A phone can register and ring correctly while the call has no audio. This is possible because SIP signaling and RTP media often travel through different addresses and ports.
The NAT problem
Office devices usually have private addresses that cannot be reached directly from the public internet. A NAT router translates their traffic to a public address. Problems begin when SIP or SDP advertises the private address, the router closes a temporary mapping, or the firewall blocks the media range.
How STUN, TURN, and ICE help
STUN helps an endpoint discover how its address appears outside the local network. TURN provides a relay when a direct media path cannot be created. ICE tests possible paths and selects one that works. Browser-based calling and mobile apps often use these methods together.
Why SIP ALG is controversial
SIP ALG tries to inspect and rewrite VoIP traffic. A well-implemented ALG can help, but many consumer routers modify headers incorrectly, interfere with encryption, or create inconsistent mappings. When registration drops or audio is one-way, disabling SIP ALG is a common controlled test—not a universal rule.
A disciplined troubleshooting order
First confirm whether the failure affects signaling, audio, or both. Check the public and private addresses in SIP and SDP, verify the RTP port range, review firewall and NAT timeouts, remove unnecessary double NAT, test with and without VPN, and capture a failing call when possible. Change one item at a time so the real cause is not hidden.