I'd need to see a wireshark to give you definitive answer, but Forbidden to me means that the telco rejected the call, likely its a password (you didnt put in the correct one) or IP issue - the telco doesnt know the correct external IP for your pbx. Also, make sure your external IP is set in the KSU correctly or the telco will reject the call for sure thinking its someone trying to hack.