How to switch off SIP ALG on a BT Business Hub

Identify the exact BT Hub first

BT Business Hubs and consumer Home/Smart Hubs do not expose the same controls. The steps below come from BT Business guidance. If the page or switch is absent, do not assume hidden consumer-hub commands exist.

• Read the exact model and firmware from the hub status page or label.
• Back up or record broadband, DHCP, port-forward and firewall settings before the change.
• Confirm whether the BT Hub is the edge router or sits in front of another firewall, creating double NAT.
• Make the change from a wired or trusted local connection, not remote WAN management.

Disable SIP ALG on the supported Business Hub

1. 1
   Open the hub

   Browse to http://192.168.1.254 or http://businesshub.home from the trusted LAN.

2. 2
   Open Advanced Settings

   Select Advanced Settings and enter the hub administrator password when prompted. This is not the Wi-Fi password unless the device label or administrator changed it that way.

3. 3
   Open Firewall configuration

   Select Firewall, then Configuration, and scroll to the Application Layer Gateway section.

4. 4
   Select the documented option

   Set Yes next to Disable SIP ALG. This wording is intentionally inverted: Yes means the ALG is switched off.

5. 5
   Apply the setting

   Select Apply and wait for the hub to confirm. Restart the affected SIP registration or endpoint if needed so it creates fresh state.

Keep the BT Hub firewall secure

Do not switch off the firewall, enable DMZ for a telephone system or create an unrestricted SIP port forward. Disabling SIP ALG stops application-layer rewriting; it does not remove the need for normal firewall and PBX protections.

• Remove test port forwards that are not required by the final supported design.
• For direct IP, restrict signalling and media to the account-specific UKDDI allowlists.
• For registered phones and trunks, prefer outbound state and the application’s supported keepalive/registration interval.
• Use a separate voice VLAN where the network design supports it and keep hub/phone management private.

Prove the change fixed the original symptom

1. 1
   Watch registration

   Confirm the trunk or phone remains registered through at least two refresh cycles.

2. 2
   Test inbound and outbound

   Use external numbers you control and confirm routing and approved caller ID.

3. 3
   Test media and duration

   Check two-way audio, keypad tones, hold and a call longer than five minutes.

4. 4
   Check double NAT if faults remain

   If another router is downstream or an upstream service also performs NAT/ALG, document both layers before making further changes.