I'm using zyxel USG firewalls over years with 3cx. They are working fine. You have to to set NAT forwarding in NAT section (5060,5090 UDP and TCP, 9000-9049 UDP, 5000 TCP). Another thing, under firewall you have to create rule for those ports. You have to do from WAN to LAN any IP to local IP address of 3CX PC. You have to do that sip tcp sip udp , tunnel 5090 udp and tcp, ect. SIP alg you have to uncheck but I did not have issues if that option is on. You can create group of those ports as "VOIP" service then you can set QOS for VOIP. For remote office you can create VPN between two USG then on remote phones you can set provision server with local setting and it will works beautiful.
P.S. after NAT you can just disable firewall and it will work for sure.