One common reason for this is that the UDP Timeout settings are not configured correctly. These may be found on the advance - Conntrack/Netfilter page in the Tomato config. I set "unreplied timeout" to 10 seconds and "assured timeout" to 300 seconds. On the VoIP devices, the NAT keepalive should be greater than the Tomato UDP Unreplied Timeout value (10) but less than the Tomato UDP Assured Timeout value (300). The default here is 15 and that's fine.