So, you have multiple issues here with your firewall/internet connection that you will need to solve.
SIP ALG Failed means that the PBX could not contact the SIP ALG detector or did not receive the response from that server. As you can see during the test, the pbx sends a request to the server sip-alg-detector-.3cx.com, this traffic must be allowed IN/OUT.
On tunnel port 5090 Full Cone Nat Failed, it means that the port is closed or it is restricted, for example using an ACL or blocked by Geo IP. Tunnel port 5090 TCP/UDP must be opened publicly without any restriction.
Then the error Mapping Does Not Match, these errors mean that you are not using Port Preservation. So if the pbx internally sends a request using the port 9000 UDP then when packet leaves the local LAN the packet must be sent with the same port 9000 and not changing to another port, in your test it was changed to 42728.
You will need to check this issue with your ISP as well since most of the ISP when a non corporate internet connection is use, then they normally apply these remapping.
Also note that no source port remapping should be used in the firewall.
If you need further assistance configuring your firewall, please enter in contact with the vendor.
Once the firewall checker pass successfully, then try it again.