Asterisk NAT SIP 2.0 Unathorized 401 Weird scenario - asterisk

Question

First of all I have already taken a look at similar questions such as :
https://serverfault.com/questions/392979/asterisk-sip-2-0-401-unauthorized
or
https://serverfault.com/questions/574166/asterisk-401-unauthorized-when-trying-to-register-sip-clients
yet they do not apply to my situation or the solutions do not solve my issue.
I have one asterisk 1.8 box sitting on site A .
Site A has a public static IP and a local class c network 192.168.1.X , asterisk is behind NAT.
Some phones are on the same local network, while others are in site B.
Site B has another public static IP and a local class c network 192.168.2.X.
So, phones on site B are behind nat aswell.
Strangely, some phones on site B are able to register, while others not.
The most interesting example is one grandstream gxp 2100.
This phone has 3 accounts with the following configuration configurations :
[1000]
deny=0.0.0.0/0.0.0.0
secret=xxxxxx
dtmfmode=rfc2833
canreinvite=no
context=from-internal
host=dynamic
trustrpid=yes
sendrpid=no
type=friend
nat=yes
port=5060
qualify=3000
qualifyfreq=60
transport=udp
encryption=no
callgroup=
pickupgroup=
dial=SIP/1000
mailbox=1000#device
permit=0.0.0.0/0.0.0.0
callerid=TONY - Lab Line 1 <1000>
callcounter=yes
faxdetect=no
cc_monitor_policy=generic
[3000]
deny=0.0.0.0/0.0.0.0
secret=xxxxxxx
dtmfmode=rfc2833
canreinvite=no
context=from-internal
host=dynamic
trustrpid=yes
sendrpid=no
type=friend
nat=yes
port=5060
qualify=3000
qualifyfreq=60
transport=udp
encryption=no
callgroup=
pickupgroup=
dial=SIP/3000
mailbox=3000#device
[9000]
deny=0.0.0.0/0.0.0.0
secret=xxxxxxxxxxx
dtmfmode=rfc2833
canreinvite=no
context=from-internal
host=dynamic
trustrpid=yes
sendrpid=no
type=friend
nat=yes
port=5060
qualify=3000
qualifyfreq=60
transport=udp
encryption=no
callgroup=
pickupgroup=
dial=SIP/9000
mailbox=9000#device
Only account 1000 and 3000 are able to register, while account 9000 encounters the following error:
<--- SIP read from UDP:95.254.61.X:5064 --->
REGISTER sip:95.231.94.6 SIP/2.0
Via: SIP/2.0/UDP 192.168.2.190:5064;branch=z9hG4bK1380984150;rport
From: <sip:9000#95.231.94.6>;tag=1294836145
To: <sip:9000#95.231.94.6>
Call-ID: 844020207-5064-1#BJC.BGI.C.BJA
CSeq: 2672 REGISTER
Contact: <sip:9000#192.168.2.190:5064>;reg-id=3;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B8251202A>"
X-Grandstream-PBX: true
Max-Forwards: 70
User-Agent: Grandstream GXP2100 1.0.5.23
Supported: path
Expires: 3600
Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, UPDATE, MESSAGE
Content-Length: 0
<------------->
--- (14 headers 0 lines) ---
Sending to 95.254.61.X:5064 (NAT)
<--- Transmitting (NAT) to 95.254.61.X:5064 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.2.190:5064;branch=z9hG4bK1380984150;received=95.254.61.248;rport=5064
From: <sip:9000#95.231.94.6>;tag=1294836145
To: <sip:9000#95.231.94.6>;tag=as54ceb003
Call-ID: 844020207-5064-1#BJC.BGI.C.BJA
CSeq: 2672 REGISTER
Server: FPBX-2.10.1(1.8.21.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="47737672"
Content-Length: 0
<------------>
What do you think is causing this issue?
Thank you in advance for your kind support and help!

Answer 1

That is normal behavour of asterisk
Asterisk answer as UNATHORIZED with NEW nonce packet. After that client have answer again with md5sum calculated with that nonce.
Very likly in your case client NOT receive that packet for some reason(incorrect nat setup, firewall etc)