I never used SIP in my APPs, but I deployed some asterisk and callmanagers etc, however, you only need the SIP ports (to register) and the RTP ports open usually open in the vpn. I have a lot of deployments with VPN with SIP traffic VPN and DMVPN. I did not see why the SIP framework will not work. I used a lot zoiper APP inside of VPN.