All media goes to the Avaya cloud (MPC) instance nearest to Avaya Hybrid Cloud Gateway, regardless of the agent location. You need Secure Real-Time Transport Protocol (SRTP) because the voice media goes to the cloud.
You need open firewall ports for media. Signaling and administration are firewall-friendly.