I believe you can only specify NAT related addresses in the general section.
Your logs don’t match your configuration with respect to codecs, possibly because you have more codecs in the general section. (Not including disallow can break things if you haven’t got a disallow in general, but, in this case, you must, as you are not sending all possible codecs.)
Although not causing you a visible problem, I would note you have a standard cook book configuration so it is obsolete and wrong.
nat=yes - only needed if the ITSP is both behind NAT and doesn’t know how to compensate - change ITSP if they really need this.
externip : undocumented synonym for externaddr.
media_address : redundant with respect to externaddr
type=friend : should be type=peer (security)
insecure=port : rarely needed (although insecure=invite is needed. WRONG. it has no effect when there is no secret.)
canreinvite: should be directmedia
If 15.2 is your first version of Asterisk, you should have started with chan_pjsip.