Matt,
We do not currently us the 3cx, but have installed a video/voip system that utilizes SIP as well as other protocols for video. Inbound calling was visible to the system, but they were dropped when trying to answer. Researching TZ170 issues, I came across this forum.
We didn't want to put this system in a DMZ either, and after a week of frustrations figured out a solution for our problem. We assigned a static ARP entry for the LAN IP & MAC address of our system and this cleared up the problem.
Did you come across another solution? The TZ170's were are running is getting long in the tooth and I didn't want to spring for the Enhanced software, etc. We are looking at putting in more of these systems, but do not want another repeat with a different firewall solution.
Charlie