How to disable SIP inspection on Cisco ASA and Secure Firewall

Direct answer

On Cisco ASA, SIP ALG behaviour is provided by SIP inspection in a service policy; find the applied policy and class, remove only inspect sip, save and establish fresh sessions. Cisco Secure Firewall Threat Defense is managed differently, so use the matching FMC or Device Manager procedure rather than pasting ASA CLI.

Identify ASA or Threat Defense before changing policy

Cisco ASA and Cisco Secure Firewall Threat Defense do not share a universal management workflow. Confirm platform, software release, management plane, context/tenant, HA role and which service/access policy carries the traffic.

Back up configuration and ensure console or out-of-band rollback access.
Record the current policy map, class, service-policy attachment and live SIP sessions.
Check whether an upstream router, SBC or cloud firewall also rewrites SIP.
Schedule the change because fresh sessions can interrupt active calls.

Cisco ASA

SIP inspection is normally an inspect sip action inside a policy-map class applied by service-policy.

Secure Firewall Threat Defense

Use the version-supported FMC or Device Manager policy workflow. ASA CLI pasted onto FTD can be ineffective or unsupported.

Remove SIP inspection from the applied ASA policy

The example uses common default object names. Inspect the running configuration first and substitute the actual policy and class; do not create a second global policy accidentally.

1
Find the active policy and class
Use read-only show commands to identify where inspect sip is configured and where that policy is applied.
2
Remove only SIP inspection
Under the actual applied policy-map and class, issue no inspect sip. Leave DNS, FTP and other required inspection/actions untouched.
3
Verify before saving
Display the policy and service-policy counters, confirm the intended line is gone and that the policy remains attached correctly.
4
Save and create fresh sessions
Save the ASA configuration, then clear only filtered affected connections during the window or restart the endpoint registration.

ASA concept — verify names before changingcisco

show running-config policy-map
show running-config service-policy
show service-policy | include SIP|sip

configure terminal
 policy-map ACTUAL_APPLIED_POLICY
  class ACTUAL_INSPECTION_CLASS
   no inspect sip
 end

show running-config policy-map ACTUAL_APPLIED_POLICY
write memory

Use the actual object names

global_policy and inspection_default are common, not guaranteed. The example deliberately uses placeholders so it cannot silently modify an unrelated custom class.

Handle Secure Firewall Threat Defense through its manager

1
Identify the management method
Record whether the device is managed by Secure Firewall Management Center or Device Manager and the exact software release.
2
Locate SIP inspection configuration
Use the version’s Cisco configuration guide to find the inspection/policy or supported FlexConfig mechanism that currently enables SIP handling.
3
Change and deploy through policy
Remove only SIP application inspection, review the generated changes, deploy to the intended devices and monitor deployment status.
4
Do not treat diagnostic CLI as permanent configuration
Changes made outside the supported manager can be overwritten or leave configuration drift. Keep the source of truth in FMC/Device Manager.

Keep explicit firewall controls after inspection is off

Traffic	Control
Registered trunk/phone	Required outbound destination, transport and return state; no broad inbound exposure
Direct-IP trunk	Exact UKDDI source allowlists, signalling/media destinations and port ranges from activation
PBX management	Trusted admin networks only, strong authentication and current software
Unauthorised SIP	Deny and log appropriately; do not rely on inspect sip to authenticate a peer

Test Cisco policy and the complete call path

1
Create fresh SIP state
Restart the affected registration or clear only its filtered connections after confirming no active business call will be disrupted.
2
Check policy hits
Confirm the new traffic matches the intended access/NAT policy and no longer invokes SIP inspection.
3
Call in and out
Verify exact DDI routing, approved caller ID and expected SIP responses.
4
Check media and stability
Verify two-way audio, keypad tones, transfers and a call beyond five minutes; monitor denies and connection tables.

TECHNICAL FAQ

Questions to check before raising a fault

Remove passwords from screenshots, configuration exports and packet captures before sharing them.

What is the Cisco ASA command to disable SIP ALG?

Inside the actual applied policy-map class it is no inspect sip. First identify the real policy and class; do not assume the default names shown in examples.

Can I paste ASA commands into a Cisco FTD device?

No. Use the supported FMC or Device Manager method for the exact Threat Defense release so policy remains consistent and survives deployment.

Do I need to clear connections after the change?

Existing sessions may retain old inspection state. During a change window, restart the affected registration or clear only tightly filtered connections, not the entire firewall connection table.

OFFICIAL REFERENCES

Platform and standards documentation

Use the linked model and version documentation alongside this guide. Your UKDDI activation email takes priority for service-specific values.

Cisco ASA CLI reference — inspect commandsOfficial Cisco ASA command reference documenting inspect sip and no inspect sip.Cisco Secure Firewall documentationOfficial versioned management and configuration guides for Secure Firewall.

NEXT TECHNICAL STEP

Related UKDDI guides

All technical guides →

STILL NOT REGISTERED?

Send the symptoms, not the secret.

Tell UKDDI the affected number, time of a test call, call direction, SIP response code and public PBX IP. Never send the SIP password.

Contact technical support