nat=yes causes Asterisk to respond to the IP level address, not to the Contact header in the application level data. That suggest the service provider hasn’t got their NAT configuration right (nat= is about the remote NAT status, not yours).
Please note that insecure=very is undefined on 1.8 and was almost certainly more insecure than you needed in 1.4 (it equates to port,invite, but most people do not need the port). Also, canreinvite is deprecated and may actually have be removed in 1.8, in favour of direct media.