Application Layer Gateways

Fri Sep 22 03:10:48 UTC 2017

Working with an ISP, we recently deployed Comtrend VDSL routers, and
Alcatel-Lucent GPON ONTs. Both of these devices uses chipsets made by
Broadcom, and as such probably use the same underlying Broadcom operating
system if I had to guess. They are different chipsets though as one is from
VDSL2, and the other for GPON

By default, the Comtrend had the following Firewall -- ALG/Pass-Throughs
enabled:

FTP
H323
IPSec
IRC
PPTP
RTSP
SIP
TFTP

On the Acatel-Lucent (Nokia) ONT, the following came enabled by default
from the factory:

FTP
H323
IPSEC
L2TP
PPTP
RTSP
SIP
TFTP

The only difference between these two is the Comtrend has an IRC as a ALG,
and Acatel has L2TP as a protocol type. The other seven ALG protocols as
the same.

My question is in general, is it a good idea to disable all Application
Layer Gateways?

The only ALG I have had experience with was a SIP ALG. Almost all SIP
providers strongly recommend you disable SIP ALGs as it does more harm and
breaks more things than it does good, so we always disable SIP ALG. But
what about the other protocols on these two? Do you think they should be
enabled or disabled by default?

I am leaning towards disabling them all for our standard config.