I have two SIP devices connecting via their own VPN connection to my CRS125.

In IP/Firewall/Connection I can see them indeed connecting to my SIP server via UDP on port 5060.

However, one of them shows "SACF" flags, while the other one only shows "C".

I found that S = seen-reply, A = assured, C = confirmed and F = fasttrack

But what does this mean in beginners' terms?
And why would they both be different?

Thanks!

These flags are set depending on the return traffic seen on the connection.
So when they don't get set, there is no reply seen.
(the different flags refer to different situations, e.g. a single UDP packet sent and received,
or a series of UDP exchanges that apparently is a session. these are used to vary the timeout
on the connection tracking entry)

Having more than one SIP device on the same router is always a little problematic.
The first thing I would try in this case: go to the IP->Firewall->Service Ports screen and disable
the entry for SIP. That is a "helper" that tries to be clever about your SIP traffic and usually
causes more trouble than doing good.
(however, this also depends on how your devices and exchanges are actually configured w.r.t. NAT)

Wow, indeed, after disabling this SIP entry, both devices have SACF in the IP/Firewall/Connections!

Thanks!

Ok but in that case you also need to check if the phones actually work.
(i.e. when you make or receive a call, there is audio in both directions)

Audio works in both directions, thanks.