Default Subzone and Default Zone will involve traversal call/registration in default configuration.
However current release version doesn’t have any configuration that will control enable/disable encryption over SIP call while using TLS as transport protocol.
So as long as TLS is in used for your call, your zone configuration should be fine.
Please note that there are few firewalls does support TLS inspection today (Cisco ASA, Checkpoint, etc.). If you are using such firewall, I’d suggest to disable it for isolating firewall issue. (please note very unfortunately some of firewall may require create rule manually to disable TLS inspection even it have check box to disable the TLS inspection…).
