Its expected…since 323 imbeds the media in the H245 or H225 fast start mechanisms which are in the body of the message. You will need a firewall that has h323 support that will swap inside and outside addresses. Only fix i know is to get a firewall that does support it.