Short answer: Service Book
Long answer: The device looks up it's service book for the communication with the BES/BIS. Once it finds that, it talks to it (by way of the carrier) and the internal IP address (in this case, 192.168.x.x) is looked up by the BES/BIS. Naturally, on a BIS this would give an error (lol, unless the carrier has something on that IP, on the network of the BIS and no firewall). On a BES, however, it's entirely possible the company with it put something on the network the BES can see with a non-routing IP address. In that case, the device could reach it.
M
|