After talking to a few hosted VoIP providers, they all state that "ALG" or SIP inspection in the case of the Cisco firewall should be disabled. How is SIP not broken after leaving the firewall over the public Internet when being NAT'd from a private to public address if the SIP payload contains a private address that inspection would normally fixup -- using the older inspection terminology there ;-) ? Is STUN or TURN the only way preventing this breakage and can I assume that these providers support that or does that have to be confirmed? Is it not better to have inspection? I know that certain SIP implementations don't add addressing in the application layer, but in the these cases they do.
I have SIP inspection enabled and don't see any issues with it and I gain the benefit of not only being able to do a show SIP but the necessary pinholes are dynamically created instead of opening wide static holes these providers often request, but the providers still insist having ALG creates more problems.