Android sip phone extention 401 error

I have had this working for some time, but at times, like now, the sip phone does not register. I am trying to figure out this error.

— Transmitting (no NAT) to 216.232.xxx.xx:1025 —>
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 216.232.xxx.xx:49154;branch=z9hG4bKPjkFOXAeaz6zPf8adQrt7d5tow9CW44XMm;received=216.232.xxx.xx;rport=1025
From: “202” sip:[email protected];tag=9618B-JI1ME.R6oQZm.59IKyrE2uKtZZ
To: “202” sip:[email protected];tag=as5e74cb7b
Call-ID: 6MHhLB33ogNUvzhij9YFItHHRySOSlIV
CSeq: 47229 REGISTER
Server: FPBX-2.10.0rc1(1.8.11)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="29bff5fa"
Content-Length: 0

My sip phone is setup as follows

account name: 202
CallerID 202
Server 216.232.xxx.xx
username 202
Sup Authentication ID: Leave blank for same then username
Password: xxxxxx
USe TCP (not UDP): left unchecked
Proxy: not set

Now I just changed the server ip address to the internal 192.xxx.xxx.xxx address and it does register. Nat issue?

Here is sip_general_addition.conf
vmexten=*97
context=from-sip-external
callerid=Unknown
notifyringing=yes
notifyhold=yes
tos_sip=cs3
tos_audio=ef
tos_video=af41
alwaysauthreject=yes
useragent=FPBX-2.10.0rc1(1.8.11)
disallow=all
allow=ulaw
allow=alaw
allow=gsm
callevents=no
bindport=5060
bindaddr=0.0.0.0
jbenable=yes
jbforce=yes
jbimpl=fixed
jbmaxsize=200
jblog=no
jbresyncthreshold=1000
defaultexpiry=120
maxexpiry=3600
minexpiry=60
allowguest=no
srvlookup=no
registerattempts=0
registertimeout=20
notifyhold=yes
rtptimeout=30
g726nonstandard=no
t38pt_udptl=yes
videosupport=no
maxcallbitrate=384
canreinvite=no
rtpholdtimeout=300
rtpkeepalive=0
checkmwi=10
notifyringing=yes
nat=yes
externip= 216.232.xxx.xx
localnet=192.168.1.0/255.255.255.0

and sip additional_conf
cat /etc/asterisk/sip_additional.conf
;--------------------------------------------------------------------------------;
; Do NOT edit this file as it is auto-generated by FreePBX. All modifications to ;
; this file must be done via the web gui. There are alternative files to make ;
; custom modifications, details at: http://freepbx.org/configuration_files ;
;--------------------------------------------------------------------------------;
;

This is the sip phone bellow
[202]
deny=0.0.0.0/0.0.0.0
secret=xxxxxxx
dtmfmode=rfc2833
canreinvite=no
context=from-internal
host=dynamic
trustrpid=yes
sendrpid=no
type=friend
nat=no
port=5060
qualify=yes
qualifyfreq=60
transport=udp
encryption=no
callgroup=
pickupgroup=
allow=ulaw
allow=alaw
dial=SIP/202
mailbox=202@device
permit=0.0.0.0/0.0.0.0
callerid=acmetelecom <202>
callcounter=yes
faxdetect=no

[vitel-inbound]
type=friend
dtmfmode=auto
context=from-trunk ; (this could be ext-did or from-pstn as well)
insecure=port,invite
insecure=port,invite
canreinvite=no
host=inbou.xxxx.xxx
allow=all
nat=yes

[vitel-outbound]
type=friend
dtmfmode=auto
username=xxxx
secret=xxxx
fromuser=xxx
trustrpid=yes
sendrpid=yes
context=from-trunk ; (this could be ext-did or from-pstn as well)
canreinvite=no
canreinvite=no
host=outbound.vitelity.net
allow=all
nat=yes

Thanks much! again, phone registered internall to wifi network, but want it to register outside of network, should I want to access system in the field.

Make sure the correct ports are open and routed to the server.

I use the following
5222 UDP
5060 - 5061 UDP
10000 - 20000 UDP (this many ports is not normally required for small home systems, I believe they are used for Multimedia.

rtp ports 10000-20000 straming media are set

5060 and 5061 open but never heard of ports 5222. Never used this in the past and it did register.

Used asterisk for a long time so always know to have these open in the router. I can double check rtp.conf to make sure they are included.