I have also this problem - the nat only fails for sip-packets for example for http-traffic it works fine - in our case it works for about a week an then the sip-packets are not inspected and the voice-provider sent answer-packet with the original ip-...