Hi Greg!
First, make sure that you have your router configured to forward UDP ports used by UCx for media streams (by default 10000 to 13999) to the IP address of your UCx system.
Take a peek at the end of the following page in the E-MetroTel documentation:
The information about media ports is valid (and needed) for both remote Nortel phones as well as remote SIP phones. For remote SIP phones, you should probably add the SIP signaling port (5060 by default) to your router forwarding table.
Next, make sure that you set the following values on the top of the SIP Settings page:
NAT = yes
IP Configuration = Static IP
External IP = <WAN IP address assigned to your router by your ISP>
Local Networks = local subnet to which the UCx system belongs (if you use the default subnet, the fields should be 192.168.1.0 and 255.255.255.0)
Now, a word of caution - if you open the SIP signaling port on your router, make sure:
1. That you use strong password for all your SIP extensions
2. That you have the Allow SIP Guest option on the SIP Settings page set to NO
3. That you have the Allow Anonymous Inbound SIP Calls on the General Settings page set to NO
The reason is that the default SIP port 5060 is attacked by hackers all the time. Personally, I change the SIP port used by UCx to a non-default value (you could use for example 5090 or something like that) - the probability that hackers would test various ports looking for a moved SIP port is pretty low. In other words, you'll see hundreds of attempts to get in using the port 5060 each day - you are not likely to see any on a non-default port.