Brad, Brian, thanks for your replies
Actually, the switch is not used in the standard setup, where the external profile is used as a gateway and the internal (default) profile for directly connected sip clients.
In my case, the switch has two profiles. The so called external is connected to another switch, just passing calls. The connection is routed. The second profile (internal) which is giving me troubles, is used for registering SIP clients. The SIP clients are usually behind their own NAT routers.
SIP-IP and EXT-SIP-IP are both the same public IP, since the router is publicly visible on the internal profile. On the external profile, they are assigned to a private internal IP. The switch is sitting on two subnets.
Now, the local-network-acl is set to localnet.auto on both profiles. I was assuming ACLs are used solely for security!
Hynek