John,
Doing a quick Google search, I see that Facetime is using SIP, ICE, RTP, and H264. I'm not sure how accurate it is, but here's the link I used:
http://youshottheinvisibleswordsman.co.uk/2010/06/25/iphone4-facetime-and-open-standards/
With that being said, the first thing that I would confirm is that you have 'inspect sip' within your policy-map and applied to the appropriate interfaces. If that is there, the only thing that I can offer is some basic troubleshooting guidance:
1.) Enable 'logging buffered debug' and increase the buffer-size substantially. I usually use 'logging buffer-size 512000' or '1024000'.
2.) Enable packet captures on the relevant interfaces for the relevant traffic:
https://supportforums.cisco.com/docs/DOC-1222
3.) Create the issue by trying a call that doesn't work.
4.) Immediately after reproducing the issue, do a 'show log | inc ' where ip_addr is the relevant host that is failing. In some cases, it is equally easy to just do a 'show log' and use other PC/Linux tools (Notepad or Grep) to parse through the traffic.
5.) If #3 doesn't give you all of the information, try a call that DOES work and do a comparative study of the two.
In either case, the information from #2 and #4 above will give you alot of good information - and the syslogs will give us a better understanding as to how the ASA is handling the connections.
My initial suspicion is that you have an asymmetric route issue. Since the ASA is a stateful firewall, it needs to see every packet of a TCP flow. If you see a number of syslogs of 'Deny TCP (no connection)', this is a tell-tale sign of exactly that. The possible solutions for you, if that is the case, would be to adjust the routing on your network to ensure that this doesn't happen or enable TCP State Bypass for the relevant traffic (supported in 8.2):
http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/s1.html#wp1428242
Good Luck! Let me know if this helps!
Best Regards,
Kevin
