1 of 1 people found this helpful
I can't recommend strongly enough that the interface of the SBC facing the SIP trunks of the carrier have a public IP not behind any existing firewall. The SBC essentially is a firewall for VoIP.
There are so many things that can go wrong doing it any other way. Even if you can get it to work now, something will change in the future such as newer protocols, someone upgrading firewall software, etc that will break things in weird, intermittent, and unpredictable ways.
This is especially true if your firewall does NAT or is managed by a different entity than you. Unmitigated disaster in the making with weeks of blamestorming.