7936 Phones and Problems With DTMF on SIP Trunks

The CUCM  SRND states that the best way to implement a SIP trunk is to set the DMTF Preference on the Trunk in CUCM to "No Preference" and use dtmf-relay sip-kpml rtp-nte on the dial-peers pointing to the CUCM server(s). This allows CUCM to decide which method to use, depending if a phone supports out of band (e.g. KPML, SIP notify, etc.) or RFC2833 & thus avoid invoking an MTP to handle DTMF inter-working unless unavoidable.
Unfortunately this doesn't work with the old 7936 conference phones, you'll get no DTMF in calls via the SIP trunk, bug reference CSCuc80321 explains in detail. In short the workaround is to use DTMF Preference "RFC2833" on the Trunk, but this will always invoke an MTP. This in turn can cause a problem if you're using G729, as the MTPs running on the CUCM server(s) as part of the IP Voice Media Streaming App service only support G711. You'll need a router to be able to provide an MTP that can handle G729, as the example configuration snippet shows:

dspfarm profile 1 mtp 
 codec g729r8
 codec g729ar8
 maximum sessions software 60
 associate application SCCP

Kludging NAT for Communications Manager SIP Trunks

Ideally when using a SIP trunk to an external provider for PSTN connectivity with Communications Manager you'd use a Unified Border Element (UBE) in media flow-through mode to handle SIP to SIP inter-working & present a single IP address for NATing on your Internet router. But what happens when the customer is too cheap to pay for a UBE? Well if the SIP trunk requires registration or the SIP headers formatting in a way the CUCM doesn't like then you're out of luck! Otherwise you can kludge an IOS router into handling the NATing to a single IP address.
The problem stems from the fact that unless you enable "MTP required" Communications Manager handles a SIP trunk like an UBE in media flow-around mode - it handles protocol inter-working but the RTP audio streams pass directly between endpoints. This means that you have to NAT port 5060 to the CUCM server for the SIP traffic, but also NAT the phone's subnet too. Even if you do enable using an MTP, with multiple servers there could be multiple MTPs with different IP addresses.
The configuration below works assuming your IP address for NAT is 1.2.3.4, the CUCM server is 10.1.1.2, the phones reside in the 10.1.1.0/24 network & the SIP trunk is 4.3.2.1:

ip inspect name FIREWALL tcp
ip inspect name FIREWALL udp
ip inspect name FIREWALL sip
!
interface FastEthernet0
 description Outside interface
 ip address 1.2.3.1 255.255.255.248
 ip access-group OUTSIDE_IN in
 ip nat outside
 ip inspect FIREWALL in
 ip inspect FIREWALL out
interface FastEthernet1
 description Inside interface
 ip address 192.168.0.1 255.255.255.0
 ip nat inside
!
ip access-list extended OUTSIDE_IN
 permit tcp host 4.3.2.1 host 1.2.3.4 eq 5060
 permit udp host 4.3.2.1 host 1.2.3.4 eq 5060
 deny   ip any any log
access-list 2 remark Voice subnet
access-list 2 permit 10.1.1.0 0.0.0.255
!
ip nat pool phones 1.2.3.4 1.2.3.4 netmask 255.255.255.252
ip nat inside source list 2 pool phones overload
ip nat inside source static udp 10.1.1.2 5060 1.2.3.4 5060 extendable

This kludge works as we've done a static port NAT to the CUCM server & allowed it in the access-list, this allows call control messages in & out. The SIP inspect punches holes in the access-list to allow the RTP inbound (outbound is allowed anyway). The SIP NAT ALG (application layer gateway) fixes the SIP headers to have the right IP addresses & port numbers. You can confirm this via show ip nat translations which shows the phone's being NATed as well as the CUCM server:

Pro Inside global   Inside local          Outside local   Outside global
udp 1.2.3.4:5060    10.1.1.2:5060         4.3.2.1:5060    4.3.2.1:5060
udp 1.2.3.4:5060    10.1.1.2:5060         ---                   ---
udp 1.2.3.4:32366   10.1.1.21:32366       4.3.2.1:30118   4.3.2.1:30118
udp 1.2.3.4:32367   10.1.1.21:32367       4.3.2.1:30119   4.3.2.1:30119
udp 1.2.3.4:26642   10.1.1.24:26642       4.3.2.1:21068   4.3.2.1:21068
udp 1.2.3.4:26643   10.1.1.24:26643       4.3.2.1:21069   4.3.2.1:21069
udp 1.2.3.4:19462   10.1.1.26:19462       4.3.2.1:31900   4.3.2.1:31900
udp 1.2.3.4:19463   10.1.1.26:19463       4.3.2.1:31901   4.3.2.1:31901
udp 1.2.3.4:29940   10.1.1.26:29940       4.3.2.1:20970   4.3.2.1:20970
udp 1.2.3.4:29941   10.1.1.26:29941       4.3.2.1:20971   4.3.2.1:20971
udp 1.2.3.4:25306   10.1.1.28:25306       4.3.2.1:25398   4.3.2.1:25398
udp 1.2.3.4:25307   10.1.1.28:25307       4.3.2.1:25399   4.3.2.1:25399