If you have multiple Internet connections to your cyberoam and load balancing enabled, when a particular server is accessing the Internet it may use any of the connections based on the load balancing rules. This can effect issues like email SPF records, and also applications that use NAT to provide access externally. Recently I was.
3CX needs the following ports forwarded to the VOIP server in order to work. The documentation does not by default describe which ones are meant to be TCP and which UDP so here they are: Port 5060 (TCP and UDP) – Used for SIP protocol transmission