Cisco SPA504G & Asterisk behind NAT, can't register

Please help me understand SIP debug and hopefully understand why it won’t connect?

Network for Asterisk:
IP inside: 192.168.33.31
Public IP: x.x.x.129

Network for Phone:
IP inside: 192.168.99.112
Public IP: x.x.x.51

Here is my sip.conf

[code]; Declaring generic transport ==================================================
[general]
context=unauthenticated
allowguest=no
srvlookup=no
udpbindaddr=0.0.0.0
tcpenable=no
externip=x.x.x.129:5060
localnet=192.168.33.0/24

nat=force_rport,comedia

; Office phone template ========================================================
office-phone
type=peer
context=internal
host=dynamic
dtmfmode=auto
disallow=all
allow=g722
allow=ulaw
allow=alaw
allow=g729

; Cisco SPA504G phone I got first - installed on my desk at home
A44C119EEBF8
secret=zzzzzzzz
dtmfmode=rfc2833[/code]

Log is full of messages like this (this is the only device):

And if I enable SIP debug it looks like this:

[code]SIP Debugging enabled

<— SIP read from UDP:x.x.x.51:5061 —>
REGISTER sip:x.x.x.129:5060 SIP/2.0
Via: SIP/2.0/UDP x.x.x.51:5060;branch=z9hG4bK-50e0aef
From: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=68567d7be3cae5f6o0
To: “Ext 1” sip:A44C119EEBF8@x.x.x.129
Call-ID: 4775d917-32cbdaa7@192.168.99.112
CSeq: 26074 REGISTER
Max-Forwards: 70
Contact: “Ext 1” sip:A44C119EEBF8@x.x.x.51:5060;expires=180
User-Agent: Cisco/SPA504G-7.5.7s
Content-Length: 0
Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE
Supported: replaces

<------------->
— (12 headers 0 lines) —
Sending to x.x.x.51:5061 (NAT)

<— Transmitting (NAT) to x.x.x.51:5061 —>
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP x.x.x.51:5060;branch=z9hG4bK-50e0aef;received=x.x.x.51;rport=5061
From: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=68567d7be3cae5f6o0
To: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=as12ba24e5
Call-ID: 4775d917-32cbdaa7@192.168.99.112
CSeq: 26074 REGISTER
Server: Asterisk PBX 13.1-cert1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="7314e3dc"
Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘4775d917-32cbdaa7@192.168.99.112’ in 32000 ms (Method: REGISTER)

<— SIP read from UDP:x.x.x.51:5061 —>
REGISTER sip:x.x.x.129:5060 SIP/2.0
Via: SIP/2.0/UDP x.x.x.51:5060;branch=z9hG4bK-50e0aef
From: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=68567d7be3cae5f6o0
To: “Ext 1” sip:A44C119EEBF8@x.x.x.129
Call-ID: 4775d917-32cbdaa7@192.168.99.112
CSeq: 26074 REGISTER
Max-Forwards: 70
Contact: “Ext 1” sip:A44C119EEBF8@x.x.x.51:5060;expires=180
User-Agent: Cisco/SPA504G-7.5.7s
Content-Length: 0
Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE
Supported: replaces

<------------->
— (12 headers 0 lines) —
Sending to x.x.x.51:5061 (NAT)

<— Transmitting (NAT) to x.x.x.51:5061 —>
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP x.x.x.51:5060;branch=z9hG4bK-50e0aef;received=x.x.x.51;rport=5061
From: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=68567d7be3cae5f6o0
To: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=as12ba24e5
Call-ID: 4775d917-32cbdaa7@192.168.99.112
CSeq: 26074 REGISTER
Server: Asterisk PBX 13.1-cert1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="7314e3dc"
Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘4775d917-32cbdaa7@192.168.99.112’ in 32000 ms (Method: REGISTER)

<— SIP read from UDP:x.x.x.51:5061 —>
REGISTER sip:x.x.x.129:5060 SIP/2.0
Via: SIP/2.0/UDP x.x.x.51:5060;branch=z9hG4bK-50e0aef
From: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=68567d7be3cae5f6o0
To: “Ext 1” sip:A44C119EEBF8@x.x.x.129
Call-ID: 4775d917-32cbdaa7@192.168.99.112
CSeq: 26074 REGISTER
Max-Forwards: 70
Contact: “Ext 1” sip:A44C119EEBF8@x.x.x.51:5060;expires=180
User-Agent: Cisco/SPA504G-7.5.7s
Content-Length: 0
Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE
Supported: replaces

<------------->
— (12 headers 0 lines) —
Sending to x.x.x.51:5061 (NAT)

<— Transmitting (NAT) to x.x.x.51:5061 —>
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP x.x.x.51:5060;branch=z9hG4bK-50e0aef;received=x.x.x.51;rport=5061
From: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=68567d7be3cae5f6o0
To: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=as12ba24e5
Call-ID: 4775d917-32cbdaa7@192.168.99.112
CSeq: 26074 REGISTER
Server: Asterisk PBX 13.1-cert1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="7314e3dc"
Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘4775d917-32cbdaa7@192.168.99.112’ in 32000 ms (Method: REGISTER)

<— SIP read from UDP:x.x.x.51:5061 —>
REGISTER sip:x.x.x.129:5060 SIP/2.0
Via: SIP/2.0/UDP x.x.x.51:5060;branch=z9hG4bK-50e0aef
From: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=68567d7be3cae5f6o0
To: “Ext 1” sip:A44C119EEBF8@x.x.x.129
Call-ID: 4775d917-32cbdaa7@192.168.99.112
CSeq: 26074 REGISTER
Max-Forwards: 70
Contact: “Ext 1” sip:A44C119EEBF8@x.x.x.51:5060;expires=180
User-Agent: Cisco/SPA504G-7.5.7s
Content-Length: 0
Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE
Supported: replaces

<------------->
— (12 headers 0 lines) —
Sending to x.x.x.51:5061 (NAT)

<— Transmitting (NAT) to x.x.x.51:5061 —>
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP x.x.x.51:5060;branch=z9hG4bK-50e0aef;received=x.x.x.51;rport=5061
From: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=68567d7be3cae5f6o0
To: “Ext 1” sip:A44C119EEBF8@x.x.x.129;tag=as12ba24e5
Call-ID: 4775d917-32cbdaa7@192.168.99.112
CSeq: 26074 REGISTER
Server: Asterisk PBX 13.1-cert1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="7314e3dc"
Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘4775d917-32cbdaa7@192.168.99.112’ in 32000 ms (Method: REGISTER)[/code]

There is no route back to x.x.x.51:5061 or the phone doesn’t know how to authenticate itself.

Also check that SIP ALG is not enabled in the router as enabling it tends to break things.

Replied in another topic, seems like 2 issues might be related