Something like this, you set your sip service and tell ScreenOS to use the SIP application. So the ALG will open the high ports for the calls. The SIP ALG needs to be on for this.
set policy id 36 name "SIPphones" from "Untrust" to "Trust" "any" "VIP(untrust)" "_SIP" permit log
set policy id 36 application "SIP"
set policy id 36
exit