3CX supports SIP and I have yet to come across any SIP enabled phone/ATA or other endpoint that has not been able to register.
When a phone attempts to contact a server, the server will challenge the endpoint to provide the authentication details. The phone should, upon receiving the challenge, then respond back to the server with the initial request and the needed authentication to allow the registration. This is a standard SIP messaging scheme with the only variables being the details that you entered into the account page.
As the phone is remote, and not knowing more, it would be to your advantage to bring the phone back to 3CX, assuming not local, and connecting to the local LAN to get the registration. At least this way, you can prove to yourself that 3CX is not singling out the t49. The issue is related to the wrong creds being supplied (perhaps from a copy and paste that added a space or other invisible character) or the NAT is wrong and while the server is seeing the registration and issuing the challenge, the remote t49 is not and not seeing the 407, just sends a simple register request again and again.
A wireshark capture at the server end showing the registration attempt may show the issue. If the t49 is using the private IP to tell the server to respond to, then that is the issue. While I do not have a t49, Yealink usually has a setting in the advanced account page - Keep Alive - set to notify, Interval 30 seconds or less, rport - enabled. You can try this and see, but not knowing more, just a guess as to what may work. These settings merely try and keep the firewall open and use a random port. You may also need to go to the network settings and enable NAT and plug in an IP (public).