A rule is only part of the path
Stateful firewalls associate permitted traffic with a flow. SIP signaling and RTP media normally use different flows and may reach different destinations. Seeing a permitted SIP connection says little about whether the selected RTP tuple can cross the same boundary.
Asymmetric routing means the return traffic follows a different path. A stateful device that sees only part of a TCP exchange can reject legitimate packets. UDP has no TCP handshake, but NAT mappings, filtering and routing policy can still depend on which device sees each direction.
Paired observations help locate a change or loss. Account for clock offset, NAT and capture drops before attributing a difference to the network.
Inspect a failing call across the boundary
Write down the source and destination tuple on each side, the expected next hop and the state entry. Compare rule counters and drop logs with packet captures taken during the same call. Distinguish an expired mapping from a still-present mapping that points at the wrong WAN or peer.
Idle failures deserve their own test. Let the phone sit for the observed interval, then place an inbound call. Record registration refresh and keepalive activity without assuming a single universal UDP timeout. A successful immediate outbound call may refresh state and temporarily hide the problem.
Repair ownership of the return path
Correct routing, NAT and policy routing so the intended stateful boundary sees the required traffic. More permissive state handling exists on some firewalls, but weakens checks and should not be a blind workaround. In a cluster, verify state synchronization and failover behavior on the actual platform. Retest idle inbound calls, active calls during failover and fresh calls afterward as separate outcomes.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.