After implementing a new NGFW, a firewall engineer sees a VoIP traffic issue going through the firewall After troubleshooting the engineer finds that…

The behavior described—the firewall modifying the payload of voice packets for NAT and opening dynamic pinholes for media ports—is the explicit function of an Application Layer Gateway (ALG). For VoIP traffic, this is most commonly the SIP (Session Initiation Protocol) ALG. When a SIP ALG is incompatible with the specific VoIP system, it can corrupt SIP headers or SDP bodies, leading to issues like one-way audio or failed call setups. Disabling the SIP ALG is a standard troubleshooting step that prevents the firewall from modifying these packets, often resolving the issue.

A. Disable ALG under H.323 application: While H.323 is a VoIP protocol with an ALG, SIP is far more prevalent in modern networks. The described symptoms are classic for a problematic ALG, making SIP the most probable protocol.

B. Increase the TCP timeout under H.323 application: This addresses sessions dropping due to inactivity, not call setup or media path issues caused by packet modification, which is the problem described.

C. Increase the TCP timeout under SIP application: Similar to option B, adjusting timeouts does not resolve problems related to incorrect payload NAT or dynamic port handling by a malfunctioning ALG.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: In the section "Session Initiation Protocol (SIP)

" it states

"The firewall provides a Session Initiation Protocol (SIP) Application-level Gateway (ALG) that processes SIP signaling messages to permit SIP media traffic to securely traverse the firewall." It further notes

"In some cases

you might need to disable the SIP ALG." This confirms the ALG's function and that disabling it is a valid troubleshooting action. (Reference: PAN-OS Administrator's Guide 10.2

Features > App-ID > Application-Level Gateways > Session Initiation Protocol (SIP)).

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: The guide explains the function of ALGs: "An ALG understands the specific application protocol and can inspect and modify the application payload to... open dynamic pinholes for the application to enable it to traverse NAT." This directly matches the behavior observed in the question. (Reference: PAN-OS Administrator's Guide 10.2

Features > App-ID > Application-Level Gateways).

3. Palo Alto Networks Knowledge Base

"How to Troubleshoot VoIP Issues": This document frequently lists disabling the relevant ALG (most often SIP) as a primary step to isolate whether the firewall's packet inspection and modification are the cause of the problem. It differentiates this from timeout issues

which have different symptoms and solutions. (Reference: Palo Alto Networks Knowledge Base

Article ID 2680

"How to Troubleshoot VoIP Issues").