AT&T Fiber Pace 5268AC: SIP ALG rewriting causes dropped calls at 32 seconds

Router & ISP SIP ALG issuesMANUAL FIX INSIDEFREE — NO SIGNUP
Quick answer. The Pace 5268AC runs SIP ALG on 5060/5061 and is one of the gateways known to keep rewriting SIP headers even when its ALG-related firewall setting is turned off. The rewriting corrupts the ACK leg of the call handshake, so the SBC's Timer H expires 32 seconds (64×T1) after the 200 OK under RFC 3261 and the call is torn down with a BYE — the signature 32-second drop. The fix that works on this hardware is port 5062 for SIP signaling, which the ALG does not inspect — with the firewall setting checked and disabled first in case your firmware honors it.

The raw code check

Run this before you change anything — it confirms the root cause in one pass:

capture behind the 5268AC — 5060FAIL
INVITE ok → 200 OK ok → ACK ✗ (rewritten Via)
SBC: no ACK received — Timer H armed
T+32.0s: Timer H expired → BYE sent
call dropped. every call. same second.
capture — signaling on 5062OK
INVITE ok → 200 OK ok → ACK ✓ (headers intact)
SBC: ACK received — timers cleared
T+32s: call continues normally
T+5m: still up — fix confirmed

The manual fix — 3 steps

  1. Check the 5268AC firewall settings. Browse to the gateway (192.168.1.254), open Firewall > Advanced Configuration, and look for SIP or ALG handling under the firewall and applications settings. Disable what you find, save, and reboot the gateway — then test a call, because on this model the setting is sometimes honored and sometimes cosmetic.
  2. Move SIP signaling to port 5062. If calls still drop at 32 seconds, switch the worker's SIP endpoint to port 5062 (local listener and outbound proxy). The 5268AC's ALG only touches 5060/5061, so signaling on 5062 passes with headers untouched. This is the same mechanism VoipFlow uses in production, which is why we stopped fearing this gateway.
  3. Verify both ways. Run the SIP ALG Port Scanner against the worker's public IP (5060 rewritten vs 5062 clean is the expected signature on this gateway), then hold a five-minute test call and watch it pass the 32-second mark with two-way audio.

The automated alternative

If you'd rather never do this again: VoipFlow runs this whole class of maintenance as software — certificate issue-and-bind in about 12 seconds, signaling on port 5062 so SIP ALG rewriting never engages, per-tenant isolation, flat $399/mo. The 14-day sandbox is free, no credit card, and no sales follow-up unless you ask for one.

Deploy Free 14-Day Sandbox — No Credit Card Required

Related