topic Re: Disable SIP ALG on ASR 4431 in Switching

Disable SIP ALG on ASR 4431

WonderfulIT — Fri, 08 Mar 2019 23:03:05 GMT

Hi all,

I'm not that knowledgable with VOIP so bear with me......we have a conference phone and it keeps showing as registered on the VOIP companies site (a 3rd party) and then during the call it then drops and shows as not registered and no calls can be made.

They have asked me to disable SIP ALG on the router which i did by:

enable
configure terminal
no ip nat service sip udp port 5060

But then the phone doesn't work and shows as unregistered.

Am i doing this wrong or is this not the correct way to disable SIP ALG on a Cisco ?

Thanks in advance

Re: Disable SIP ALG on ASR 4431

Leo Laohoo — Thu, 17 May 2018 10:50:17 GMT

no ip nat service sip tcp port 5060
no ip nat service sip udp port 5060

Re: Disable SIP ALG on ASR 4431

WonderfulIT — Thu, 17 May 2018 11:03:22 GMT

So i've done it right then (i did both UDP and TCP) ? Would this block port 5060 completely by any chance?

Re: Disable SIP ALG on ASR 4431

Leo Laohoo — Thu, 17 May 2018 11:18:58 GMT

Yes.

Re: Disable SIP ALG on ASR 4431

WonderfulIT — Thu, 17 May 2018 11:20:43 GMT

Great, thanks

Re: Disable SIP ALG on ASR 4431

WonderfulIT — Thu, 17 May 2018 11:21:46 GMT

Sorry, just realised. Are you saying YES to me doing it right or YES to it would block port 5060 altogether?

Thanks

Re: Disable SIP ALG on ASR 4431

Leo Laohoo — Thu, 17 May 2018 11:44:55 GMT

The commands I've posted will block TCP & UDP ports 5060.

Re: Disable SIP ALG on ASR 4431

WonderfulIT — Thu, 17 May 2018 13:27:22 GMT

Right so as i'm not great at VOIP etc then i thought that SIG ALP was just a sort of inspection on SIP packets that sometimes modifies it and therefore causes issues so i was under the impression that this would disable the "ALG" inspection of the SIP packet but still let the packet through ?

Is there any way of disabling the ALG side but still let the SIP packet through or am i completely misunderstanding this ?

Thanks

Re: Disable SIP ALG on ASR 4431

Leo Laohoo — Thu, 17 May 2018 20:13:00 GMT

@WonderfulIT wrote:

or am i completely misunderstanding this ?

You're over-thinking this.

When applied, the two lines disables SIP ALG. Period.

Factory default the AP and observe what it's doing.

Re: Disable SIP ALG on ASR 4431

wilson419 — Fri, 18 May 2018 07:33:11 GMT

I think i am then....so if you disable SIP ALG then how does a device communicate on port 5060 ? From what you're saying these commands BLOCK that port completely ?

Re: Disable SIP ALG on ASR 4431

Leo Laohoo — Fri, 18 May 2018 08:23:50 GMT

@wilson419 wrote:

if you disable SIP ALG then how does a device communicate on port 5060

It won't. TCP and UDP 5060 are blocked so nothing should be talking to that port. NOTHING.

Re: Disable SIP ALG on ASR 4431

wilson419 — Fri, 18 May 2018 08:52:29 GMT

Right, that's clear now then so the part i obviously don't understand is that when comms companies ask us to disable SIP ALG on a line (which seems to becoming a common request) then if the device on the end of that communicates on port 5060 then this will just block the whole device ?

On some of the Drayteks we use there's an option to disable SIP ALG and this seems to disable it but still allow that device to work on port 5060 so is there anything else i would need to do on a Cisco such as adding a new NAT rule or something or is it a case of if you disable SIP ALG then there's no chance of getting anything to work on port 5060 ?