1. Can we enable media encyption only (without signaling encryption)?
No. The symetric keys for the SRTP streams of the call are passed to each endpoint in the signaling stream with CUCM. Leaving the signaling stream unencrypted would completely defeat the purpose of SRTP.
2. If seperate office network are behind firewall, can the encrypted signal pass through the firewall? I read some documents said that the encrypted signal cannot be inspected by firewall.
You won't be able to do layer seven (i.e. SIP or SCCP) inspection on the firewall and will need to allow TLS and RTP/SRTP sessions through as that is all the firewall will see. Essentially your ACLs will have to be more open. Alternatively you can use a Trusted Relay Point for TURN support if you're using IOS ZBFW. The UC SRND has some additional reference information in the Security chapter: http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/srnd/8x/security.html
