Explain the options when using NAT, as ALGs are notoriously error prone
This is what we suggest firewall-wise for VoIP customers:
Avoid using NAT where possible.
However, some NAT gateways provide an adequate SIP ALG (e.g. Technicolor TG582), and some devices provide NAT that works with the new call server (e.g. FireBrick FB2700 and many simple NAT routers). If NAT works, then well done, but if not we cannot guarantee to be able to make it work.