What is an Application Layer Gateway (ALG)?

Application Layer Gateway (ALG), also called an Application Level Gateway, is a security component that inspects protocols embedding connection addresses inside their own payload – FTP, SIP, PPTP, TFTP, and IKE ESP – and dynamically opens temporary firewall pinholes so those protocols keep working across NAT and firewall boundaries.

Key takeaways

• ALG inspects protocols that embed addresses inside their own payload.
• It opens temporary firewall pinholes instead of static port forwards.
• FTP, SIP, PPTP, TFTP, and IKE ESP are the protocols it covers.
• IKE ESP ALG is disabled by default starting in VOS Release 22.1.4.
• Versa configures ALG policies in both Concerto and Director.

On this page: Why it matters · How it works · Types · ALG & Versa · FAQ

Why is ALG important?

Ordinary NAT and stateful firewalls only rewrite packet headers – the addresses and ports in the IP and TCP/UDP layers. Some protocols break that assumption: FTP negotiates a second data connection by writing an address and port into its control session’s payload, and SIP does the same to set up a voice or video stream. A firewall or CGNAT device that only inspects headers never sees those embedded values, so it cannot tell which incoming connection to allow, and the session stalls.

ALG closes that gap without punching static holes in the firewall or disabling NAT altogether. It reads into the payload to find the embedded address, rewrites it to match the translated address on the other side, and opens a temporary pinhole scoped to that one connection – keeping FTP transfers, SIP calls, and VPN tunnels working through NAT while the firewall stays closed to everything else.

What is ALG?

ALG solves the embedded-address problem one of two ways: either the application identifies an address–port combination the firewall should allow inbound, or ALG monitors the control traffic and dynamically opens the matching port mapping. VOS devices use the second approach.

Take FTP in active mode as the canonical example. FTP uses two sessions: a control session on port 21 that lists directories and issues commands, and a separate data session that moves the file. A client behind NAT sends the server an internal address in the control payload – one the server cannot route to, and one the firewall was never told to expect a connection on. ALG listens on port 21, watches for the packet that initiates the data session, rewrites the embedded address to the external NAT address, and creates a temporary firewall rule admitting the connection. Once the data session ends, the pinhole closes.

Types of ALG

ALG is implemented per protocol, since each embeds connection information differently. FTP ALG rewrites the address in the control session so the server’s data connection reaches the client despite NAT. SIP ALG parses SDP fields in SIP signaling to open the media (RTP) ports a call uses. PPTP ALG tracks the GRE tunnel a Point-to-Point Tunneling Protocol VPN establishes alongside its TCP control channel. TFTP ALG handles Trivial FTP’s connectionless transfers, invisible to a header-only firewall. IKE ESP ALG covers IPsec negotiation that switches from IKE’s UDP channel to ESP for the encrypted tunnel.

ALG & Versa

On Versa VOS devices, ALG ships enabled by default for FTP, PPTP, SIP, and TFTP; IKE ESP was also enabled until VOS Release 22.1.4 (Service Release 2025-09-23), after which it defaults to disabled and needs a vsm-configs edit in /opt/versa/etc/vsboot.conf plus a service restart to turn back on.

In Concerto, administrators build an ALG policy from the SD-WAN main template workflow, or separately under Servers & Settings > Application Layer Gateway Policies – see Configure Application Layer Gateway for current releases and Configure Application Layer Gateway (ALG) for Releases 12.1.1 through 12.2.2. In Director, the equivalent lives under an organization’s Others > ALG menu – see Configure ALG. Either way, the configuration associates with a device’s master profile.

Frequently asked questions

What is the difference between ALG and NAT?

NAT translates the IP addresses and ports in a packet’s header. ALG goes further, inspecting the payload of protocols that embed their own address and port information, and opening the temporary firewall pinholes NAT alone cannot create for that embedded data.

Which protocols does ALG support on Versa VOS devices?

FTP, SIP, PPTP, TFTP, and IKE ESP. Each is implemented as its own ALG instance, so administrators can enable or disable them individually and layer in user-defined services per protocol, rather than turning application-layer inspection on or off for the whole device at once.

Why is IKE ESP ALG disabled by default now?

Starting in VOS Release 22.1.4 (Service Release dated 2025-09-23), IKE ESP ALG ships disabled and cannot be re-enabled through the UI. Re-enabling it requires editing the vsm-configs stanza in /opt/versa/etc/vsboot.conf to set enable_ike_alg=true, then restarting services with the vsh restart CLI command.

Does ALG work with firewalls, NAT, or both?

Both. ALG specifically enhances firewall and carrier-grade NAT (CGNAT) operations together – it is the mechanism that lets protocols requiring dynamically negotiated connections keep working when a device sits behind both a NAT boundary and a stateful firewall at once.

How is an ALG policy configured on a Versa device?

In Concerto, it’s built through the SD-WAN main template workflow or under Servers & Settings, then applied via permissions and a reusable policy object. In Director, it’s configured per organization under Others > ALG and associated with a device’s profile.

More on ALG

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about ALG, these are worth looking at next.