[asterisk-users] SCCP (skinny) phone behind NAT: RTP dest addr wrong

[Infra]

Greetings:

I have a working configuration for SCCP on our LANS which doesn't
route RTP correctly to a skinny phone behind NAT registering from
a remote public IP.

Configuration:

asterisk 1.4.35 servicing only skinny phones trunked to
asterisk 1.2.40 which services chan_phone FXS, zap FXO
and SIP phones; both instances of asterisk are behind NAT
and run on the same host (using different base directories)

working: cisco 7920 on wireless LAN behind NAT (172.16.5.0/24)

rtp problem: cisco 7920 on public access point behind NAT

symptom: asterisk is sending rtp to the NAT address of the
phone, e.g. 192.168.0.3

in skinny.conf, nat=yes is set for the context block of the
phone.

tcpdump of port 2000 reveals one packet after placing a call
from the phone that includes the NAT ip address of the phone
(c0a8 0003):

12:14:18.812960 IP (tos 0x0, ttl 50, id 16034, offset 0, flags [none],
proto
TCP (6), length 72)
    71.215.193.161.1025 > 216.251.177.106.2000: Flags [P.], cksum 0x461d
(correct), seq 148:180, ack 569, win 16384, length 32
        0x0000:  4500 0048 3ea2 0000 3206 b62f 47d7 c1a1
E..H>¢..2.¶/G×Á¡
        0x0010:  d8fb b16a 0401 07d0 7c8a ecc6 710d 8d62
Øû±j...Ð|.ìÆq..b
        0x0020:  5018 4000 461d 0000 1800 0000 0000 0000
P. at .F...........
        0x0030:  2200 0000 0000 0000 c0a8 0003 ba71 0000
".......À¨..ºq..
        0x0040:  6d00 0000 0000 0000                      m.......

packet tracing RTP at the border router shows (on the LAN segment
of the asterisk host), e.g.

11:43:54.380567 IP (tos 0x0, ttl 64, id 737, offset 0, flags [DF], proto
UDP
(17), length 200)
    pbx1.cybertheque.net.20002 > 192.168.0.3.29112: UDP, length 172


Shouldn't 'net=yes' in skinny.conf force asterisk to use the public IP
of the phone?

Help much appreciated!

Michael