Disabling SIP ALG on FortiGate Firewalls

← Network & Firewall

Disabling SIP ALG on FortiGate Firewalls

SIP ALG (Application Layer Gateway) attempts to assist with NAT traversal for SIP traffic but typically causes more problems than it solves. On FortiGate firewalls, SIP ALG interference can result in:

• One-way audio on calls
• Calls dropping after 30 seconds
• Registration failures or repeated re-registrations
• Audio delays or jitter

Disabling SIP ALG is strongly recommended for any FortiGate behind which VoIP devices register with SIPSTACK.

Caution

You must have administrative access to the FortiGate web interface or CLI to complete these steps. If you are unsure, contact your IT administrator before making changes.

Method 1: Web Interface (GUI)

Step 1: Log into the FortiGate Web Interface

1. Open a browser and navigate to the FortiGate management IP address.
2. Log in with your administrator credentials.

Step 2: Disable SIP ALG via Application Control

1. Navigate to Security Profiles → Application Control.
2. Open the Application Control profile applied to your LAN-to-WAN policy.
3. In the Application Overrides section, find SIP.
4. Set the SIP action to Block or Monitor (not Allow) — this prevents FortiGate from processing SIP packets through the ALG engine.

Note

The exact location of SIP ALG settings varies between FortiOS versions. On FortiOS 6.4+, SIP inspection is controlled through the VoIP profile rather than Application Control.

Step 3: Disable via VoIP Profile (FortiOS 6.4+)

1. Navigate to Security Profiles → VoIP.
2. Edit the profile assigned to your internet-facing policy.
3. Set SIP to disabled, or delete the VoIP profile from the policy entirely.

Method 2: CLI (Recommended — Reliable Across All FortiOS Versions)

SSH or console into the FortiGate and run:

config system settings
    set sip-helper disable
    set sip-nat-trace disable
end

config system session-helper
    show
end

The show output lists numbered session helpers. Find the entry for SIP (typically port 5060) and delete it:

config system session-helper
    delete 13
end

Replace 13 with the actual entry number shown for SIP in your output.

Reboot the FortiGate after making CLI changes:

execute reboot

Step 4: Verify and Test

1. After changes are applied, check that VoIP phones re-register successfully.
2. Make a test call — confirm two-way audio on both ends.
3. Monitor VoIP traffic for 10–15 minutes to confirm stability.

Tip

If calls still drop after disabling SIP ALG, check that the UDP session timeout is set to at least 600 seconds (Network → Interfaces → Edit → Advanced → Session TTL). Short UDP timeouts cause NAT bindings to expire mid-call.

Related Resources

• General Firewall Configuration for VoIP
• Enabling QoS on a FortiGate Firewall for VoIP
• Network Requirements — Nova PBX Docs
• Router Compatibility Guide