Cardine,
Are you using a double router setup the way dan is decribing? Not sure why there are 2 routers involved unless the one from the cable company is not actually being used.
Whatever the setup, you have to make sure that the router is capable of doing NAT Traversal and that it is active. Of course, you have to have all the licensing requirements in the BCM as well. You need IP licenses for your sets and you need the NAT Traversal license in the BCM. Then you have to make sure you tick the Support Remote Worker checkbox under Resources>IP Sets.
It's also a good idea to verify what the external address of the supporting router is. To be sure, have someone on the LAN that the BCM sits on go to whatismyip.com. That will tell you for sure what it is (you could also use the STUN setg in the BCM to get it). Set the IP phone's S1 address to that external IP and if the proper ports are forwarded to the BCM, the set should register and you should have 2-way audio.
Ports required are: 70000 for registration
28000-28249 for RTP over UDP
30000-30099 for RTP over UDP
60000-60240 for RTP over UDP
17018-17019 for signalling
2216-2217 for signalling
20000-20249 for UDP
There is also a note saying 0-1023 need to be opened but I'm not so sure about those. You would really have to check that with the IT guys.
I hope you're not trying to set up a a vpn connection between that 600 and the IP set. If so, it's not required.
