dialog and check Disable ALG:
    Screen Shot 2013-11-15 at 13.19.40.png

 

On the CLI

Use the following command to disable the SIP ALG:

> configure
# set shared alg-override application sip alg-disabled yes|no

 

If issues still occur with SIP after disabling the ALG, testing can be performed setting up filters with packet captures and running the following CLI commands to gather additional information:

> debug dataplane packet-diag set:
log feature flow basic
log feature ctd basic

 

Note: Not all phone system implementations use the SIP application. In some cases, vendors like Cisco will use applications such as RTP and RTCP. In these cases, if the phones are experiencing issues it might be necessary to perform an application override for the specific phone traffic.

 

For more information seeHow to Create an Application Override

 

owner: rvanderveken

Tags (8)
Comments

I do not get this SIP ALG customization option on PA500 6.0.0 ?

Do you have superuser rights ? If you still are unable to change it using superuser rights, please open a ticket with TAC.

You can't set this in Panorama - it's done on the local devices themselves.

To the best of my knowledge, Polycom is the ONLY system to use SIP ALG because they refuse to embrace STUN, the industry standard. If you're having phones report as SIP peers with their private/internal IP address instead of their external/public address, (for example, on an Asterisk PBX, Reports>Asterisk Info>Peers), either STUN needs to be turned on in the phones and SIP ALG turned off in the firewall, or the opposite, depending on whether or not you have Polycom phones. You'll never have both enabled at the same time.

It solved my issue with PA200 running 7.1.2 and IP Phone from Bahnhof. The phone used is a Siemens Gigaset C530 IP. Thanks!

Is there a way to automate this to be applied on multiple firewalls at once? It cannot be done from Panorama.

Very usefull.

That correct some issue with my CISCO VCS Control.

It solved my issue, i am using Asterisk as Internal PBX and 3CX on cloud (done bridging)

However i am facing a completely different problem, during weekends, my bridge is getting disconnected.

I checked the logs and firewall settings too, nothing is pointing to any suspicious activity.

I just don't know the reason, every weekend it happens.

And to restore the bridge I have to change the public IP of my 3CX cloud server and everything gets back to normal.

 

Does anyone faced this kind of issue?

Looks like this helps Ring Doorbell issues.  See:  https://www.reddit.com/r/paloaltonetworks/comments/8qv8h0/palo_alto_sip_issues/