I got the exact proplem, and about the same question long time back. Talk one way although all the required port had been open already. I didn't use sentinel for external phone, just do open the port and also some with vpn.
Finally Owen help me solved the problem.
What Owen told me was put the Required Zone to 1 instead of the default 0. 0 is the default for the keyset phone.
Im not sure if this will help, but it solved my problem.
