I currently have successful two way calls (signalling and media) in the following setup
External Linphone --> Freeswitch --> Freeswitch SBC -> Router -> Kamailio --> Internal Linphone
However, when I try to call a Cisco handset that is registered to CUCM9 via CME in the following config:
External Linphone --> Freeswitch --> Freeswitch SBC -> Router -> CME -> CUCM9 --> Cisco handset
The call signalling appears to be working fine and I can successfully initiate a call from each end, but the only RTP stream that is working is from the external Linphone client to the Cisco handset.
Note that CME is being used as a CUBE device, so all SIP and RTP goes via it.
Looking at the RTP debugs on CME I can see the problem is that the "Media Dest Addr" is getting set to the external side of the FS SBC rather than the internal IP address.