asterisk users - May 2004 - SIP auth in/outside of nat?

I've got asterisk running behind a firewall.   On all machines in this 
narrative the domain name of the asterisk server resolves to the 
outside IP address.

The soft-phone can place calls just fine if it's outside the firewall.

Inside the firewall 'sip debug' that the soft-phone has connected but 
authentication appears to fail.

If I configure the soft-phone with the internal IP address of the 
asterisk server it works again.

I'm confused.  Help?

  - ben

softphone: x-lite/mac
asterisk 0.9.0 on freebsd