The cisco pix firewall requires that in version 7.0 or later look at the “inspect” fields. (Prior to version 7 it was called “fixups” not “inspect”.) Make sure that the “inspect SIP” field is NO. “Oo inspect sip” is the proper setting. With ‘inspect sip’ on, the PIX firewall replaces the internal IP address of the phone with the external IP address. VOIP uses both pieces of information to accurately deliver the call. The internal IP address must be inside the SIP packet for the service to work without issue.