[SR-Users] cisco spa502g issues

Hi guys, we have a bunch of SIP phones behind a fire wall, with our kamalio server out on the internet. Most of them are the older SPA92x series, but we have some new SPA502g's. We have no problems calling between 92x and 502's. How ever the 502's calling each other do not get voice path. I have noticed that the phones REGISTER differently: AOR:: 5546@<our domain> Contact:: sip:5546@<OUR OFFICE IP>:1032 Q= Expires:: 180 Callid:: 4754c4f9-c67e1018(a)10.0.41.29 Cseq:: 43112 User-agent:: Cisco/SPA502G-7.6.2a State:: CS_DIRTY Flags:: 0 Cflag:: 0 Socket:: udp:<OUR SR IP>:5060 Methods:: 6815 AOR:: 5590(a)sip.skunkworks.net.au Contact:: sip:5590@10.0.41.14:5060 Q= Expires:: 1154 Callid:: 24435738-224b06db(a)10.0.41.14 Cseq:: 8012 User-agent:: Linksys/SPA921-5.1.8 Received:: sip:<OUR OFFICE IP>:1026 State:: CS_SYNC Flags:: 0 Cflag:: 64 Socket:: udp:<OUR SR IP>:5060 Methods:: 4767 The older 921 has its private IP in the contact, where as the newer 502 has the external IP of our office in the contact. Our file wall is a Watchguard T-10 (latest updates etc) with the SIP-ALG running. Any thoughts on where to start looking ? Cheers, Ben.