Thank you!
I added rtp_secure_media=forbidden to the External SIP profile. After flushing cache, reloading XML, and rebooting, no difference.
Without SRTP, all calls, inbound, outbound, and internal work flawlessly.
With SRTP I can call between internal extensions perfectly, no errors. But...