If you don't have the RTP ports forwarded to you it may result in intermitent issues, so you may want to consider whether or not you want to keep it that way. The reason it works 'most of the time' is because upon the negotiated signalling, you begin to transmit to them through the ports that you've requested they send the media to you in. Once you have initiated that, they'll be able to reach you through those ports as you've opened up a hole from inside. The things that can go wrong are two fold. Until you do that, the hole isn't opened so any transmission they do to you will get blocked. Secondly, if your firewall re-maps your ports, you may or may not recieve the media, it depends on how aggresive they are in trying to accomodate an 'incorrect configuration' on your part. Some providers may wait until they see your media stream, ignore the signallilng information you supplied them in the SIP dialog, and send the media back to the ports that your stream is coming from. As long as they are doing that, it would continue to work. However, the proper operation would be for them to send the media to your advertised ports. If your firewall has remapped those ports, then the media will get blocked and you'll end up with one way media where as if you had the ports forwarded, they would still arrive at your PBX.
So ... the crux here is, it may work now, and it may continue working, but it may also break or even get intermitent problems if you don't have those ports forwarded. The latter could happen because of changes on their side (which would not be anything they're doing wrong) or changes on your side because of firewall behavior.
