we ended up putting the system ahead of the firewall and the IP phones work great.