Alex there are the port you will need to allow passage through the firewall..
SIP uses TCP and UDP port 5060 and 5061. Also you will need to allow RTP traffic which can vary but is usally UDP 16384 to 32000. Also your phones will need to download config file from the CME so allow TFTP traffic on port 69/UDP.