Does the SIP ALG for NAT have to be on the router where I am planning on running Call Manager Express for that to work properly, or can I have it running on an upstream router where I am currently preforming NAT functions?
You should be able to run it on either. If you have a choice, it would probably be better to run it on the upstream router. There are some things with SIP that aren't supported with the NAT ALG when the SIP is originated and fixed on the same router. One of these things I can name off hand is the 'sip bind' command which isn't supported on the same box.
It's still very possible to run it on the same box, however. But the SIP ALG doesn't require any information from CME to work properly.