It’s not even a good workaround, because if an incoming call arrives during the brief unreachable interval, it will go to voicemail. However, a short expiry is usually a good idea for other reasons. If a momentary network outage causes qualify to fail, the lack of traffic may cause the remote router to close the NAT association, resulting in future OPTIONS requests not being delivered, until the device registers again, up to an hour later.
pjsip show contacts shows the address and port where an incoming call would be sent. If you have more than one endpoint behind the same NAT, all sending REGISTER from their local port 5060, the router/firewall must translate the source port number for all but one, whether SIP ALG is enabled or not. Otherwise, two endpoints would appear to be on the same port and the router wouldn’t know where to send the replies. While most NAT routers only modify the source port when there would otherwise be a conflict, I believe that USG by default always selects a random source port.
If pjsip show contacts for each extension shows the public IP address and port number from which REGISTER was received, regardless of the content of any headers, that is correct behavior. Anything else is a problem at the PBX end.
If the OPTIONS request is sent to other than the address and port indicated by pjsip show contacts, that’s a problem at the PBX end.
And, if the Contact header in the OPTIONS request contains anything other than the public IP of the PBX and the port that pjsip is listening on, that’s a problem at the PBX end.
Note that when any setting regarding IP addresses or ports is changed, you must restart (not just reload) Asterisk. If you’re not sure, reboot the entire server.