The Network Security Administrator discovers that the company's NAT-aware SIP phone system is not working properly through the Palo Alto Networks firewall, even though SIP traffic is being allowed…

ALGs are generally configured per application or globally, not directly disabled within a security policy itself; the security policy only allows or denies the traffic.

An application override policy bypasses Layer 7 inspection, which might stop the SIP ALG from being invoked, but it's a less direct and less granular solution than specifically disabling the SIP ALG if the issue is a conflict between the phone's NAT-awareness and the firewall's ALG.

A security policy allowing any traffic is too broad and does not address the specific issue of SIP ALG interference with a NAT-aware SIP system, which requires more granular control over the SIP application behavior.

When a SIP phone system is NAT-aware, it already handles NAT traversal itself, making the firewall's SIP Application Layer Gateway (ALG) redundant and potentially conflicting; disabling the SIP ALG within the SIP application settings prevents the firewall from modifying SIP packets and interfering with the phone system's own NAT signaling.