“SIP ALG promises to rewrite embedded IP addresses inside SIP headers automatically. In reality, it corrupts RTP packet payloads and causes silent one-way audio drops.”

During VoIP SIP trunking deployment for enterprise hosted PBX clients at Net4 India, customers complained that incoming calls connected successfully, but callers could hear audio in only one direction.

Architecture: Disabling SIP Inspection & Configuring Explicit Pinholes

Packet capture analysis on Cisco ASA firewalls revealed that the default inspect sip engine (SIP ALG) was rewriting internal SDP (Session Description Protocol) IP addresses incorrectly.

We fixed the issue by disabling SIP inspection globally and configuring explicit UDP port ranges (10000-20000) for RTP media stream pinholes.

[!CAUTION] Always disable SIP inspection (no inspect sip) on Cisco ASA, Fortinet, and Juniper firewalls when deploying enterprise SIP trunks with NAT.

# # Cisco ASA Configuration: Disabling SIP ALG Inspection
policy-map global_policy
 class inspection_default
  no inspect sip

# # Configuring Explicit RTP Media Stream UDP Pinholes
access-list DMZ_INBOUND permit udp any host 192.168.10.50 range 10000 20000

The Verdict

Key Takeaway

Disable SIP ALG on Enterprise Firewalls for Clean Session Description Parsing.

Disabling SIP ALG inspection and defining explicit RTP UDP pinholes resolves one-way audio and call setup drops on enterprise firewall boundaries.