V18 Sip trunk

Question

I am trying to set up a sip trunk with sophos v18. 
 I have a cisco cube router behind sophos xg v18. 
 The cube talks sip to cisco Call manager. 
 What rules and nat is needed to connect the cisco router with Sip provider? 
 I thought it would be as simple as making a nat dnat rule sending the sip traffic hitting our external ip address to the internal ip of the Cisco router. However it is not working as expected. 
 I see the sip traffic hit the cisco router and then the sip traffic is continuing on to the call manager and ringing the internal phones. I can even answer the call. But then it disconnect within a few seconds. 
 I see the cisco router is sending the sip OK back out to the provider but not seeing a ack back from the provider. 
 Coming from ASA word i am used to natting in the ASA and seeing internal ip addresses hitting the cisco cube on the incoming invite. But with the NAt in the sophos i am seeing the public ip hitting the cube in the invites?

Jim Boothe1 · Accepted Answer

So after a lot of trial and error i found that it was the SIP headers that were causing the issue. My nat rule and firewall rules were correct in letting the traffic in. Sophos just handles sip traffic differnt than what i am used to with a cisco ASA. It does not re-write the headers. So i was seeing public information in the invite headers and header information going back to the provider was sending private information in the headers. 
 
 I had to create sip-profile and change the response in the contact and or remote party id header information as it flowed back out towards my provider to have my public ip information. 
 Now it is working as expected. 
 
 I am not sure if there are any other settings i could have done on the Sophos to make it work more like an ASA or if the XG just designed to work like this. Probably the latter which is fine now that i have a solution i can move forward with new customers. 
 
 Also FYI. Using a different sip provider that uses sip registration i.e. setting username password information to set up the trunk it worked without any issues behind the XG. the Traffic just went out and talked to the providers SBC and registered. The above issue only appeard when sending sip traffic to and from a provider with no registration.