SRTP protect: replay check failed (index too old)

No idea? ICE candidates are what matter, and apparently that is the ICE candidate that was used - could have been discovered as a peer reflexive candidate due to your AWS arrangement NATting that traffic. You’d have to examine a packet capture.

RTPproxy was altering the SDP. (interestingly, it was setting the c= lines, not the candidates.) It’s now looking better, the IP addresses are correct, its the ports that appear incorrect.

They don’t seem to agree on the bundle thing. These are the RTP packets to and from Asterisk, based on the type, it looks like opus (111) and VP8/9 (98). All streams are bundled

Got  RTP packet from    41.71.39.122:51871 (type 111, seq 012067, ts 3804002217, len 000085)
Sent RTP packet to      41.71.39.122:51871 (via ICE) (type 111, seq 013877, ts 3804002208, len 000085)
Got  RTP packet from    41.71.39.122:51871 (type 98, seq 011958, ts 2704589154, len 001166)
Sent RTP packet to      41.71.39.122:51871 (via ICE) (type 98, seq 012013, ts 2704589154, len 001154)
Got  RTP packet from    41.71.39.122:51871 (type 98, seq 011959, ts 2704589154, len 001166)
Sent RTP packet to      41.71.39.122:51871 (via ICE) (type 98, seq 012014, ts 2704589154, len 001154)
Sent RTP packet to      41.71.39.122:51871 (via ICE) (type 98, seq 023366, ts 2704589154, len 001154)
Sent RTP packet to      41.71.39.122:51871 (via ICE) (type 98, seq 013825, ts 2704589154, len 001154)

But the invite OK, response (from the browser) is with this:

v=0
o=- 8481965294150378426 3 IN IP4 127.0.0.1
s=-
t=0 0
a=group:BUNDLE 0 1 video-2 video-3
a=msid-semantic: WMS e0cf1599-0657-4a7b-8ffe-2378f202b3d5
m=audio 51871 UDP/TLS/RTP/SAVPF 111 0 8 126
c=IN IP4 41.71.39.122
a=rtcp:9 IN IP4 0.0.0.0
a=candidate:788437763 1 udp 2122260223 192.168.99.254 51871 typ host generation 0 network-id 2
a=candidate:1594107298 1 udp 2122194687 192.168.88.232 65185 typ host generation 0 network-id 1 network-cost 10
a=candidate:1618831347 1 tcp 1518280447 192.168.99.254 9 typ host tcptype active generation 0 network-id 2
a=candidate:294115666 1 tcp 1518214911 192.168.88.232 9 typ host tcptype active generation 0 network-id 1 network-cost 10
a=candidate:3799229584 1 udp 1686052607 41.71.39.122 51871 typ srflx raddr 192.168.99.254 rport 51871 generation 0 network-id 2
a=candidate:2475235889 1 udp 1685987071 41.71.39.122 65185 typ srflx raddr 192.168.88.232 rport 65185 generation 0 network-id 1 network-cost 10
a=ice-ufrag:E43w
a=ice-pwd:TgV+D8lMCQKcNeILlDvoz/xY
a=ice-options:trickle
a=fingerprint:sha-256 DB:11:5D:28:B3:A9:BB:30:72:D2:1A:5E:6B:FB:CF:5D:94:F8:91:F3:13:65:FF:E1:BF:2D:C3:CE:15:CD:1F:3A
a=setup:passive
a=mid:0
a=sendrecv
a=msid:e0cf1599-0657-4a7b-8ffe-2378f202b3d5 7c541310-cc3a-4de9-9a9c-19bffcbc742e
a=rtcp-mux
a=rtpmap:111 opus/48000/2
a=rtcp-fb:111 transport-cc
a=fmtp:111 minptime=10;useinbandfec=1
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:126 telephone-event/8000
a=ssrc:361660592 cname:6ssPX/GwjPVXdKI2
m=video 52657 UDP/TLS/RTP/SAVPF 98 96
c=IN IP4 41.71.39.122
a=rtcp:9 IN IP4 0.0.0.0
a=candidate:788437763 1 udp 2122260223 192.168.99.254 52657 typ host generation 0 network-id 2
a=candidate:1594107298 1 udp 2122194687 192.168.88.232 57548 typ host generation 0 network-id 1 network-cost 10
a=candidate:1618831347 1 tcp 1518280447 192.168.99.254 9 typ host tcptype active generation 0 network-id 2
a=candidate:294115666 1 tcp 1518214911 192.168.88.232 9 typ host tcptype active generation 0 network-id 1 network-cost 10
a=candidate:3799229584 1 udp 1686052607 41.71.39.122 52657 typ srflx raddr 192.168.99.254 rport 52657 generation 0 network-id 2
a=candidate:2475235889 1 udp 1685987071 41.71.39.122 57548 typ srflx raddr 192.168.88.232 rport 57548 generation 0 network-id 1 network-cost 10
a=ice-ufrag:E43w

I get the audio, and one video stream back.