Only phone side firewall configuration would be slg. Most FW allow all ports outbound, especially sky ( mine at home) for dect phone, provision in 3cx, you need to update FW to 3cx on dect 1st. Then login and use the provisioning url. Dect phones can't use the rps service. Any other sip phones...