“SIP Application Layer Gateway (SIP ALG) promises to rewrite embedded IP addresses inside SIP headers automatically. In reality, it mangles Session Description Protocol (SDP) payloads and causes maddening one-way audio drops on enterprise firewalls.”

In May 2013, during my tenure as Assistant Manager at Net4 India, we rolled out a new enterprise Hosted VoIP SIP Trunking service for 50 corporate clients.

Our central datacenter perimeter was secured by Cisco ASA firewalls operating between the public internet and our internal DMZ SIP proxies.

Within 48 hours of launch, our NOC helpdesk was flooded with critical support tickets.

Every client reported the exact same maddening symptom:

An incoming call rang, the agent picked up the receiver, and the caller could hear the agent speaking perfectly—but the agent heard total silence from the caller.

One-way audio.

---

The Mechanics of a SIP Call

To understand why one-way audio occurs, you have to separate call signaling from media delivery:

1. Call Signaling (SIP): Uses UDP port 5060 to set up, ring, and teardown the call session.
2. Media Stream (RTP): Uses dynamic UDP ports (typically 10000–20000) to transmit actual digitized voice audio using Session Description Protocol (SDP) payloads.

When a call connects, the SIP INVITE message contains an SDP payload specifying the target IP address and dynamic UDP port where the receiving phone expects to listen for incoming RTP audio packets.

---

The Mess: The Mangled SDP Payload

The client’s security team had deployed the Cisco ASA firewalls with default factory settings.

By default, Cisco ASA enables SIP ALG (Application Layer Gateway) inspection under the global policy map:

# Cisco ASA Default Inspection Policy (The Hidden Culprit)
policy-map global_policy
 class inspection_default
  inspect sip # <-- SIP Application Layer Gateway ACTIVE

The firewall vendor added inspect sip with good intentions: to inspect deep packet payloads and automatically rewrite private IP addresses inside SIP packets to public NAT IPs.

In reality, SIP ALG is notorious for corrupting voice packets.

When an internal SIP phone sent an INVITE message containing its private SDP IP (192.168.10.50), the ASA’s SIP ALG engine attempted to rewrite the payload on the fly.

Because our DMZ used multi-homed NAT interfaces, the ALG engine got confused. Instead of replacing 192.168.10.50 with the valid public NAT IP, it modified the SDP payload to an invalid, unroutable address (0.0.0.0 or private loopback)!

# SIP SDP Payload Before ASA SIP ALG Rewrite (Clean):
c=IN IP4 192.168.10.50
m=audio 12450 RTP/AVP 0 8 101

# SIP SDP Payload After ASA SIP ALG Rewrite (Corrupted!):
c=IN IP4 0.0.0.0 # <-- Unroutable IP! Remote caller streams RTP audio to nowhere!
m=audio 12450 RTP/AVP 0 8 101

The remote caller’s PBX received the c=IN IP4 0.0.0.0 instruction and began streaming RTP audio packets into a black hole.

The call setup succeeded on UDP 5060 (the phones rang), but the audio stream died on UDP 12450. After 30 seconds of missing RTP keepalives, the call disconnected automatically.

A junior analyst tried fixing the issue by placing the internal VoIP server into a broad permit any any DMZ ACL.

It didn’t solve the problem—because ACL permits don’t stop the ALG engine from corrupting deep packet payloads, and it exposed our internal PBX to malicious SIP registration brute-force scanners!

---

The Solution: Disabling SIP ALG & Opening Explicit RTP Pinholes

We fixed the outage permanently by disabling SIP inspection entirely on the firewall and configuring explicit, static UDP pinholes for RTP media streams.

1. Disabling SIP ALG Globally

We modified the Cisco ASA policy map and turned off inspect sip:

# Disabling SIP Inspection on Cisco ASA
policy-map global_policy
 class inspection_default
  no inspect sip

2. Configuring Explicit RTP Media UDP Pinholes

Instead of allowing a buggy ALG engine to open dynamic ports unpredictably, we defined explicit, restricted UDP pinholes for the RTP media port range (UDP 10000-20000) pointing to our Session Border Controller (SBC).

# Permit Explicit RTP Media Stream UDP Pinholes to SBC
access-list DMZ_INBOUND permit udp any host 202.71.130.50 range 10000 20000

3. SBC Application-Layer NAT Traversal

We configured our Session Border Controller (SBC) to handle NAT traversal natively using STUN/TURN protocols, ensuring SDP payloads were rewritten cleanly at Layer 7 by a dedicated voice engine rather than a firewall security module.

---

The Impact

• 100% Audio Restoration: Permanently resolved one-way audio drops across all 50 corporate SIP trunking clients.
• Reduced Firewall Load: Dropped firewall CPU utilization by 14% by removing deep SIP packet inspection overhead.
• Clean Security Boundary: Maintained strict firewall ACL boundaries without resorting to dangerous permit any any rules.

Key Takeaway

Disable SIP ALG on Enterprise Firewalls.

Never rely on hardware firewall SIP Application Layer Gateways (inspect sip on ASA, SIP ALG on Fortinet/SonicWALL) for NAT traversal. Disabling SIP ALG and opening explicit RTP UDP port ranges (10000-20000) while letting a dedicated Session Border Controller (SBC) manage SDP rewrites is the only way to guarantee two-way audio integrity.

---

Architecture and decisions: mine. Debugging sessions at odd hours: mine. AI assistance: structure, syntax, first draft. — Sachin