LAN -> FW/LAN -> NAT (Auto/Manual (neither worked for us))
SS3 Service Definitions:
Polycom-H.323: 1720 - 1720, TCP
Polycom-TCP: 3230 - 3235, TCP
Polycom-UDP: 3230 - 3253, UDP
Polycom-H.245: 11000 - 11999, TCP
SS3 Service Enable:
for each "Service" defined above, set the Polycom's internal IP address as the "Public Server". This will automatically create permission rules on the Policy page.
This is a collection of techical information, much of it learned the hard way. Consider it a lab book or a /info directory. I doubt much of it will be of use to anyone else.