Damn. That was it. I use dd-wrt and disabled the SPI firewall. Sure enough, Caller ID came up with 1 ring.

I've been hesitant to disable that, since I was using that firewall. Amazing how you forward like 50,000 ports .. and even with putting the PAP2 in the DMZ .. you still don't have full connectivity without getting turning off the SPIf.