A stand-alone endpoint is only capable of a direct H.323 or SIP call; neither of which are compatible with NAT. Give the endpoint a public IP and try again. Or use a direct cloud registration to Webex Control Hub (license required) which would allow it to traverse the firewall/NAT.