Application Level Gateway

Description

The Application Level Gateway (ALG) is a critical functional entity in 3GPP networks that facilitates communication between nodes operating in different IP address realms or IP versions (e.g., IPv4 and IPv6). Unlike basic Network Address Translation (NAT) or NAT with Protocol Translation (NAT-PT), which are application-unaware, an ALG is application-specific and capable of inspecting and translating network addresses embedded within application-layer payloads. This is essential for protocols like SIP/SDP, where IP addresses and port numbers are carried in the message body and must be translated to maintain end-to-end connectivity.

The ALG operates at the application layer, often integrated with a NAT-PT or NAT device. When a packet traverses the ALG, it not only translates the IP header addresses but also parses the application payload to identify and replace embedded IP addresses and port numbers. For example, in a SIP INVITE message, the SDP body contains the IP address and port where the caller expects to receive media. Without ALG, the recipient in a different address realm would attempt to send media to an unreachable address. The ALG rewrites these fields to reflect the translated address, ensuring that the media path is correctly established.

In 3GPP networks, ALGs are particularly relevant for interworking between IPv6-only and IPv4-only domains, a scenario common during the transition to IPv6. The ALG may reside in the IMS core, at the boundary between the packet core and external networks, or in the UE itself. 3GPP specifications such as TS 23.228 (IMS), TS 23.417, and TS 29.079 define the requirements and procedures for ALG functionality in various contexts, including IMS and interworking with external networks.

The ALG must be aware of the specific application protocols it supports. For SIP/SDP, it must handle not only the IP addresses in the SDP but also any SIP headers that contain addresses (e.g., Via, Contact, Record-Route). It must also manage the state of sessions to correctly translate addresses in subsequent messages. This stateful operation introduces complexity and potential performance bottlenecks, but it is necessary for seamless interworking.

Security considerations are paramount: the ALG must not introduce vulnerabilities such as address spoofing or denial of service. It must also handle fragmentation and other IP-level issues. Despite its benefits, ALGs can be challenging to deploy due to the need to keep pace with application protocol evolution. Nevertheless, they remain a vital component for ensuring interoperability in mixed IP-version environments, as reflected in their continuous presence from Rel-5 through Rel-19.

Purpose & Motivation

The ALG exists to solve the problem of communication between nodes in different IP address realms or IP versions when application protocols carry network addresses in their payloads. Basic NAT and NAT-PT only translate IP headers, leaving embedded addresses untouched, which breaks protocols like SIP/SDP. The ALG was introduced to perform application-specific translation, enabling seamless interworking without requiring changes to end hosts or applications.

Historically, as networks began transitioning from IPv4 to IPv6, the need arose to allow IPv6-only devices to communicate with IPv4-only devices. Early solutions like NAT-PT were application-unaware and failed for protocols that embed addresses. The ALG concept, standardized in IETF RFC 2663 and adopted by 3GPP, provided a framework for application-aware translation. This allowed operators to deploy IPv6 in their core networks while still supporting legacy IPv4 services and roaming partners.

The ALG also addresses scenarios where private and public address realms must interwork, such as when a UE in a private IP network accesses services in a public network. By translating embedded addresses, the ALG ensures that sessions are established correctly and media flows as expected. Without ALGs, many real-time services (VoIP, video) would fail across address realm boundaries.