I noticed something in practice that wanted to confirm with what theory says.
I have something like this:
dial-peer 1 voice voip
session target ipv4:10.0.0.1
session protocol sipv2
ip route 10.0.0.0 255.0.0.0 126.96.36.199
ip route 0.0.0.0 0.0.0.0 188.8.131.52
IP address 10.0.0.1 is a SIP proxy which establishes calls to different media gateways depending on the destination pattern.
In particular, for destination pattern 1.. calls are sent to a media gateway with IP 184.108.40.206.
I will have expected that RTP sent to 220.127.116.11 should be routed through 18.104.22.168 (the default route). However I noticed that it is sent to 22.214.171.124, this is, the next-hop used for routing h323 signaling to 10.0.0.1.
I think this is not a bug, but a feature. Most of the time, you will not know the IP addresses where your RTP will be terminated. You will only know the IP address of the call processing server. If, for QoS reasons, you need to have voice routed through a specific route, you will need to find out all possible RTP destinations, in order to configure static routes to all of them.
I discovered this empirically. Does anybody knows if this is documented by Cisco? I have not been able to find it.
Unless you configure "bind", the source address for both signaling and media is non-deterministics, or better say, local best address. See: