Finally resolved by the firewall team. We upgraded to the latest ios, 12.4(15)T5. There was a bug in 12.4(11)T1, See this: CSCsi84069, CBAC blocks RTP traffic even if pre-generated session exists
Under some very specific circumstances with IP inspect, NAT and ip phones located in different VRF's, it might be that SIP inspection is not allowing through the RTP session of called SIP phone.
No known workaround
Thank you,
John