The usual mistake I see is that a firewall admin will allow the SIP device to talk to the controller but not the end device.
That's why it will ring - it can get the signaling from the controller - but can't talk to any other phone.
The SIP device must be able to talk to any subnet where there are going to be phones talking to it.
Ralph