H323/SIP awareness or ALG features in your firewall/network should be disabled in order to prevent it from modifying the signaling (or, if practical, create exceptions for the affected endpoints). Though these features are in place to help traffic (through NAT for example), it usually ends up breaking traversal signaling and routing since this is already handled by Videonor and the endpoint. Typical symptoms are successful login, but missing media when in-call.
Other features such as IPS (often suddenly dropping inbound UDP traffic after a given amount of time), UDP flood protection (severe packet-loss occurring when accumulated UDP traffic hits a certain threshold) and other packet inspection features can also cause packet loss in media traffic, but ALG features is by far the most common issue.
In addition to the features mentioned above, do not forget the more basic requirements, such as sufficient network bandwidth and, if applicable, wireless networks with good capacity/coverage. Less common sources of error is NIC speed mismatch between switch and endpoint, network-traffic compression and routers limiting traffic between points in your network.