SPA400 behind NAT

[Undel]

I'm trying to register asterisk on SPA400 device, but no luck - request sent and... nothing.
I've forwarded ports 5060 and 10000 on my router (at this stage I just try to establish SIP connection, RTP is not the case now).
Asterisk's sip.conf contain:

[general]
register=spa400@172.16.1.3/spa400

[spa400]
port=5060
type=friend
user=spa400
host=172.16.1.3
dtmfmode=rfc2833
canreinvite=no
context=from-trunk
insecure=very
nat=yes
externip = 79.165.200.209 
fromdomain = MYDOMAIN.LOCAL 
localnet = 172.16.1.0/255.255.255.0 
qualify=yes

I've added trunk with the same parameters:

disallow=all
allow=ulaw
canreinvite=no
context=from-trunk
dtmfmode=rfc2833
host=172.16.1.3
incominglimit=1
nat=yes
externip=79.165.200.209
fromdomain=MYDOMAIN.LOCAL
localnet=172.16.1.0/255.255.255.0
qualify=yes
port=5060
type=friend
username=1-pstn

and registration string:

register=spa400@172.16.1.3/spa400

What am I doing wrong?

Asterisk has public IP address, but SPA400 can be placed only behind NAT(DMZ is not an option too, it's used for web server).
IP addresses shown here are not the same, which I really use.