Oh - and in my actual config, I used the (I believe) correct "ip firewall nat-preserve-source-port record-source-address".
Have you tried upgrading to R12.3.3 as that is the latest GA.
What ACLs do you have setup and which access-policy's are they tied to?
media-gateway ip primary is enabled on both ports facing the provider as well as the pbx?
what are the firewall settings starting with: