If you mean port 400, you need to fix your NAT router, or tell them not to specify it in the Contact header on the INVITE response. With your configuration, Asterisk will only send to port 400 if that Contact header specifies it, either because that is what they sent, or that is what your router corrupted it to.
If you mean the request URI, that will depend on your dialplan and what was dialled, but you would want that to be variable
Note that type=friend is bad practice, use type=peer, and that canreinvite and insecure=very are deprecated or unsupported in currently supported versions of Asterisk, although neither affects the port used. Use directmedia for canreinvite. Use insecure=invite, or insecure=port,invite, depending on the minimum that is really needed. It is clearer to use remotesecret, instead of secret, rather than to use insecure=invite.