To resolve this problem you need to make sure that the NAT firewall you are using is SIP aware. Most of the brand name firewalls have SIP ALG ( application layer gateway ) that changes SIP and RTP messages passing thru the firewall to allow registration and open RTP ports needed on the fly.
Most SOHO firewalls are not sip aware and you will have problems with Polycome phones - these phones are known to have problems with NAT , while providing very good ( I'd even say unmatched ) voice quality.
In addition your 3CX is behind NAT as well, making the whole communication picture a mess. Even with port forwarding enabled you most likely will see problems with phones not restringing or RTP not establishing.
So the question is - What kind of fireawalls are you using ?