Asterisk behind NAT and clients behind NAT

Hi,

We just install asterisk on a Centos 6 vm and it is sitting behind a firewall (ads router) here at office 1.

We can connect Xlite to asterisk from any computers in office 1.

Office 2 is also behind a firewall (another adsl router) but we can’t connect Xlite to the asterisk server in office 1.

On sip.conf we have

[general] context=public ; Default context for incoming calls. Defaults to 'default' externhost=pablo.anahata.uno ; refreshed periodically externrefresh=180 nat=yes localnet=10.1.1.0/255.255.255.0 qualify=yes

and then…

[code][pablo_laptop]
type=friend
context=phones
host=dynamic
secret=Anahata123

[pablo_desktop]
type=friend
context=phones
host=dynamic
secret=Anahata123

[cisco_7940]
type=friend
context=phones
host=dynamic
secret=Anahata123

[cisco_7941]
type=friend
context=phones
host=dynamic
secret=Anahata123

[arslan_desktop]
type=friend
context=phones
host=dynamic
secret=Anahata123
[/code]

on rtp.conf we have:

[general] ; ; RTP start and RTP end configure start and end addresses ; ; Defaults are rtpstart=5000 and rtpend=31000 ; rtpstart=10000 rtpend=20000

In office 1 firewall, we have forwarded 5060 tcp/udp and 10000-20000 udp to the asterisk server as per this image
postimg.org/image/yljih73v1/

Does anyone know why the sip soft phones (e.g. XLite) in office 2 cannot connect to asterisk on office 1?

Thanks