I can only send and receive media from only 1 public IP address.
After studying the traffic from my firewall after configuring dNAT, I found I was dropping lots of incoming packets when placing my outbound calls on an IP address I didn’t recognize. I brought it to the attention of the vendor’s tech-support. Their response was that they send the handshaking and media over separate IP addresses.
The calls DO land, and I get two-way audio. Ideally I would like the configuration to be tidy, so if my customer decides to scale up the service - this dropped traffic does not present problems.