aster + idphone = Forbidden

Дано:

1. trixbox (System Status Version: 2.6.2.1, Asterisk 1.4.22-2)
2. СИП оператор местной связи с собственным last mile (adsl) - IDPhone (LAN 192.168.2.1/24[eth0:1] sip serv 10.133.137.2 [sip.telecom.kz])

Задача банальна - входящая\исходяшая связь по sip 8)

sip транк конф: PEER Details:

username=18xx5yy5zz 
type=friend 
nat=yes 
qualify=no 
canreinvite=no 
insecure=very 
secret=passwd
host=10.133.137.2
fromuser=18xx5yy5zz
fromdomain=sip.telecom.kz
dtmfmode=rfc2833
disallow=all
context=from-trunk
allow=ulaw&alaw&g729

User details: оставил пустым ;)

18xx5yy5zz:passwd@sip.telecom.kz/18xx5yy5zz

pbx1*CLI> sip show registry
Host                            Username       Refresh State     
sip.telecom.kz:5060             18xx5yy5zz         585 Registered

При исходящем звонке на номер 291 20 91 получаю Forbidden 304 от сип сервера.

Reliably Transmitting (NAT) to 10.133.137.2:5060:
INVITE sip:2912091@10.133.137.2 SIP/2.0
Via: SIP/2.0/UDP 192.168.2.2:5060;branch=z9hG4bK4b51d959;rport
From: "3307574" <sip:18xx5yy5zz@10.133.137.2>;tag=as634946f6
To: <sip:2912091@10.133.137.2>
Contact: <sip:18xx5yy5zz@192.168.2.2>
Call-ID: 1d9c4cd42837befb7ce058df20e38b85@10.133.137.2
CSeq: 102 INVITE
User-Agent: Asterisk PBX
Max-Forwards: 70
Date: Fri, 03 Jun 2011 17:40:31 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Supported: replaces
Content-Type: application/sdp
Content-Length: 307

v=0
o=root 2737 2737 IN IP4 192.168.2.2
s=session
c=IN IP4 192.168.2.2
t=0 0
m=audio 19556 RTP/AVP 18 0 8 101
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=silenceSupp:off - - - -
a=ptime:20
a=sendrecv

---
    -- Called IDPhone/2912091
pbx1*CLI>
<--- SIP read from 10.133.137.2:5060 --->
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 192.168.2.2:5060;received=192.168.2.2;branch=z9hG4bK4b51d959;rport=5060
From: "3307574" <sip:18xx5yy5zz@10.133.137.2>;tag=as634946f6
To: <sip:2912091@10.133.137.2>
Call-ID: 1d9c4cd42837befb7ce058df20e38b85@10.133.137.2
CSeq: 102 INVITE


<------------->
--- (6 headers 0 lines) ---
pbx1*CLI>
<--- SIP read from 10.133.137.2:5060 --->
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP 192.168.2.2:5060;received=192.168.2.2;branch=z9hG4bK4b51d959;rport=5060
From: "3307574" <sip:18xx5yy5zz@10.133.137.2>;tag=as634946f6
To: <sip:2912091@10.133.137.2>;tag=aprqngfrt-44ngeo00000c6
Call-ID: 1d9c4cd42837befb7ce058df20e38b85@10.133.137.2
CSeq: 102 INVITE

С входящими проблем нет =)

Други, подскажите куда ковырять?