SBC steering pool and mismatch to firewall rules query

Hi all,

I have a Teams direct routing configuration and on my steering pool for Teams I have noticed there is a mismatch with the ports on the firewall configuration. So for example on the steering pool I have start range 20,000 and end range 30,000 but on the firewall rule for inbound connections from Teams the allowed media ports are 25,000-25,100. So the firewall ports range is extremely restricted in comparison to what I would expect the SBC to be offering to Teams in SDP bodies.

What's really curious is the SBC appears to offer ports in the very narrow band of 25,000-25,100 in it's SDP bodies towards Teams and I am wondering how it's doing this? When I first spotted this configuration mismatch I was expecting to see one way audio problems when the SBC offered a port outside of the firewall restricted ports or SIP updates offering new ports when a connection on a port could not be made but the SBC always seems to be able to pick a port that actually is open on the firewall.