Issue with Avamar 7 Proxy Registeration

I'm having an issue with registering a proxy (7.0.101-61) on my Avamar grid (7.0.101-61).  We are an MSP so we have customers that access our grid via a public address.  When we try to activate a proxy with the public FQDN we get to the point where we are asked if we changed the GSAN password.  We have changed the password from the default GSAN password but for some reason it indicates we are using an "invalid password".  I'm able to successfully login to the Avamar Administration Console with the GSAN root user account and the updated password.  Still the proxy doesn't allow us to successfully mount it to the grid (although even with the invalid password the proxy is added to the grid and I can backup clients).  Because of the unsuccessful mount of the proxy even with successful backup jobs completing, the Activity Session of the job is empty, it seems to be hit or miss on images that I can perform FLRs on, etc.  Here is where it starts to get strange, we have another grid at another location that is fairly new but currently on the 7.0.101-61 version and using the 7.0.101-61 proxy.  This grid is currently using the default password for GSAN.  It was also failing until I talked to upper level support and they indicated that I didn't have all the ports open necessary for the new proxy (28002-28009) which deploys 8 different streams for one deployed proxy (which I might add isn't listed in any documentation that those ports need to be open but that is another topic for another thread).  So we opened those ports on the firewall that is dedicated for this grid that uses defaults passwords and once we did we could successfully mount the proxy, Activity Session logs were populated, and every image level machine on that grid could perform an FLR. 

Now back to my original grid with the updated passwords.  The grid itself sits internally on a domain.   The grid is presented to our customers via a public facing IP/FQDN and then we allow the firewall to do a NAT translation to point those customers to the internal address.  If I try to activate a proxy internally on a network that is aware of the internal address/FQDN using that name it goes through and mounts successfully.  If I try to do the same thing using the public facing IP/FQDN I get the "invalid password" error.  So for our customers who are not aware of the internal IP/FQDN and only know of the public IP/FQDN we can never get a proxy registered correctly.  Does anyone have any ideas about what may be causing the grid to think that I'm using an incorrect password when I try to register using the public IP/FQDN?  When we were using 6.1 for both Avamar version and proxy version this worked as expected.  Nothing has changed to the environment except for the version of Avamar and proxy that we are using.  I'm able to ping and use telnet on all proxies and they all respond or connect as expected on the relevant ports needed.  I'm stuck with this error and I don't have a good answer why its happening.

Any help is appreciated and my apologies for such a long post.  I hope it makes sense but I wanted to make sure I included all the steps we have taken and pertinent information in this post.